Public infrastructure
MCP Observatory

- Problem
- MCP plugins can access files and shell. Review should not require running them.
- I built
- Static analysis, reproducible sampling, gated disclosure and a nightly public index. Sole author.
- Outcome
- 1,673 scanned · 171 findings published
- Sample
- Inspect source
- Gate publication
2026-10-04 snapshot. Accuracy is unmeasured; findings are not confirmed vulnerabilities.
- Python 3.11+
- tree-sitter
- SARIF / JSONL
- pytest · ruff · mypy
- GitHub Actions / Pages
