{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-06T00:42:09.729Z","url":"https://verifymcp.io/servers/robertkeus-keep-me-secure-mcp/ghcr-io-robertkeus-keep-me-secure-mcp","markdownUrl":"https://verifymcp.io/servers/robertkeus-keep-me-secure-mcp/ghcr-io-robertkeus-keep-me-secure-mcp.md","server":{"slug":"robertkeus-keep-me-secure-mcp","name":"Keep Me Secure","registryName":"io.github.robertkeus/keep-me-secure-mcp","description":"Tells your coding agent whether your installed packages need patching, with advice on what to do.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"ghcr-io-robertkeus-keep-me-secure-mcp","type":"oci","identifier":"ghcr.io/robertkeus/keep-me-secure-mcp","withdrawn":false,"url":"https://verifymcp.io/servers/robertkeus-keep-me-secure-mcp/ghcr-io-robertkeus-keep-me-secure-mcp","version":"v1.4.0","transport":"stdio","scoredAt":"2026-11-05T20:03:06.710Z"},"score":{"total":38,"tier":"low","status":"scored","weekDelta":null,"history":[{"date":"2026-11-05","total":38}]},"categories":[{"name":"Supply Chain Security","score":0,"verdict":"unverified","reasons":["No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.","Known CVEs could not be checked: this image's dependency list comes from an SBOM its publisher attached, which nothing verifies, so we will not report it as a clean result.","Install-script risk not yet assessed.","Dependency health could not be checked: this image's dependency list comes from an SBOM its publisher attached. It names packages and versions but not whether each is deprecated, still maintained or linked to its source, so there is nothing we can fairly grade."],"codes":[{"code":"supplychain.malware_inconclusive","args":{"reason":"ecosystem_unsupported"}},{"code":"cve.inconclusive","args":{"reason":"sbom_unverified"}},{"code":"installscript.inconclusive","args":{"reason":"no_install_concept"}},{"code":"dephealth.inconclusive","args":{"reason":"sbom_no_registry_facts"}}]},{"name":"Provenance & Transparency","score":35,"verdict":"fail","reasons":["Source repository is publicly reachable at the declared URL.","Provenance check failed: no build-provenance attestation is published.","License check failed: no license is declared.","Actively maintained (last published 0 days ago).","Publishes a security disclosure policy (SECURITY.md)."],"codes":[{"code":"provenance.repo_verified","args":{}},{"code":"provenance.none","args":{}},{"code":"license.absent","args":{}},{"code":"maintenance.recent","args":{"age_days":"0"}},{"code":"disclosure.present","args":{}}]},{"name":"Schema Quality & AI Usability","score":73,"verdict":"fail","reasons":["AI-judged instruction clarity (excellent).","Context-footprint check failed: tool/resource definitions use about 494 tokens (~164/item across 3 items; 3 tools + 0 resources), over budget; trim descriptions and params.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"excellent"}},{"code":"schema.footprint_heavy","args":{"avg":"164","items":"3","tools":"3","tokens":"494","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":0,"verdict":"unverified","reasons":["Stability observed for 0 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"0"}}]},{"name":"Tool Coverage","score":100,"verdict":"pass","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","100% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"100"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","We read all 3 captured tool definition(s), and no name or description among them implies an irreversible operation.","An AI judge read all 4 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_none","args":{"tools":"3"}},{"code":"toolsafety.manipulation_clean","args":{"units":"4","judged":"4"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28."],"codes":[{"code":"protocol.supported","args":{"latest":"2026-07-28","version":"2025-11-25"}}]}],"inconclusive":["No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.","Known