ToolProof Trust Profile

ai-gavelin-mcp

High-impact capability. Restrict to sandbox/test resources and avoid production credentials.

100risk score

Connect With Limitsconnection signal

sensitive_contextrisk type

71evidence score

Source: https://github.com/gavelin-ai/mcp
Registry: ai.gavelin/mcp 1.0.0

Connection signal

High-impact capability. Restrict to sandbox/test resources and avoid production credentials.

Observed tools

None observed in this static profile.

Top findings

Detected capability: environment_access — proxy.js:13
Install risk pattern: unpinned_dependency — package-lock.json:10
References credential or secret pattern: API_KEY_GENERIC — proxy.js:13

Recommended controls

Install in a sandbox before team or production use.
Pin the exact package/repository version.
Review install scripts, Dockerfile behavior, and dependency pins.
Do not use production credentials during first install.
Restrict filesystem, repository, cloud, and database scope.
Require human approval for destructive actions.