中文 EN

扫描报告

扫描新文件

✓ 可信 — 风险评分 5/100
上次扫描：2 天前 重新扫描
5 /100
discovery-engine
Automatically discover novel, statistically validated patterns in tabular data. Find insights you'd otherwise miss, far faster and cheaper than doing it yourself.
This is a legitimate MCP server for a statistical pattern discovery service (Disco by Leap Laboratories) with no malicious indicators, no hidden functionality, and well-documented behavior that matches the implementation.
技能名称discovery-engine
分析耗时47.3s
引擎pi
✓
可以安装
Approve for use. No security concerns identified.

安全发现 2 项

严重性 安全发现 位置
低危
Unpinned dependency versions in pyproject.toml 供应链
pyproject.toml specifies dependencies with >= version specifiers: mcp>=1.0.0, httpx>=0.24.0, pydantic>=2.8.0. This allows any future version to be installed, which could theoretically introduce a vulnerability if a new release is compromised. However, this is standard Python packaging practice and no known vulnerabilities exist in these packages.
dependencies = [
    "mcp>=1.0.0",
    "httpx>=0.24.0",
    "pydantic>=2.8.0",
]
→ Consider pinning exact versions for reproducible builds, though this is a minor risk for established packages like these.
 pyproject.toml:28
提示
OAuth auth module referenced but not present in skill directory 文档欺骗
server.py imports from '.auth' module (DiscoOAuthProvider, create_callback_routes, DualAuthMiddleware) which is not included in this skill package. The import is conditionally gated behind 'if _OAUTH_SECRET' which requires environment variable to be set. This is a code stub for production deployment and does not represent a security risk in this package.
from .auth import DiscoOAuthProvider, create_callback_routes
→ No action needed. The .auth module is part of the full package distribution, not this skill stub.
 server.py:50
资源类型声明权限推断权限状态证据
文件系统 READ READ ✓ 一致 server.py:391 — Path(file_path).read_bytes() for local file upload only
网络访问 READ WRITE ✓ 一致 server.py:179 — _dashboard_request() POSTs to disco.leap-labs.com; file upload v…
命令执行 NONE NONE — No subprocess, os.system, or shell execution found in codebase
环境变量 READ READ ✓ 一致 server.py:32 — os.getenv('DISCOVERY_API_KEY') only; no iteration through os.envi…
技能调用 READ READ ✓ 一致 MCP tools: discovery_upload, discovery_analyze, discovery_status, discovery_get_…
剪贴板 NONE NONE — No clipboard access found
浏览器 NONE NONE — No browser automation found
数据库 NONE NONE — No database access found
29 项发现
🔗
中危 外部 URL 外部 URL
https://img.shields.io/pypi/v/discovery-engine-api
README.md:5
🔗
中危 外部 URL 外部 URL
https://img.shields.io/badge/License-MIT-blue.svg
README.md:6
🔗
中危 外部 URL 外部 URL
https://www.leap-labs.com
README.md:8
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com/api/signup
README.md:41
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com/api/signup/verify
README.md:46
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com/docs
README.md:52
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com/mcp
README.md:213
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com
README.md:274
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com/.well-known/openapi.json
README.md:280
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com/discover
README.md:281
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com/api/data/upload/presign
SKILL.md:138
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com/api/data/upload/finalize
SKILL.md:150
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com/sign-up
SKILL.md:290
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com/developers.
SKILL.md:290
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com/reports/a1b2c3d4-...
SKILL.md:374
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com/developers
SKILL.md:560
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com/account
SKILL.md:561
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com/api/account
SKILL.md:578
🔗
中危 外部 URL 外部 URL
https://api.stripe.com/v1/payment_methods
SKILL.md:591
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com/api/account/payment-method
SKILL.md:614
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com/api/account/credits/purchase
SKILL.md:632
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com/visualization-spec**
SKILL.md:844
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com/llms-full.txt
SKILL.md:851
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com/visualization-spec
SKILL.md:852
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com/.well-known/mcp.json
docs/python-sdk.md:426
🔗
中危 外部 URL 外部 URL
https://glama.ai/mcp/schemas/server.json
glama.json:2
🔗
中危 外部 URL 外部 URL
https://disco.leap-labs.com/agents
llms.txt:133
🔗
中危 外部 URL 外部 URL
https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json
server.json:2
🔗
中危 外部 URL 外部 URL
https://docs.disco.leap-labs.com
server.py:60

目录结构

9 文件 · 104.3 KB · 2688 行
Markdown 3f · 1584L Python 1f · 892L Text 1f · 136L TOML 1f · 46L JSON 2f · 29L YAML 1f · 1L
├─ ▾ 📁 docs
│ └─ 📝 python-sdk.md Markdown 446L · 15.6 KB
├─ 📋 glama.json JSON 4L · 98 B
├─ 📄 llms.txt Text 136L · 4.7 KB
├─ 📄 pyproject.toml TOML 46L · 1.5 KB
├─ 📝 README.md Markdown 283L · 10.4 KB
├─ 📋 server.json JSON 25L · 782 B
├─ 🐍 server.py Python 892L · 33.6 KB
├─ 📝 SKILL.md Markdown 855L · 37.7 KB
└─ 📋 smithery.yaml YAML 1L · 23 B

依赖分析 3 项

包名版本来源已知漏洞备注
mcp >=1.0.0 pip 否 Version not pinned — uses >= specifier
httpx >=0.24.0 pip 否 Version not pinned — uses >= specifier
pydantic >=2.8.0 pip 否 Version not pinned — uses >= specifier

安全亮点

✓ No shell execution (subprocess, os.system, shell=True) — codebase is pure Python with httpx for HTTP only
✓ No base64-encoded payloads piped to bash — file upload uses standard httpx AsyncClient
✓ No credential harvesting — only reads DISCOVERY_API_KEY from environment, does not enumerate os.environ for sensitive keys
✓ No sensitive path access — does not read ~/.ssh, ~/.aws, .env, or similar credential paths
✓ No hidden functionality — SKILL.md documentation is thorough and accurately describes all tool behaviors
✓ No curl|bash or wget|sh remote script execution patterns
✓ No eval(), exec(), or dynamic code execution
✓ Presigned URL upload pattern ensures file content goes directly to cloud storage, not through the agent
✓ API key read from environment variable to avoid parameter logging by MCP clients
✓ Clean git repo reference (github.com/leap-laboratories/discovery-engine) confirms public verifiability
✓ OAuth implementation uses official MCP auth library (mcp.server.auth) — no custom auth bypass logic
✓ No obfuscation techniques (no base64 payload decoding, no anti-analysis patterns)