dvalincode

MCPattested

v0.19.0io.github.arthurpanhkuUnknownUpdated 28d agonpm GitHub

Deterministic security scanning, no model or API key, plus offline-verifiable proof a fix worked.

Works in

ClaudeCursorCopilotGemini

Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.

Attested build

A verified provenance attestation binds this artifact to the listed repository. Nobody has claimed the listing yet — this proves where the code was built, not who stands behind it.

28d agoLast update

Package

Authorio.github.arthurpanhku

LicenseUnknown

Version0.19.0

Sourcenpm+mcp-registry

GitHubarthurpanhku/dvalincode

SBOMCycloneDX 1.6 ↓

Trust Status

A

85/100Trusted

✓Listed in Forge index+10/10

✓Identity verified · attested build+20/20

—Ed25519 publish signature+0/5

→ Included automatically when the publisher runs `forge publish`

—Domain verification+0/5

→ Publisher: host /.well-known/forge.json on the package homepage with { "publisher": "<github-login>" }

✓npm Trusted Publishing (Sigstore)+5/5

—npm maintainer match+0/5

→ Publisher: add the verified GitHub login to the npm package's maintainers (npm owner add <login>)

✓CVE scan · clean+30/30

✓Static analysis · clean+20/20

Paste into Claude Code, Cursor, or any AI assistant to fix all gaps

StatusIdentity verified

PublisherUnverified

SignatureUnsigned

Domain—

Provenance✓ Sigstore-verified · 73e364f

Dependencies✓ 60 resolved+ · none vulnerable

Tool surface34 tools · 6 privileged

Security scan✓ Cleanv0.17.0 · 1mo agoHow well does this scan work?

EvalsNone

IndexedAug 11, 2026

Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.

Tools

34 tools · 6 privileged

Statically extracted from the published packagev0.17.0 · 1mo ago

Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.

Filter toolsPrivileged only

delete_fileprivilegedNo description published

This tool published no description. Forge does not invent one.

edit_fileprivilegedNo description published

This tool published no description. Forge does not invent one.

git_diffNo description published

This tool published no description. Forge does not invent one.

git_statusNo description published

This tool published no description. Forge does not invent one.

list_filesNo description published

This tool published no description. Forge does not invent one.

list_remediation_casesNo description published

This tool published no description. Forge does not invent one.

list_skillsNo description published

This tool published no description. Forge does not invent one.

compactNo description published

This tool published no description. Forge does not invent one.

undoNo description published

This tool published no description. Forge does not invent one.

helpNo description published

This tool published no description. Forge does not invent one.

gitNo description published

This tool published no description. Forge does not invent one.

planNo description published

This tool published no description. Forge does not invent one.

memory_deleteprivilegedNo description published

This tool published no description. Forge does not invent one.

memory_importNo description published

This tool published no description. Forge does not invent one.

memory_searchNo description published

This tool published no description. Forge does not invent one.

memory_updateNo description published

This tool published no description. Forge does not invent one.

memory_writeprivilegedNo description published

This tool published no description. Forge does not invent one.

prepare_remediation_worktreeNo description published

This tool published no description. Forge does not invent one.

project_scriptsNo description published

This tool published no description. Forge does not invent one.

read_fileNo description published

This tool published no description. Forge does not invent one.

read_skillNo description published

This tool published no description. Forge does not invent one.

run_checkNo description published

This tool published no description. Forge does not invent one.

run_security_scanNo description published

This tool published no description. Forge does not invent one.

run_security_suiteNo description published

This tool published no description. Forge does not invent one.

search_textNo description published

This tool published no description. Forge does not invent one.

dvalin_scanNo description published

This tool published no description. Forge does not invent one.

dvalin_run_taskNo description published

This tool published no description. Forge does not invent one.

dvalin_get_sessionNo description published

This tool published no description. Forge does not invent one.

dvalin_get_evidenceNo description published

This tool published no description. Forge does not invent one.

shellprivilegedNo description published

This tool published no description. Forge does not invent one.

dvalin-security-engineerNo description published

This tool published no description. Forge does not invent one.

secure-code-scanNo description published

This tool published no description. Forge does not invent one.

secure-code-remediationNo description published

This tool published no description. Forge does not invent one.

write_fileprivilegedNo description published

This tool published no description. Forge does not invent one.

0 of 34 tools published a description.

Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.

About

Deterministic security scanning, no model or API key, plus offline-verifiable proof a fix worked.

Keywords

mcp

Alternatives

Comparing tool surfaces…

Tools exposed

34 tools · 6 privileged · observed 2026-08-17 by static extraction. A tool surface is what one scan read on one day, not a live capability list.

Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.

No dependency coverage

This package was last scanned before Forge began storing the resolved tree. The next scan will record it.