Live survey286 models · 13 providers · 19,992 auditsAudited verification-before-completion · SAFE →What changedHow we verifyllms.txt

MCP server · Audited from source

contextburn MCP server

by arsentev-ai/contextburnMIT licenceAudited 19 Sep 2026 · source aaacd93da484

npm contextburn 0.1.0stdio★ 0
✓SAFEGrade B · 89/100 · 19 Sep 2026 · aaacd93
0GitHub stars
InstallView source on GitHub ↗

Is it safe? Yes — SAFE, grade B (89/100). The tool list is built at runtime, so we cannot read it from the source. The audit recorded 5 findings (0 critical, 0 high, 0 medium, 5 low). Maintainer's description: How much of what your coding agent spends is actually work: the share of paid tokens that became output, not context re-reading. Local, no network calls.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “contextburn MCP server (arsentev-ai/contextburn)”. Retrieved 19 Sep 2026. https://modelsatlas.com/mcp/arsentev-ai/contextburn

Trust audit

Audit 0.4.1 · full source read 19 Sep 2026

Trust score89/100✓SAFE B
0 critical0 high0 medium5 low0 info

5 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemNone observedNothing seen in the source
  • NetworkNone observedNothing seen in the source
  • ShellNone observedNothing seen in the source
  • DependenciesNot pinnedSome ranges float
  • SecretsNone foundNo keys in source

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

LayerWhat we checkResult
L0 ProvenanceRepo owner, licence, archive status, activityPASS 1 finding
L1 Static sourceSecrets, path traversal, supply chainPASS 1 finding
L2 InstructionsPrompt injection and authority framing in docs and tool descriptionsPASS 2 findings
L3 InventoryDeclared tools match the sourcePASS 1 finding
L4 SandboxRun in isolation and watch behaviourSKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

  • Repository owner arsentev-aiUser accountAccount type recorded when we read the repository.
  • PackagePublished on npmcontextburn at version 0.1.0
  • LicenceMITFrom the repository, as read at the audited commit.
  • Last push5 days agoActivity of the repository when we read it.
  • Source commit readaaacd93da484The audit covers exactly this commit, read on 19 Sep 2026.

Runtime

  • Sandbox runNot run yetThis audit read the source only; it did not execute the server.
  • Tool inventoryBuilt at runtimeThe source declares no tools; the server lists them when a client connects, so we cannot read them.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (5)

Sorted by severity

LOWInventory / provenanceinv.hidden_file · editors/vscode/.vscodeignore
F-13 Inventory / provenanceCWE-1104Layer L0
.vscodeignore
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWSupply chainsupply.unpinned · editors/raycast/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@raycast/api, @raycast/eslint-config, eslint, prettier, typescript
Why
5 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWPrompt injectionprompt.transfer_instruction · README.md:27
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
Real output over the session logs of the 36 runs behind the U-curve report — nothing else on the machine. Video with DOI: [10.5281/zenodo.22713920](https://doi.org/10.5281/zenodo.22713920). The runs t
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
LOWPrompt injectionprompt.transfer_instruction · editors/vscode/README.md:33
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
and cost followed a U-curve in session length — report: DOI [10.5281/zenodo.22699668](https://doi.org/10.5281/zenodo.22699668).
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
LOWInventory / provenancemcp.no_tools_extracted · server.json
F-13 Inventory / provenanceCWE-1104Layer L3
Why
the tool list is enumerated at runtime by tools/list, not declared in source
Fix
the page says so rather than showing an empty table

Tools it exposes

None declared in source

The tool list is built at runtime, so we cannot read it from the source.

Install

Package version 0.1.0 · audited commit aaacd93

claude mcp add contextburn -- uvx contextburn==0.2.1 mcp

The command pins the package version recorded in the source (0.1.0); the audit covers commit aaacd93da484. Transport: stdio. No environment variables required.

Audit history

  1. ✓SAFE B 89 / 100

    Source changed, verdict held · aaacd93da484

  2. ✓SAFE B 89 / 100

    First audit · 1f13b187797a

README badge

For maintainers · updates on every re-audit

ModelsAtlas: SAFE BMODELSATLASSAFE · B 
[![ModelsAtlas: SAFE B](https://modelsatlas.com/mcp/arsentev-ai/contextburn/badge.svg)](https://modelsatlas.com/mcp/arsentev-ai/contextburn/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about contextburn MCP server

What is the contextburn MCP server?
How much of what your coding agent spends is actually work: the share of paid tokens that became output, not context re-reading. Local, no network calls.
Is contextburn safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does contextburn need?
No credential environment variables were found in its source, so it appears to need none.
How does contextburn run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as contextburn at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (aaacd93da484), read on 2026-09-19. The repository is watched and re-audited when it changes.

Sources

  • arsentev-ai/contextburn on GitHub — the source we read, its licence, stars and activityObserved · 19 Sep 2026
  • ModelsAtlas trust audit — SAFE verdict for commit aaacd93da484Observed · 19 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.