npm/@modelcontextprotocol/server-everything
graded version 2026.7.4 · litmus-v16 · 2026-07-15
The changes below clear what held this to a F. Each is a concrete edit; re-run the litmus after to confirm the grade moves. See the full report for the matched evidence.
- C-03Sensitive-data handling· high
Planted secret surfaced back
A secret the server was handed (a planted canary) came back out — echoed in a tool output or carried over the network. A server that re-emits the data it’s given will leak the real thing in production.
Fix: Never echo input secrets in responses, logs, or error messages, and never forward them to a third-party host. Treat anything passed in as need-to-know and keep it inside the call.
at get-env
POLYGRAPH-CANARY-b8556af6-ab0e-49ff-8481-761fb1d8f45e
Confirm the fix
The harness is open and deterministic. Re-run it after your change and watch the grade and fingerprint move — the same run anyone else can reproduce.
npx -p @polygraphso/litmus polygraphso-litmus npm/@modelcontextprotocol/server-everything