Static scan: 2 manifest/implementation gap(s)

[Tetsurohhori]

I ran a static analyzer over MCP server manifests and implementations, looking for gaps between declared tool capabilities and what the code actually does. I found 2 item(s) in this repository that may be worth a look.

Findings

undeclared network access

• Location: packages/mcp-server/src/verify/guarded-request.ts:24 (commit d1f2eb1a46ad)
• Observed: network: import node:https
• Why flagged: Declared MCP surface does not mention this undeclared network access.

import { request as httpsRequest } from 'node:https';

undeclared network access

• Location: packages/mcp-server/src/verify/guarded-request.ts:26 (commit d1f2eb1a46ad)
• Observed: network: import node:dns
• Why flagged: Declared MCP surface does not mention this undeclared network access.

import { lookup as dnsLookup, type LookupAddress } from 'node:dns';

Reproduce

pip install mcp-blast-radius && mcp-blast-radius scan /path/to/your/mcp-server

If any of this is a false positive, please say so — I am tuning the detector.