CVEs could not be checked: this image's dependency list comes from an SBOM its publisher attached, which nothing verifies, so we will not report it as a clean result.","Install-script risk not yet assessed.","Dependency health could not be checked: this image's dependency list comes from an SBOM its publisher attached. It names packages and versions but not whether each is deprecated, still maintained or linked to its source, so there is nothing we can fairly grade.","Stability observed for 0 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"malware":[],"components":[{"slug":"mcp","type":"remote","identifier":"https://mcp.keepmesecure.dev/mcp","withdrawn":false,"score":66,"current":false,"url":"https://verifymcp.io/servers/robertkeus-keep-me-secure-mcp/mcp","markdownUrl":"https://verifymcp.io/servers/robertkeus-keep-me-secure-mcp/mcp.md"},{"slug":"ghcr-io-robertkeus-keep-me-secure-mcp","type":"oci","identifier":"ghcr.io/robertkeus/keep-me-secure-mcp","withdrawn":false,"score":38,"current":true,"url":"https://verifymcp.io/servers/robertkeus-keep-me-secure-mcp/ghcr-io-robertkeus-keep-me-secure-mcp","markdownUrl":"https://verifymcp.io/servers/robertkeus-keep-me-secure-mcp/ghcr-io-robertkeus-keep-me-secure-mcp.md"}],"facts":[{"label":"Registry","value":"oci"},{"label":"Package","value":"ghcr.io/robertkeus/keep-me-secure-mcp"},{"label":"Version","value":"v1.4.0"},{"label":"Transport","value":"stdio"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"check_project","title":"Is my stack secure?","description":"Use for questions like 'is my stack secure?', 'do I need to patch anything?' or 'do we have vulnerable packages?'. Checks every installed package, including transitive ones, in all lockfiles in this project against public security advisories. verdict is yes, no or unknown; unknown means the check was incomplete, so never report it as safe. Supports PHP, JavaScript, Python, Go, Rust, Ruby, Java (Gradle lockfiles) and .NET. Does not cover language runtimes, OS packages or Docker base images.","inputs":[{"name":"ecosystem","type":"string","required":false,"description":"Only to limit the check: php, npm, python, go, rust, ruby, java or dotnet. Omit for a full check."},{"name":"path","type":"string","required":false,"description":"Subfolder relative to the project root. Omit to scan the whole project. Test and example folders are skipped unless named here."},{"name":"refresh","type":"boolean","required":false,"description":"Ignore today's cached result"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":198},{"name":"check_platform","title":"Has this platform been breached?","description":"Lists known security incidents at hosting, deployment and AI platforms, with what to do and a link to the source. Use when the user asks about a platform or breach. Omit name to list all. The list is curated and not complete, so no result doesn't mean a platform is safe.","inputs":[{"name":"name","type":"string","required":false,"description":"Platform name, such as railway or vercel"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":83},{"name":"check_package","title":"Is this package version safe?","description":"Checks one exact package version against public security advisories.","inputs":[{"name":"ecosystem","type":"string","required":true,"description":"php, npm, python, go, rust, ruby, java or dotnet"},{"name":"name","type":"string","required":true,"description":"Package name, such as guzzlehttp/guzzle"},{"name":"version","type":"string","required":true,"description":"Exact version, such as 