{"id":"ffee5defd72e","status":"done","kind":"auto","source":"npm","target":"npm:@modelcontextprotocol/server-everything","name":"@modelcontextprotocol/server-everything","version":"1.0.0","verdict":"NO MALICIOUS BEHAVIOR OBSERVED","top_finding":null,"findings":3,"critical":0,"public":true,"confidence":null,"created_at":"2026-10-25T12:09:35.990529Z","finished_at":"2026-10-25T12:11:46.546343Z","report_url":"https://detonationlabs.com/r/ffee5defd72e","progress":[{"phase":"mcp","label":"baseline","status":"ok","duration":38.1,"new":["dns:example.com","dns:raw.githubusercontent.com","ownread:~/.npmrc","write:<skill>/node_modules/.bin/mcp-server-everything","write:<skill>/node_modules/.bin/node-which"],"findings":[],"note":"install scripts: exit 0; 52 tool calls"},{"phase":"mcp","label":"time-travel","status":"ok","duration":13.7,"new":[],"findings":[],"note":"install scripts: exit 0; 52 tool calls"},{"phase":"mcp","label":"ci-github","status":"ok","duration":38.2,"new":[],"findings":[],"note":"install scripts: exit 0; 52 tool calls"},{"phase":"mcp-agent","label":"agent","status":"ok","duration":18.9,"new":[],"findings":[],"note":"install scripts: exit 0"}],"error":null,"report":{"engine":"detonator 0.5.1","generated":"2026-10-25T12:11:46Z","target":{"name":"@modelcontextprotocol/server-everything","sha256":"564b83331f296eaca46f71d01c859eb0152ce93f825e11635dece4ec04d29f70","files":49,"scripts":["dist/index.js","dist/prompts/args.js","dist/prompts/completions.js","dist/prompts/index.js","dist/prompts/resource.js","dist/prompts/simple.js","dist/resources/files.js","dist/resources/index.js","dist/resources/session.js","dist/resources/subscriptions.js","dist/resources/templates.js","dist/server/index.js","dist/server/logging.js","dist/server/roots.js","dist/tools/echo.js","dist/tools/get-annotated-message.js","dist/tools/get-env.js","dist/tools/get-resource-links.js","dist/tools/get-resource-reference.js","dist/tools/get-roots-list.js","dist/tools/get-structured-content.js","dist/tools/get-sum.js","dist/tools/get-tiny-image.js","dist/tools/gzip-file-as-resource.js","dist/tools/index.js","dist/tools/simulate-research-query.js","dist/tools/toggle-simulated-logging.js","dist/tools/toggle-subscriber-updates.js","dist/tools/trigger-elicitation-request-async.js","dist/tools/trigger-elicitation-request.js","dist/tools/trigger-long-running-operation.js","dist/tools/trigger-sampling-request-async.js","dist/tools/trigger-sampling-request.js","dist/tools/trigger-url-elicitation.js","dist/transports/in-memory-event-store.js","dist/transports/listen.js","dist/transports/sse.js","dist/transports/stdio.js","dist/transports/streamableHttp.js","dist/version.js"],"declared":{},"trigger_hints":[],"source":"npm:@modelcontextprotocol/server-everything@1.0.0","command":"node skill/node_modules/@modelcontextprotocol/server-everything/dist/index.js","kind":"mcp","version":"1.0.0"},"verdict":"NO MALICIOUS BEHAVIOR OBSERVED","observed":{"network":["example.com","raw.githubusercontent.com"],"files_written":["<skill>/node_modules/.bin/mcp-server-everything","<skill>/node_modules/.bin/node-which","~/.npm/_logs/*-debug-0.log"],"secrets_read":[],"commands":[],"exfiltration":[]},"findings":[{"rule":"network-egress","severity":"low","title":"Network destinations contacted","evidence":["example.com","raw.githubusercontent.com"],"run_label":"mcp:baseline","confidence":"Info","confidence_reason":"Context recorded during the run.","why":"","technique":""},{"rule":"secret-read-by-owner","severity":"low","title":"A tool read its own credentials (e.g. gh, aws, ssh)","evidence":["~/.npmrc (by npm)"],"run_label":"mcp:baseline","confidence":"Info","confidence_reason":"Context recorded during the run.","why":"","technique":""},{"rule":"network-egress","severity":"low","title":"Network