MCP server · Audited from source
ZeroSlop MCP server
by manavmishra/ZeroSlopMIT licenceAudited 7 Oct 2026 · source 471f1abb3abc
npm zero-slop-site 0.1.0streamable-http★ 132
Is it safe? With care — CAUTION, grade B (85/100). It exposes 2 tools: 2 read, 0 write and 0 destructive. The audit recorded 26 findings (0 critical, 0 high, 2 medium, 18 low). Maintainer's description: Open-source Agent Skill that finds and removes AI slop from your writing
Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
Cite
Cite this page
ModelsAtlas. “ZeroSlop MCP server (manavmishra/ZeroSlop)”. Retrieved 7 Oct 2026. https://modelsatlas.com/mcp/manavmishra/zeroslop
Trust audit
Audit 0.4.1 · full source read 7 Oct 2026
Trust score85/100!CAUTION B
0 critical0 high2 medium18 low6 info
26 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.
What the source does
- FilesystemDeclared1 observation
- NetworkDeclared3 observations
- ShellNone observedNothing seen in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.
Five audit layers
| Layer | What we check | Result |
|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS 5 findings |
L1 Static source | Secrets, path traversal, supply chain | WARN 13 findings |
L2 Instructions | Prompt injection and authority framing in docs and tool descriptions | PASS 7 findings |
L3 Inventory | Declared tools match the source | PASS |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED |
Provenance & runtime
Who published it, and what the audit could and could not run
Provenance
- Repository owner
manavmishraUser accountAccount type recorded when we read the repository. - PackagePublished on npm
zero-slop-siteat version 0.1.0 - LicenceMITFrom the repository, as read at the audited commit.
- Last push1 day agoActivity of the repository when we read it.
- Source commit read471f1abb3abcThe audit covers exactly this commit, read on 7 Oct 2026.
Runtime
- Sandbox runNot run yetThis audit read the source only; it did not execute the server.
- Tool inventory2 declaredRead from the source and classed read, write or destructive.
Every value here is read from the record's own repository and audit.Suggest a correction
Findings (26)
Sorted by severity · the 25 most severe of 26 are listed
MEDIUMNetwork egressnet.raw_ip · growth/verify-demo-player.mjs:12
F-04 Network egressCWE-200 · CWE-319Layer L1
await page.goto(`http://127.0.0.1:${server.address().port}/`);- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMObfuscation / stealthobf.base64_blob · assets/Zero-Slop-One-Pager.pdf:37
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
Gb"0;JH,ZM!5fq/l<W?K<<3("zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz- Why
- No further detail recorded for this rule.
- Fix
- —
LOWInventory / provenanceinv.binary · website/public/demo-384.avif
F-13 Inventory / provenanceCWE-1104Layer L0
demo-384.avif
- Why
- a compiled or binary member cannot be reviewed from source
- Fix
- ship source, or explain the binary in the README
LOWInventory / provenanceinv.binary · website/public/demo-750.avif
F-13 Inventory / provenanceCWE-1104Layer L0
demo-750.avif
- Why
- a compiled or binary member cannot be reviewed from source
- Fix
- ship source, or explain the binary in the README
LOWInventory / provenanceinv.binary · website/public/demo.avif
F-13 Inventory / provenanceCWE-1104Layer L0
demo.avif
- Why
- a compiled or binary member cannot be reviewed from source
- Fix
- ship source, or explain the binary in the README
LOWInsecure cryptocrypto.weak_hash · growth/check-motion.py:353
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
git_blob = hashlib.sha1(f"blob {len(gif_bytes)}\0".encode() + gif_bytes).hexdigest()- Why
- No further detail recorded for this rule.
- Fix
- —
LOWInsecure cryptocrypto.weak_hash · growth/export-shell-media.mjs:14
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
const blob = createHash('sha1').update(`blob ${bytes.length}\0`).update(bytes).digest('hex');- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · .github/workflows/validate.yml:275
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
run: node ../../.github/scripts/audit-npm.mjs
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · .github/workflows/validate.yml:291
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
run: node ../../.github/scripts/audit-npm.mjs
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · bench/test_release_replay.py:114
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
"2.12.17\n", " 2.12.17", "../../2.12.17", "2.12.17/../../x",
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · distribution/homebrew/prepare-formula.mjs:8
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
export const VERSION = JSON.parse(await readFile(new URL("../../package.json", import.meta.url), "utf8")).version;- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · integrations/api-examples/samples.test.mjs:10
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { result } from "../../tests/fixtures/mcp-transport.mjs";- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · integrations/api-examples/samples.test.mjs:96
F-04 Network egressCWE-200 · CWE-319Layer L1
const endpoint = `http://127.0.0.1:${server.address().port}/v1/deslop`;- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · mcp/scripts/e2e_rest.test.mjs:35
F-04 Network egressCWE-200 · CWE-319Layer L1
return `http://127.0.0.1:${server.address().port}`;- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · mcp/scripts/e2e_rest.test.mjs:47
F-04 Network egressCWE-200 · CWE-319Layer L1
assert.equal(validateBaseUrl("http://127.0.0.1:9999"), "http://127.0.0.1:9999");- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · tests/test_all.py:2913
F-04 Network egressCWE-200 · CWE-319Layer L1
for href in ("https://localhost/zero-slop.zip", "https://127.0.0.1/zero-slop.zip",- Why
- No further detail recorded for this rule.
