footprintjsBLOCK
mcp/footprintjs/footprint
The flowchart pattern for backend code — self-explainable systems that AI can reason about. Causal traces, auto-generated tool descriptions, transactional state.
Verdict
BLOCK
Grade
F
Trust score
55 /100
Exposed tools
15 15r · 0w · 0d
Transport
—
License
MIT
Stars
20
01
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
FootPrint
The flowchart pattern for backend code — self-explainable systems that AI can reason about.
Part of the footprintjs ecosystem — the self-explaining stack.
Read from source at commit
53c9ac782583OBSERVED · 2026-10-11Advertisement
02
Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude-code
claude mcp add footprintjs -- npx -y [email protected]
claude-desktop
{
"mcpServers": {
"footprintjs": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}03
Exposed tools (15)
15 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Cost | read | Accumulator (KeyedStore) — running total computed during traversal |
CreditCheck | read | Pull credit report |
Debug | read | Translator (Scope ScopeRecorder) — per-stage diagnostic entries |
DynFlow | read | Dynamic subflow |
InOut | read | Chart in/out stream — entry/exit pairs at every chart boundary (root + subflows) |
Kid | read | what it holds |
Manifest | read | Translator (FlowRecorder) — subflow catalog built during traversal |
Metrics | read | Aggregator (KeyedStore) — per-step timing and I/O counts |
Narrative | read | Translator (SequenceStore) — plain-English trace merged from flow + data events |
Projected | read | the stripped projection |
Quality | read | Quality scores per execution step with backtracking support |
Topology | read | Composition graph: subflow boundaries, fork branches, decision branches |
backtrack | read | Backward slice for a state variable: who wrote it, what those writers read, which decisions allowed them. Honest about what the trace cannot see. |
element_birth | read | For an array-valued variable: which stage execution produced element N (append-fold provenance — exact under delta commit logs). |
slice_json | read | The backward slice as a flat JSON graph (nodes keyed by step id, id-referenced edges) — for clients that render rather than read. |
04
Trust audit
BLOCKgrade F · trust 55/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (3 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/lib/reactive/types.ts:112
$eval(name: string, value: unknown): void;
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
MEDIUMInventory / provenance · inv.binary · CWE-1104
bench/compareCore.ts
compareCore.ts
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
scripts/audit-process.mjs:14
console.log(CI ? `::group::${command}\n::stop-commands::${token}` : `\n$ ${command} # in ${cwd}`);MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
scripts/audit-process.mjs:16
if (CI) console.log(`::${token}::\n::endgroup::`);MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
src/lib/detach/drivers/sendBeacon.ts:55
name: 'send-beacon',
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
test/lib/capture/envelope.test.ts:313
inner.token = 'MUTATED-AFTER-CAPTURE';
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
test/lib/engine/security/redaction-one-law.test.ts:22
const SECRET = 'sk-live-SUPER-SECRET-BYTES';
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
test/lib/engine/security/redaction-subflow-served-state.test.ts:37
const SECRET = 'sk-live-SUPER-SECRET-BYTES';
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
test/lib/engine/security/redaction-subflow-served-state.test.ts:38
const TOKEN = 'tok-SUPER-SECRET-FIELD';
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
test/lib/engine/security/root-boundary-redaction.test.ts:167
const pauseData = { question: 'approve?', secret: 'operational-pause-secret' };LOWInventory / provenance · inv.hidden_file · CWE-1104
.clinerules
.clinerules
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.eslintrc.js
.eslintrc.js
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.prettierrc.js
.prettierrc.js
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.windsurfrules
.windsurfrules
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.suspicious_name · CWE-1104
test/lib/engine/security/pause-payload-redaction.test.ts
pause-payload-redaction.test.ts
Why it matters. member named after an attack tool
Fix. remove or justify
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/lib/builder/structure/StructureRecorderDispatcher.ts:27
import { isDevMode } from '../../devMode.js';LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/lib/detach/drivers/batch.ts:8
import type { FlowChart } from '../../builder/types.js';LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/lib/detach/drivers/batch.ts:9
import { extractErrorInfo } from '../../errors/errorInfo.js';LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/lib/detach/drivers/immediate.ts:33
import type { FlowChart } from '../../builder/types.js';LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/lib/detach/drivers/sendBeacon.ts:31
import type { FlowChart } from '../../builder/types.js';LOWNetwork egress · net.beacon_words · CWE-200, CWE-319
.github/workflows/renovate.yml:24
# otherwise run malicious code with these write perms + the RENOVATE_TOKEN and exfiltrate
LOWNetwork egress · net.beacon_words · CWE-200, CWE-319
test/lib/capture/envelope.test.ts:318
it('previews are capped — a 10KB secret cannot exfiltrate through a summary', () => {LOWNetwork egress · net.beacon_words · CWE-200, CWE-319
test/lib/detach/registry.test.ts:98
register(createHandle('beacon-1'));LOWNetwork egress · net.beacon_words · CWE-200, CWE-319
test/lib/detach/registry.test.ts:100
expect(ids()).toEqual(['mb-1', 'mb-2', 'si-1', 'beacon-1']); // insertion order
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
test/architecture/consumer-install.test.ts:76
tarball: 'http://127.0.0.1:' + server.address().port + '/footprintjs.tgz', integrity,
Gates applied: no_behavioural_pass.
Audited 2026-10-11 · audit v0.4.1 · source sha
53c9ac782583full audit observations/trust-audit/mcp-server/footprintjs__footprint.json · Report an issue / request a re-scan05
Audit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 53c9ac782583 | BLOCK | F | 55 | first audit |
06
Questions
What is the footprintjs MCP server?
The flowchart pattern for backend code — self-explainable systems that AI can reason about. Causal traces, auto-generated tool descriptions, transactional state.
What tools does footprintjs expose?
15 in total: 15 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is footprintjs safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (55/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does footprintjs need?
No credential environment variables were found in its source, so it appears to need none.
How current is this page?
The grade is for one exact copy of the source (53c9ac782583), read on 2026-10-11. The repository is watched and re-audited when it changes.