Scan identity
This report is tied to a specific repository revision and scanner version. It is a time-bounded evidence record, not a permanent statement about the repository.
What the bounded scan found
No MCP configuration evidence was observed in the selected bounded repository scan. That does not prove MCP is absent elsewhere, including other branches, deeper paths, local client configuration or runtime environments.
The scan observed agent instruction/configuration signals, CI/CD automation and documentation-level download/install command markers. It did not observe shell/command-execution evidence in the inspected implementation set. README examples such as npx and git clone are documentation evidence, not proof that repository code executed those commands.
Evidence observed is not risk proven. Agent files, workflow files and command examples can be normal for the repository's purpose. ShadowMCP identifies review surfaces; it does not label them malicious.
Evidence categories
Shell / command execution
Not found in scanned scopeNo matching shell/command-execution evidence was observed in the selected bounded implementation evidence.
Download / install
FoundDocumentation command markers were observed; this does not mean ShadowMCP or repository code executed them.
README.mdnpx · git clone
MCP configuration
Not found in scanned scopeNo matching MCP configuration evidence was observed in the selected bounded scan. This is not proof of absence outside that scope.
Agent permissions / behavior
FoundAgent-related instruction, model, tool/permission and plugin markers were observed in selected files.
AGENTS.mdagent instruction/config file · hooks · agent instructions · model configCLAUDE.mdagent instruction/config file · tools / permissions · hooks · agent instructions.claude-plugin/marketplace.jsonagent instructions.claude-plugin/plugin.jsonagent instructionsscripts/run-evals-test.jsagent instructionsscripts/run-evals.jstools / permissions · agent instructionsscripts/validate-artifact-paths-test.jsagent instructionsscripts/validate-commands-test.jsagent instructionsscripts/validate-commands.jsagent instructionsscripts/validate-reference-links-test.jsagent instructionsscripts/validate-reference-links.jsagent instructions
CI/CD automation
FoundAutomation is present and deserves contextual review of triggers, permissions, secrets, third-party actions and deployment behavior.
.github/workflows1 direct workflow file
Supply-chain / dependencies
Not found in scanned scopeNo selected dependency evidence was observed in this bounded scan. This does not prove that the repository has no dependencies.
What to review first
AGENTS.mdandCLAUDE.md: confirm intended agent instructions, hooks, model configuration and requested tool/permission behavior..claude-plugin/*: review plugin metadata and instructions before enabling the plugin in a compatible client..github/workflows: inspect triggers, permissions, third-party actions, secret use and deployment or publishing steps.README.mdcommand examples: understand whatnpxand clone/install instructions would fetch or run before following them.- Selected scripts: inspect agent-related validation/evaluation scripts in context rather than treating markers as vulnerabilities.
Scan scope
The report used ShadowMCP's bounded root + selected depth-1 model. It did not perform a general recursive crawl.
| Scope item | Recorded value |
|---|---|
| Mode | BOUNDED_ROOT_AND_SELECTED_DEPTH1 |
| Selected maximum depth | 1 |
| Selected root files | 2 |
| Selected depth-1 directories | 5 |
| Selected depth-1 files | 10 |
| Skipped selected depth-1 files | 0 |
| Maximum readable file size | 250,000 bytes |
State semantics: FOUND means selected evidence was observed; it does not prove a vulnerability, malicious behavior or unsafe operation. NOT FOUND IN SCANNED SCOPE means matching evidence was not observed by the bounded checks; it does not prove absence elsewhere. NOT CHECKED is used when an evidence class or identity could not be meaningfully checked.
Repository context
These public signals describe the repository at scan time. Popularity, ownership, activity and license metadata are not security guarantees.
Limitations
- Public, selected and bounded repository evidence only.
- FOUND means evidence observed, not risk or malicious behavior proven.
- NOT FOUND IN SCANNED SCOPE is not proof of absence outside the bounded scan.
- Trust/community metadata is descriptive context, not a security guarantee.
- Zero selected dependency evidence does not mean zero dependencies.
- No repository clone or target-code execution.
- No raw source-file bodies or secret/token values are included.
- No general recursive crawl.
- No CVE lookup, package reputation lookup or package registry lookup.
- No numeric security score and no safe/unsafe verdict.
Continue the review
This is one bounded evidence snapshot, not a permanent certificate. If the repository changes after the recorded commit, rescan it and compare the new evidence against this revision.
Shadow MCP Discovery
Approved inventory, bounded evidence and runtime visibility are different things.