Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

3 of your 43 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 1.71s · analysis 11.23s · 0.4 MB · GitHub preflight 651ms

noelrim/midnight-mcp

https://github.com/noelrim/midnight-mcp · scanned 2026-06-19 19:49 UTC (1 month, 1 week ago) · 10 languages

57 raw signals (40 security + 17 graph) 30th percentile · Python · tiny (<2K LoC) System graph score 69 (lower by 4)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month, 1 week ago · v1 · 57 actionable findings from 2 signal sources. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

77.8% cov · 17 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	90.0	0.15	13.50
`security_score`	55.6	0.25	13.90
`testing_score`	70.0	0.20	14.00
`documentation_score`	40.0	0.15	6.00
`practices_score`	72.0	0.15	10.80
`code_quality`	68.0	0.10	6.80
Overall		1.00	65.0

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 0 High 8 Medium 32 Low 9 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 40 System graph 17 Crowd 0 Layer: Software 30 Quality 21 Security 5 Cicd 1

Exclude dismissed / FP Exclude test files

Scan summary Repository scanned at 68.6/100 with 77.8% coverage. It contains 316 nodes across 3 cross-layer flows, written primarily in mixed languages. Engine surfaced 17 findings — concentrated in quality (11), security (5), cicd (1). Risk profile is high: 0 critical, 1 high, 8 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 49 of 57 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high Security checks software dependencies conf 0.88 fast-uri: GHSA-q3j6-qgpj-74h6

fast-uri vulnerable to path traversal via percent-encoded dot segments

package-lock.json

high Security checks software dependencies conf 0.88 fast-uri: GHSA-v39h-62p7-jpjc

fast-uri vulnerable to host confusion via percent-encoded authority delimiters

package-lock.json

high Security checks quality Quality conf 0.80 ✓ Repobility FastAPI POST /search has no auth

Handler `search` is registered with router/app.post(...) but no Depends/Security parameter is declared and no auth marker appears in the function body.

query/index_server.py:209

high Security checks software dependencies conf 0.88 hono: GHSA-88fw-hqm2-52qc

hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard

package-lock.json

high Security checks software dependencies conf 0.88 path-to-regexp: GHSA-j3q9-mxjg-w52f

path-to-regexp vulnerable to Denial of Service via sequential optional groups

package-lock.json

high System graph security auth conf 1.00 FastAPI POST `search` without auth dependency — query/index_server.py:208

`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.

query/index_server.py:208 securityAuth fastapi unauth mutation

medium Security checks software dependencies conf 0.88 @hono/node-server: GHSA-92pp-h63x-v22m

@hono/node-server: Middleware bypass via repeated slashes in serveStatic

package-lock.json

medium Security checks quality Practices conf 1.00 [CFG006] Missing .gitignore: No .gitignore file. Risk of committing secrets and build artifacts.

Add a .gitignore appropriate for your language/framework.

medium Security checks software dependencies conf 0.88 brace-expansion: GHSA-f886-m6hf-6m8v

brace-expansion: Zero-step sequence causes process hang and memory exhaustion

package-lock.json

medium Security checks software dependencies conf 0.88 hono: GHSA-26pp-8wgv-hjvm

Hono missing validation of cookie name on write path in setCookie()

package-lock.json

medium Security checks software dependencies conf 0.88 hono: GHSA-2gcr-mfcq-wcc3

Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

package-lock.json

medium Security checks software dependencies conf 0.88 hono: GHSA-3hrh-pfw6-9m5x

Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

package-lock.json

medium Security checks software dependencies conf 0.88 hono: GHSA-458j-xx4x-4375

hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR

package-lock.json

medium Security checks software dependencies conf 0.88 hono: GHSA-69xw-7hcm-h432

hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection

package-lock.json

medium Security checks software dependencies conf 0.88 hono: GHSA-9vqf-7f2p-gf9v

Hono: bodyLimit() can be bypassed for chunked / unknown-length requests

package-lock.json

medium Security checks software dependencies conf 0.88 hono: GHSA-f577-qrjj-4474

Hono: JWT middleware accepts any Authorization scheme, not only Bearer

package-lock.json

medium Security checks software dependencies conf 0.88 hono: GHSA-j6c9-x7qj-28xf

hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice

package-lock.json

medium Security checks software dependencies conf 0.88 hono: GHSA-p77w-8qqv-26rm

Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage

package-lock.json

medium Security checks software dependencies conf 0.88 hono: GHSA-qp7p-654g-cw7p

Hono has CSS Declaration Injection via Style Object Values in JSX SSR

package-lock.json

medium Security checks software dependencies conf 0.88 hono: GHSA-r5rp-j6wh-rvv4

Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()