7.4.0"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":77}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-05T20:03:06.000Z","track":"package","endpoint":null,"declaredUrl":null,"truncated":false,"tls":null,"dnssec":null,"auth":null,"httpsRedirect":null,"transports":[],"provenance":{"outcome":"none","label":"No attestation","reason":"no_attestation","reasonLabel":"No attestation published","discovery":null,"discoveryLabel":null,"sourceRepo":null,"attestationSkipped":null,"attestationSkippedLabel":null},"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[{"id":"GHSA-6j4f-fj2g-mc7p","cve":"CVE-2026-102276","severity":"high","fixAvailable":true},{"id":"GHSA-q2hr-2g5m-vwhr","cve":"CVE-2026-102277","severity":"medium","fixAvailable":true},{"id":"GHSA-qhr7-859c-m2p7","cve":"CVE-2026-102278","severity":"high","fixAvailable":true},{"id":"GHSA-3g3m-2fjr-6pw4","cve":"CVE-2026-118773","severity":"medium","fixAvailable":true},{"id":"GHSA-2vr4-cq9g-pvrc","cve":"CVE-2026-101910","severity":"medium","fixAvailable":true},{"id":"GHSA-h3mg-xc3c-68pw","cve":"CVE-2026-101911","severity":"medium","fixAvailable":true},{"id":"GHSA-j6r3-76f7-8jcv","cve":"CVE-2026-101912","severity":"medium","fixAvailable":true},{"id":"GHSA-rpw4-54j3-4h4q","cve":"CVE-2026-101913","severity":"medium","fixAvailable":true},{"id":"GHSA-rxp7-6hxx-x8q5","cve":"CVE-2026-111997","severity":"medium","fixAvailable":true},{"id":"GHSA-g3hv-75wg-m249","cve":"CVE-2026-118764","severity":"medium","fixAvailable":true},{"id":"GHSA-rj75-hqrm-r3gf","cve":"CVE-2026-104844","severity":"medium","fixAvailable":true},{"id":"GHSA-2m5v-pch6-74hx","cve":"CVE-2026-109383","severity":"high","fixAvailable":true},{"id":"GHSA-3wwx-pv8p-q78v","cve":"CVE-2026-85024","severity":"medium","fixAvailable":true},{"id":"GHSA-4qv8-2p9j-2685","cve":"CVE-2026-109924","severity":"medium","fixAvailable":true},{"id":"GHSA-9fm3-97px-rjf6","cve":"CVE-2026-109932","severity":"medium","fixAvailable":true},{"id":"GHSA-qrxm-fqhp-jwvm","cve":"CVE-2026-87018","severity":"high","fixAvailable":true},{"id":"GHSA-r53p-7pc4-xj5r","cve":"CVE-2026-18540","severity":"low","fixAvailable":true},{"id":"GHSA-rfgv-xxqx-mfg5","cve":"CVE-2026-19534","severity":"high","fixAvailable":true},{"id":"GHSA-xjj6-f33q-929c","cve":"CVE-2026-109869","severity":"high","fixAvailable":true}],"vulnerabilitiesTotal":19,"dependencies":null},"mismatches":[],"changelog":{"trackingSince":"2026-11-05","recent":[{"id":"chg_01a1ad16-357a-7285-8f2a-03fda6f0912b","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/robertkeus-keep-me-secure-mcp/ghcr-io-robertkeus-keep-me-secure-mcp#chg-chg_01a1ad16-357a-7285-8f2a-03fda6f0912b"},{"id":"chg_01a1ab24-a6ed-761f-a0c1-ff96527375ac","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-05","url":"https://verifymcp.io/servers/robertkeus-keep-me-secure-mcp/ghcr-io-robertkeus-keep-me-secure-mcp#chg-chg_01a1ab24-a6ed-761f-a0c1-ff96527375ac"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/robertkeus-keep-me-secure-mcp/ghcr-io-robertkeus-keep-me-secure-mcp/changelog.json"},"links":{"html":"https://verifymcp.io/servers/robertkeus-keep-me-secure-mcp/ghcr-io-robertkeus-keep-me-secure-mcp","markdown":"https://verifymcp.io/servers/robertkeus-keep-me-secure-mcp/ghcr-io-robertkeus-keep-me-secure-mcp.md","changelogJson":"https://verifymcp.io/servers/robertkeus-keep-me-secure-mcp/ghcr-io-robertkeus-keep-me-secure-mcp/changelog.json","changelogRss":"https://verifymcp.io/servers/robertkeus-keep-me-secure-mcp/ghcr-io-robertkeus-keep-me-secure-mcp.xml","external":[{"label":"GitHub Container Registry","href":"https://ghcr.io/robertkeus/keep-me-secure-mcp"},{"label":"Repository","href":"https://github.com/robertkeus/keep-me-secure-mcp"},{"label":"Website","href":"https://keepmesecure.dev/"}]}}