ModelsAtlas
Explore
Atlas / MCP servers / sylphxai / sylphx-smart-reader

sylphx-smart-readerSAFE

mcp/sylphxai/smart-reader-mcp
MCP server by sylphxai · Audited 2026-10-14
⚑ Report / re-scanSource ↗

Prism — local media sniff + route for agents. One call reads PDF/image/video via sibling contracts with provenance. SDK · CLI · MCP.

Verdict
SAFE
Grade
B
Trust score
87 /100
Exposed tools
—
Transport
stdio
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Status: retired product (hard cut, 2026-08-07)

Prism was a local media router (sniff + spawn Citra/Iris/Cue MCP servers). That composition belongs to the agent host / skills, not a seventh product.

Do not install as a product

  • Do not add smart-reader-mcp / prism as a current MCP server for new agents.
  • Do not treat this repository as an active Instrument, marketplace listing, or release authority.
  • Historical source remains for archaeology only.

What to use instead

Why retired

  1. Multi-server MCP hosts already compose independent servers.
  2. A router product doubles process tax and couples three release trains.
  3. Instruments law: host owns composition; products own one evidence domain.

Historical package ids (non-authority)

  • @sylphx/smart-reader-mcp
  • bin prism / smart-reader-mcp
  • MCP name io.github.SylphxAI/smart-reader-mcp

If these still resolve on npm, they are legacy artifacts, not the current product model.

Sniff utility (non-product)

Magic-byte sniffing for host skills lives under src/sniff/ as reference code. Prefer copying a minimal sniff into a host skill rather than depending on this package.

License

MIT — see LICENSE.

Read from source at commit 17f4fd9249ceOBSERVED · 2026-10-14
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code (npm)
claude mcp add smart-reader-mcp -- npx -y @sylphx/[email protected]
03

Trust audit

SAFEgrade B · trust 87/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (6 observation(s))
Network
none-observed
Shell
declared (5 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (9)

MEDIUMFilesystem / path · fs.system_paths · CWE-22, CWE-59
src/compose/composeVideoObjects.ts:157
if (!existsSync('/usr/bin/ffmpeg') && !existsSync('/usr/local/bin/ffmpeg')) {
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
crates/smart-reader-core/src/delegate.rs:75
let portfolio_root = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../..");
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
crates/smart-reader-core/src/policy.rs:124
let err = resolve_media_path("sub/../../etc/passwd", temp.path()).unwrap_err();
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
crates/smart-reader-core/src/read_media.rs:115
.join("../../test/fixtures/mislabeled/png-as-pdf.pdf");
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
crates/smart-reader-core/src/read_media.rs:121
.join("../../../image-reader-mcp/target/release/image-reader-cli");
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/delegate/delegateToReader.ts:8
const packageJson = require('../../package.json') as {
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, zod, @biomejs/biome, @changesets/changelog-github, @changesets/cli, @types/node, bun-types, typescript
Why it matters. 8 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWInventory / provenance · mcp.no_tools_extracted · CWE-1104
server.json
Why it matters. the tool list is enumerated at runtime by tools/list, not declared in source
Fix. the page says so rather than showing an empty table
INFOInventory / provenance · inv.oversize · CWE-1104
npm/linux-x64-gnu/smart-reader-mcp-server
npm/linux-x64-gnu/smart-reader-mcp-server
Why it matters. 4318560 bytes not read

Gates applied: no_behavioural_pass.

Audited 2026-10-14 · audit v0.4.1 · source sha 17f4fd9249cefull audit observations/trust-audit/mcp-server/sylphxai__smart-reader-mcp.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-1417f4fd9249ceSAFEB87first audit
05

Questions

What is the sylphx-smart-reader MCP server?

Prism — local media sniff + route for agents. One call reads PDF/image/video via sibling contracts with provenance. SDK · CLI · MCP.

Is sylphx-smart-reader safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (87/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does sylphx-smart-reader need?

No credential environment variables were found in its source, so it appears to need none.

How does sylphx-smart-reader run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as @sylphx/smart-reader-mcp at 0.2.11.

How current is this page?

The grade is for one exact copy of the source (17f4fd9249ce), read on 2026-10-14. The repository is watched and re-audited when it changes.

Advertisement