destinations contacted","evidence":["raw.githubusercontent.com"],"run_label":"mcp-agent:agent","confidence":"Info","confidence_reason":"Context recorded during the run.","why":"","technique":""}],"exploration":{"runs":[{"phase":"mcp","target":"@modelcontextprotocol/server-everything","label":"baseline","status":"ok","duration":38.146,"new_signatures":["dns:example.com","dns:raw.githubusercontent.com","ownread:~/.npmrc","write:<skill>/node_modules/.bin/mcp-server-everything","write:<skill>/node_modules/.bin/node-which","write:~/.npm/_logs/*-debug-0.log"],"findings":2,"note":"install scripts: exit 0; 52 tool calls","commands":[],"agent_reply":""},{"phase":"mcp","target":"@modelcontextprotocol/server-everything","label":"time-travel","status":"ok","duration":13.725,"new_signatures":[],"findings":0,"note":"install scripts: exit 0; 52 tool calls","commands":[],"agent_reply":""},{"phase":"mcp","target":"@modelcontextprotocol/server-everything","label":"ci-github","status":"ok","duration":38.189,"new_signatures":[],"findings":0,"note":"install scripts: exit 0; 52 tool calls","commands":[],"agent_reply":""},{"phase":"mcp-agent","target":"@modelcontextprotocol/server-everything","label":"agent","status":"ok","duration":18.852,"new_signatures":[],"findings":1,"note":"install scripts: exit 0","commands":["server_everything__echo({\"message\": \"Hello from the MCP everything server test run!\"})","server_everything__get-annotated-message({\"messageType\": \"success\", \"includeImage\": true})","server_everything__get-env({})","server_everything__get-resource-links({\"count\": 5})","server_everything__get-resource-reference({\"resourceType\": \"Text\", \"resourceId\": 2})","server_everything__get-structured-content({\"location\": \"Chicago\"})","server_everything__get-sum({\"a\": 42, \"b\": 58})","server_everything__get-tiny-image({})","server_everything__gzip-file-as-resource({\"name\": \"README.md.gz\", \"data\": \"https://raw.githubusercontent.com/modelcontextprotocol/servers/refs/heads/main/README.)","server_everything__toggle-simulated-logging({})","server_everything__toggle-subscriber-updates({})","server_everything__trigger-long-running-operation({\"duration\": 3, \"steps\": 3})","server_everything__simulate-research-query({\"topic\": \"Impact of MCP on AI tool integration\", \"ambiguous\": false})"],"agent_reply":"I called every tool on the `server_everything` server once. Here's what each returned:\n\n| Tool | Sample input | Result |\n|---|---|---|\n| `echo` | \"Hello from the MCP everything server test run!\" | Echoed the message back verbatim. |\n| `get-annotated-message` | `messageType: success`, `includeImage: true` | Returned \"Operation completed successfully\" (annotated content; the image wasn't surfaced in the text output). |\n| `get-env` | — | Dumped the server process environment: shell `/bin/bash`, use"}],"stopped":"mcp: coverage plateau (2 runs with no new behavior); agent: variants exhausted","model_usage":{"prompt_tokens":5190,"completion_tokens":1243,"llm_runs":1}},"note":"Observed behavior only. A clean result does not prove a package is safe.","summary":"Nothing malicious or suspicious happened in 4 runs.","recommendation":{"action":"No action needed","text":"Nothing observed calls for action. This is evidence, not a guarantee."},"iocs":{"hosts":["example.com","raw.githubusercontent.com"],"ips":[],"sha256":"564b83331f296eaca46f71d01c859eb0152ce93f825e11635dece4ec04d29f70","benign_hosts":[]},"coverage":{"runs":4,"phases":["mcp","mcp-agent"],"environments":["baseline","time-travel","ci-github","agent"],"tool_calls":156,"model_runs":1,"stopped":"mcp: coverage plateau (2 runs with no new behavior); agent: variants exhausted"},"tree":{},"confidence":""}}