package-lock.json

medium Security checks software dependencies conf 0.88 hono: GHSA-rv63-4mwf-qqc2

hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`

package-lock.json

medium Security checks software dependencies conf 0.88 hono: GHSA-wgpf-jwqj-8h8p

hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

package-lock.json

medium Security checks software dependencies conf 0.88 hono: GHSA-wmmm-f939-6g9c

Hono: Middleware bypass via repeated slashes in serveStatic

package-lock.json

medium Security checks software dependencies conf 0.88 hono: GHSA-wwfh-h76j-fc44

hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

package-lock.json

medium Security checks software dependencies conf 0.88 hono: GHSA-xf4j-xp2r-rqqx

Hono: Path traversal in toSSG() allows writing files outside the output directory

package-lock.json

medium Security checks software dependencies conf 0.88 hono: GHSA-xpcf-pg52-r92g

Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

package-lock.json

medium Security checks software dependencies conf 0.88 hono: GHSA-xrhx-7g5j-rcj5

Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

package-lock.json

medium Security checks software dependencies conf 0.88 ip-address: GHSA-v2v4-37r5-5v8g

ip-address has XSS in Address6 HTML-emitting methods

package-lock.json

high Security checks software dependencies conf 0.90 npm package `googleapis` is 23 major version(s) behind (150.0.1 -> 173.0.0)

`googleapis` is pinned/resolved at 150.0.1 but the latest stable release on the npm registry is 173.0.0 (23 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise.

package.json

medium Security checks software dependencies conf 0.88 path-to-regexp: GHSA-27v5-c462-wpq7

path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards

package-lock.json

medium Security checks software dependencies conf 0.88 qs: GHSA-q8mj-m7cp-5q26

qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set

package-lock.json

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: assets/claude-skill/SKILL.md

This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.

assets/claude-skill/SKILL.md VerificationSkill file

medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: assets/codex-skill/SKILL.md

assets/codex-skill/SKILL.md VerificationSkill file

medium System graph quality Agent instructions conf 1.00 Agent instructions exist but release-hardening basics are missing

AI-coder instruction files were found, but the repo is missing license, ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable.

Repo hardeningGenerated repo pattern

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in cli.mjs:10

Found a known-risky pattern (node_child_process). Review and replace if possible.

cli.mjs:10 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in lib/commands/repo-sync.mjs:4

Found a known-risky pattern (node_child_process). Review and replace if possible.

lib/commands/repo-sync.mjs:4 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in lib/drive/helpers.mjs:6

Found a known-risky pattern (node_child_process). Review and replace if possible.

lib/drive/helpers.mjs:6 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in server.mjs:6

Found a known-risky pattern (node_child_process). Review and replace if possible.

server.mjs:6 Node child process

medium System graph cicd CI/CD security conf 1.00 No CI/CD pipelines detected

No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints.

CI/CD securityCoverage

low Security checks software dependencies conf 0.88 hono: GHSA-hm8q-7f3q-5f36

Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()

package-lock.json

low Security checks quality Documentation No LICENSE file

Add a LICENSE file to your repository. Use choosealicense.com to pick the right license (MIT for permissive, Apache 2.0 for patent protection, GPL for copyleft).

high Security checks software dependencies conf 0.90 npm package `@modelcontextprotocol/sdk` is minor version(s) behind (1.27.1 -> 1.29.0)

`@modelcontextprotocol/sdk` is pinned/resolved at 1.27.1 but the latest stable release on the npm registry is 1.29.0 (minor version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs…

package.json

low System graph quality Production readiness conf 1.00 Composite production-readiness gap

Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation.

Repo hardeningGenerated repo pattern

low System graph quality Debug conf 1.00 Debug logging residue appears in source files

Found 161 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.

CleanupRepo hardeningGenerated repo pattern

low System graph quality Tests conf 1.00 Low test-to-source ratio

3 tests / 14 src (ratio 0.21).

low System graph quality License conf 1.00 No license file detected

No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake.

Repo hardeningGenerated repo pattern

low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence

The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.

Git historyGenerated repo pattern

low System graph quality Complexity conf 1.00 Very large file: cli.mjs (1487 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

low System graph quality Complexity conf 1.00 Very large file: server.mjs (1924 lines)

Files with >800 lines often hide complexity hotspots and discourage tests.

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/69d2a968-a339-4169-84c9-27aaee063419/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/69d2a968-a339-4169-84c9-27aaee063419/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.