MCP server · Org-owned · Audited from source
ARPI MCP
by arpi-ai/arpi-mcpNo licenceAudited 19 Sep 2026 · source 22e066a1bd1a
Is it safe? Yes — SAFE, grade B (86/100). The tool list is built at runtime, so we cannot read it from the source. The audit recorded 3 findings (0 critical, 0 high, 1 medium, 2 low).
Cite
Cite this page
ModelsAtlas. “ARPI MCP (arpi-ai/arpi-mcp)”. Retrieved 19 Sep 2026. https://modelsatlas.com/mcp/arpi-ai/arpi-mcp
Trust audit
Audit 0.4.1 · full source read 19 Sep 2026
3 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.
What the source does
- FilesystemNone observedNothing seen in the source
- NetworkNone observedNothing seen in the source
- ShellNone observedNothing seen in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.
Five audit layers
| Layer | What we check | Result |
|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS 1 finding |
L1 Static source | Secrets, path traversal, supply chain | NA |
L2 Instructions | Prompt injection and authority framing in docs and tool descriptions | PASS |
L3 Inventory | Declared tools match the source | WARN 2 findings |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED |
Provenance & runtime
Who published it, and what the audit could and could not run
Provenance
- Repository owner
arpi-aiOrganizationAccount type recorded when we read the repository. - PackageNo packageRuns from a repository checkout or a hosted URL.
- LicenceNone declaredFrom the repository, as read at the audited commit.
- Last push2 months agoActivity of the repository when we read it.
- Source commit read22e066a1bd1aThe audit covers exactly this commit, read on 19 Sep 2026.
Runtime
- Sandbox runNot run yetThis audit read the source only; it did not execute the server.
- Tool inventoryBuilt at runtimeThe source declares no tools; the server lists them when a client connects, so we cannot read them.
Every value here is read from the record's own repository and audit.Suggest a correction
Findings (3)
Sorted by severity
MEDIUMAuth / authzmcp.remote_no_auth
streamable-http
- Why
- a network transport with no auth environment variable found
- Fix
- require a token
LOWInventory / provenanceinv.no_license
- Why
- no LICENSE file and no repo licence
- Fix
- add a licence
LOWInventory / provenancemcp.no_tools_extracted · server.json
- Why
- the tool list is enumerated at runtime by tools/list, not declared in source
- Fix
- the page says so rather than showing an empty table
Tools it exposes
None declared in source
The tool list is built at runtime, so we cannot read it from the source.
Install
audited commit 22e066a
No connect command is recorded for this server yet. Follow the repository's own instructions, and read the findings above first.
Audit history
- ✓SAFE B 86 / 100
Source changed, verdict held ·
22e066a1bd1a
README badge
For maintainers · updates on every re-audit
[](https://modelsatlas.com/mcp/arpi-ai/arpi-mcp/)
The badge always shows the latest audit; a maintainer cannot pin an old verdict.
Other ratings
Cited, never blended into our score
No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.
Questions about ARPI MCP
Is ARPI MCP safe to connect to an agent?
What credentials does ARPI MCP need?
How does ARPI MCP run?
How current is this page?
Sources
- arpi-ai/arpi-mcp on GitHub — the source we read, its licence, stars and activityObserved · 19 Sep 2026
- ModelsAtlas trust audit — SAFE verdict for commit 22e066a1bd1aObserved · 19 Sep 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- Is ARPI MCP safe to connect to an agent?
- What credentials does ARPI MCP need?
- How does ARPI MCP run?