Static repository check
- Checked commit
be2fe2afddc7- Evidence Score
- 85/100
- Static risk
- Medium risk
- Files scanned
- 2
- Findings
- 6
Evidence breakdown
Source provenance25/25
Install documentation25/25
Maintenance17/20
Compatibility evidence8/20
Security signals10/10
Compatibility confidence: Limited
Findings (6)
- Medium
credentials.env-secretcordis.patch.yml:42credential-accessheaders: !!js 'process.env.EXA_API_KEY ? { "x-api-key": process.env.EXA_API_KEY } : {}' - Low
network.external-hostcordis.patch.yml:4network# (https://mcp.exa.ai/mcp, Streamable HTTP) through the mcp-client bridge the - Low
network.external-hostcordis.patch.yml:18network# instead of sending a bogus header. OAuth (https://mcp.exa.ai/mcp?login) is - Low
network.external-hostcordis.patch.yml:33network# url: https://mcp.exa.ai/mcp?tools=web_search_exa,web_fetch_exa - Low
network.external-hostcordis.patch.yml:41networkurl: https://mcp.exa.ai/mcp - Low
network.external-hostpackage.json:3network"description": "Exa Search MCP for DeepSeek Harness: mounts the remote Exa MCP endpoint (https://mcp.exa.ai/mcp) through the in-box @deepseek-ai/dsh-mcp-client bridge",
Not run
- Dependency advisory database scan
- Installation execution test
- Runtime behavior verification
Scanner 1.0.0 · Scorer 1.0.0
