← Back to search

@yamo/mcp-server

GitHub Actions Scanned 28d ago

YAMO Protocol v0.4 - Model Context Protocol server for AI agents

C
73.4 / 100

Versions

1.3.14latest
Jan 6, 2026
1.3.13
Jan 5, 2026
1.3.12
Jan 5, 2026
1.3.11
Jan 5, 2026
1.3.10
Jan 5, 2026
+ show 9 moreshow less
1.3.9
Jan 5, 2026
1.3.4
Jan 5, 2026
1.3.2
Jan 4, 2026
1.3.1
Jan 4, 2026
1.3.0
Jan 3, 2026
1.0.5
Jan 3, 2026
1.0.4
Jan 3, 2026
1.0.1
Jan 2, 2026
1.0.0
Jan 2, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 5

yamo_submit_block
annotations: none low

Submits a YAMO block to the YAMORegistry smart contract. **IMPORTANT FORMAT REQUIREMENTS:** - blockId: Must follow YAMO naming convention: {origin}_{workflow} • Examples: "claude_chain", "aurora_weave", "document_translation" • Do NOT use sequence numbers (001, 002) - contentHash: Must be a valid bytes32 hash (32 bytes = 64 hex characters) • Format: "0x" followed by exactly 64 hexadecimal characters • Do NOT include algorithm prefixes (e.g., "sha256:") - previousBlock: Content hash of parent block. • If omitted, automatically fetches the latest block's contentHash • For genesis block: 0x0000000000000000000000000000000000000000000000000000000000000000 **Transaction Flow:** 1. If previousBlock omitted, fetches latest block from chain automatically 2. Content and files are uploaded to IPFS (if provided) 3. Block is submitted to smart contract with hash reference 4. Returns transaction hash and IPFS CID

yamo_get_block
annotations: none low

Retrieves full block data from the YAMO blockchain. Returns: - blockId: Unique block identifier - previousBlock: Content hash of parent block - agentAddress: Ethereum address of submitter - contentHash: 32-byte hash stored on-chain - timestamp: Block submission timestamp (Unix epoch) - consensusType: Consensus mechanism used - ledger: Distributed storage reference - ipfsCID: IPFS CID if content was anchored Use for: - Verifying block existence before submission - Getting previousBlock hash for chain continuation - Auditing block metadata - Exploring chain history

yamo_get_latest_block
annotations: none low

Retrieves the most recently submitted YAMO block from the blockchain. Queries BlockSubmitted events to find the block with the highest timestamp, then fetches its full details including the contentHash that should be used as previousBlock for the next submission. Returns: - blockId: Unique block identifier - previousBlock: Content hash of parent block - agentAddress: Ethereum address of submitter - contentHash: 32-byte hash stored on-chain (use as previousBlock for next submission) - timestamp: Block submission timestamp (Unix epoch) - consensusType: Consensus mechanism used - ledger: Distributed storage reference - ipfsCID: IPFS CID if content was anchored Use for: - Automatically getting the chain tip for extending the chain - Fetching the contentHash to use as previousBlock in submitBlock - Discovering the latest block without knowing its ID

yamo_audit_block
annotations: none low

Performs cryptographic integrity audit of a block. **Audit Process:** 1. Fetches block metadata from blockchain 2. Downloads content from IPFS (if CID exists) 3. Re-computes SHA-256 hash of downloaded content 4. Compares computed hash vs on-chain hash 5. Returns verification result with details **For Encrypted Blocks:** - Provide encryptionKey to decrypt before verification Returns detailed audit report including: - verified: true/false integrity check result - onChainHash: Hash stored on blockchain - computedHash: Hash computed from IPFS content - ipfsCID: IPFS content identifier - agentAddress: Submitter's Ethereum address - contentPreview: First 500 chars of content

yamo_verify_block
annotations: none low

Quick hash verification against on-chain record. **IMPORTANT:** This is a SIMPLE hash comparison, NOT a full content audit. It only checks if a provided hash matches what's stored on-chain. For full integrity verification (including IPFS content), use 'yamo_audit_block'. Returns: - "VERIFIED" if hash matches on-chain record - "FAILED" if hash does not match

Permissions 4

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, fs.promises, path
shell high
Server uses shell capabilities via: child_process, spawn()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 54

info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Tool 'yamo_submit_block' has no annotations annotation_checker · 100%
low
Tool 'yamo_get_block' has no annotations annotation_checker · 100%
low
Tool 'yamo_get_latest_block' has no annotations annotation_checker · 100%
low
Tool 'yamo_audit_block' has no annotations annotation_checker · 100%
low
Tool 'yamo_verify_block' has no annotations annotation_checker · 100%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.25.1 (GHSA-345p-7cg4-v4c7) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.25.1 (GHSA-8r9q-7v3j-jr4g) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-35jp-ww65-95wh) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-3g43-6gmg-66jw) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-3p68-rc4w-qgx5) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-3w6x-2g7m-8v23) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-42h9-826w-cgv3) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-43fc-jf86-j433) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-445q-vr5w-6q77) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-5c9x-8gcm-mpgx) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-62hf-57xw-28j9) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-6chq-wfr3-2hj9) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-777c-7fjr-54vf) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-7q8q-rj6j-mhjq) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-898c-q2cr-xwhg) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-fvcv-3m26-pcqx) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-hfxv-24rg-xrqf) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-j5f8-grm9-p9fc) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-jqh4-m9w3-8hp9) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-m7pr-hjqh-92cm) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-mmx7-hfxf-jppx) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-mwf2-3pr3-8698) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-p92q-9vqr-4j8v) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-pf86-5x62-jrwf) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-pmv8-rq9r-6j72) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-pmwg-cvhr-8vh7) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-q8qp-cvcw-x6jj) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-vf2m-468p-8v99) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-w9j2-pvgh-6h63) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-xhjh-pmcv-23jw) dependency_analyzer · 95%
medium
Vulnerable dependency: axios@1.13.2 (GHSA-xx6v-rp6x-q39c) dependency_analyzer · 95%
medium
Vulnerable dependency: form-data@4.0.5 (GHSA-hmw2-7cc7-3qxx) dependency_analyzer · 95%
medium
Hex string literal (>50 chars) in yamo-protocol-yamo-mcp-server-fa92665/test/security.test.js:37 entropy_analyzer · 70%
info
package.json metadata manifest_parser · 100%
info
Tool: yamo_submit_block manifest_parser · 90%
info
Tool: yamo_get_block manifest_parser · 90%
info
Tool: yamo_get_latest_block manifest_parser · 90%
info
Tool: yamo_audit_block manifest_parser · 90%
info
Tool: yamo_verify_block manifest_parser · 90%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (6) manifest_parser · 80%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 229 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%