Security flags foundOur static scan found signals worth reviewing before you trust this with an agent. See exactly what, per check, below.
Install-time hooks & dependenciesno flags
Code that runs when you install it, before you ever call a tool.
Runs code / shell commandsno flags
Whether the server can execute commands on your machine.
Secrets & credentials3 findings
HIGHdeepview_mcp/server.py:27 — A secret read into 'GEMINI_API_KEY' at line 25 reaches a log/print sink at line 27 within the same function: a credential may leak/exfiltrate. Confirm the data path.
INFOdeepview_mcp/server.py:25 — Reads a secret-shaped environment variable. Ordinary for a credentialed server; recorded for completeness.
INFOdeepview_mcp/test.py:24 — Reads a secret-shaped environment variable. Ordinary for a credentialed server; recorded for completeness.
Network calls outno flags
Hardcoded endpoints it reaches beyond what it documents.
Prompt-injection passthroughno flags
Whether it pipes untrusted external content back as agent instructions.
Permission scope breadthno flags
How much access it asks for versus what its job needs.