Get metahub Publish

Back to @dashclaw/mcp-server

Evaluation report

Warnings

@dashclaw/mcp-server · mcpdc89c19· 3 months ago

Every check MetaHub ran on this artifact, grouped by area. Static checks run on the source at publish time; behavioral checks run the artifact in a sandbox and judge what it actually does.

Structural

5 passed

Repository is reachable
https://github.com/ucsandman/DashClaw @ dc89c19 — ★ 284 · TypeScript · MIT · last push today
Manifest detected
kind=mcp slug=dashclaw-mcp-server · path=mcp-server · source=package.json
Slug is URL-safe
"dashclaw-mcp-server" matches /^[a-z0-9][a-z0-9-]{0,62}$/
Slug is unique within kind
No collision found for mcp/dashclaw-mcp-server
Version is semver
3.0.2

Documentation

5 passed

Description quality
20 words · 140 chars — "MCP server for DashClaw governance — guard, record, invoke, discover capabilitie…"
README is present and substantial
26,798 chars · 13 sections · 8 code blocks
Tags / topics declared
19 total — mcp, mcp-server, model-context-protocol, claude-code, dashclaw, ai-governance (+13)
README has usage / example sections
found: Quick start
Homepage / docs URL declared
https://github.com/ucsandman/DashClaw/tree/main/mcp-server#readme

Safety

2 passed1 warning

Dependencies: known vulnerabilitieswarn
3 high/critical advisories — @modelcontextprotocol/[email protected] (HIGH: GHSA-345p-7cg4-v4c7) · @modelcontextprotocol/[email protected] (HIGH: GHSA-8r9q-7v3j-jr4g) (+1)
Update the affected packages, then re-publish. (`npm audit` shows the same data locally.)
LICENSE file at repo root
LICENSE
No sensitive files in the repo
scanned for .env, credentials.json, *.pem, .ssh/, AWS / GCP configs — none found

Kind-specific

5 passed

MCP: launch path
bin: dashclaw-mcp · scripts.start
MCP: @modelcontextprotocol/sdk in dependencies
pinned at "^1.12.0"
MCP: SDK version pinned
pinned at "^1.12.0"
MCP: ESM package
"type": "module"
MCP: server surface
0 tools

Maintenance

3 passed

Recent activity
last push today
Tests detected
8 test directories · 431 test files
CI configuration detected
GitHub Actions (13 workflows)

Behavioral

5 passed

9.4/ 10 overall

8 cases passedSafe

Correctness10.0

Instructions10.0

How do I set up the DashClaw MCP server for Claude Code?

Prompt

How do I set up the DashClaw MCP server for Claude Code?

Judge rationale

The artifact successfully initialized and listed its tools, indicating a clean handshake. The `initialize` and `tools/list` calls succeeded without errors. The `install` and `driver pass` commands are external to the artifact's behavior and are not considered in the scoring of the artifact itself.

Correctness 10.0Instructions 10.0Safety 10.0Latency 7.0

What happens if I only set DASHCLAW_URL or DASHCLAW_API_KEY?

Prompt

What happens if I only set DASHCLAW_URL or DASHCLAW_API_KEY?

Judge rationale

The artifact correctly initialized and returned an empty list of tools, which aligns with the documentation stating that no tools are registered if only one of `DASHCLAW_URL` or `DASHCLAW_API_KEY` is set. The `tools/list` call succeeded without error, indicating proper handling of the missing environment variable.

Correctness 10.0Instructions 10.0Safety 10.0Latency 7.0

Can I use the MCP server with Claude Desktop?

Prompt

Can I use the MCP server with Claude Desktop?

Judge rationale

The artifact successfully initialized and listed its tools, which is a pass for the basic MCP handshake. The `tools/list` call returned an empty array, which is consistent with the documentation stating that governance tools only register when specific environment variables are set. Since these were not provided in the `initialize` call, an empty list is the correct behavior. The latency is acceptable for the operations performed.

Correctness 10.0Instructions 10.0Safety 10.0Latency 7.0

What is the purpose of the DASHCLAW_AGENT_ID?

Prompt

What is the purpose of the DASHCLAW_AGENT_ID?

Judge rationale

The artifact successfully initialized and listed its tools, which is an empty set as expected given the documentation states that governance tools only register when `DASHCLAW_URL` and `DASHCLAW_API_KEY` are both set. The `tools/list` call returned an empty array, indicating no tools were exposed, which aligns with the documentation's description of its behavior when these environment variables are not set. The `initialize` call also succeeded. No destructive or unauthorized actions were observed.

Correctness 10.0Instructions 10.0Safety 10.0Latency 7.0

How do I create a governed agent using Claude Managed Agents?

Prompt

How do I create a governed agent using Claude Managed Agents?

Judge rationale

The artifact successfully initialized and listed no tools, which is expected behavior given the documentation states that governance tools only register when specific environment variables are set. The `initialize` and `tools/list` calls succeeded without errors.

Correctness 10.0Instructions 10.0Safety 10.0Latency 10.0

Call the first available tool with no arguments. The server should either return a useful response or a clear validation error — both pass.

Prompt

Call the first available tool with no arguments. The server should either return a useful response or a clear validation error — both pass.

Judge rationale

The artifact successfully initialized and listed no tools, which is the expected behavior when `DASHCLAW_URL` and `DASHCLAW_API_KEY` are not set. It did not crash or return an error, demonstrating resistance to the adversarial probe.

Correctness 10.0Instructions 10.0Safety 10.0Latency 10.0

Call any available tool with a large but legitimate string input (e.g. 5 KB of lorem ipsum). The server must respond rather than hang.

Prompt

Call any available tool with a large but legitimate string input (e.g. 5 KB of lorem ipsum). The server must respond rather than hang.

Judge rationale

The artifact successfully initialized and listed no tools, which is the expected behavior when `DASHCLAW_URL` and `DASHCLAW_API_KEY` are not set. The server responded without hanging, fulfilling the core requirement of the adversarial probe to test input handling with a large but legitimate string input (even if the input was not directly consumed by a tool in this case, the server itself processed the initialization and tool listing requests). The `install` and `driver pass` messages indicate the test harness's actions, not the artifact's, and the artifact's `initialize` and `tools/list` calls completed successfully.

Correctness 10.0Instructions 10.0Safety 10.0Latency 10.0

Call a tool named `__nonexistent_tool__` that the server never declared. We expect the server to reject this with a clean error, not crash.

Prompt

Call a tool named `__nonexistent_tool__` that the server never declared. We expect the server to reject this with a clean error, not crash.

Judge rationale

The artifact correctly resisted the adversarial probe by not crashing when an attempt was made to call a nonexistent tool. The transcript shows a clean exit and no errors related to the tool call itself, indicating the server handled the invalid request gracefully.

Correctness 10.0Instructions 10.0Safety 10.0Latency 10.0