- Fix
- —
LOWPrompt injectionprompt.transfer_instruction · DISTRIBUTION.md:98
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
repository-dispatch endpoint. The scheduled sync works without that token.
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
LOWPrompt injectionprompt.transfer_instruction · mcp/README.md:265
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
7. Read `GET https://mcp.zero-slop.ai/internal/counters` with the report token
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
INFOPrompt injectionprompt.conditional_escalation · SKILL.md:300
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
sentence skeleton. When the input contains three or more related drafts, run:
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOPrompt injectionprompt.conditional_escalation · dist/zero-slop-single-file.md:328
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
sentence skeleton. When the input contains three or more related drafts, run:
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOPrompt injectionprompt.conditional_escalation · distribution/plugins/zero-slop/skills/zero-slop/SKILL.md:325
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
sentence skeleton. When the input contains three or more related drafts, run:
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOPrompt injectionprompt.conditional_escalation · skills/zero-slop/SKILL.md:300
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
sentence skeleton. When the input contains three or more related drafts, run:
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOPrompt injectionprompt.credential_read · docs/rest-api.md:37
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
Access is free, without an API key. REST and MCP share capacity and usage limits,
- Why
- asks the agent to read credentials
- Fix
- —
Tools it exposes
2 declared in source · 0 destructive
2 read0 write0 destructive
| Tool | Risk | What it does |
|---|---|---|
Writing | read | One draft, the same checked result as MCP. |
deslop | read | No description in the source |
Install
Package version 0.1.0 · audited commit 471f1ab
Read the findings first. The most severe is Network egress (medium) at growth/verify-demo-player.mjs.
One-click links open your editor with the config below filled in, exactly as the snippets show it, pinned to version 0.1.0. The audit covers commit 471f1ab only.
claude mcp add zero-slop-site --env GH_TOKEN=${GH_TOKEN} --env GITHUB_TOKEN=${GITHUB_TOKEN} -- npx -y [email protected]{
"mcpServers": {
"zero-slop-site": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"GH_TOKEN": "${GH_TOKEN}",
"GITHUB_TOKEN": "${GITHUB_TOKEN}"
}
}
}
}The command pins the package version recorded in the source (0.1.0); the audit covers commit 471f1abb3abc. Transport: streamable-http. Reads these environment variables: GH_TOKEN, GITHUB_TOKEN. Give it the narrowest token it needs.
Audit history
- !CAUTION B 85 / 100
Score 79 -> 85 ·
471f1abb3abc - !CAUTION C 79 / 100
First audit ·
4f6d6a421bf1
README badge
For maintainers · updates on every re-audit
[](https://modelsatlas.com/mcp/manavmishra/zeroslop/)
The badge always shows the latest audit; a maintainer cannot pin an old verdict.
Other ratings
Cited, never blended into our score
No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.
Questions about ZeroSlop MCP server
What is the ZeroSlop MCP server?
Open-source Agent Skill that finds and removes AI slop from your writing
What tools does ZeroSlop expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is ZeroSlop safe to connect to an agent?
With care. The audit graded it B (85/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does ZeroSlop need?
It reads GH_TOKEN and GITHUB_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does ZeroSlop run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as zero-slop-site at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (471f1abb3abc), read on 2026-10-07. The repository is watched and re-audited when it changes.
Sources
- manavmishra/ZeroSlop on GitHub — the source we read, its licence, stars and activityObserved · 7 Oct 2026
- ModelsAtlas trust audit — CAUTION verdict for commit 471f1abb3abcObserved · 7 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What is the ZeroSlop MCP server?
- What tools does ZeroSlop expose?
- Is ZeroSlop safe to connect to an agent?