Evaluation report
Warnings@zenalexa/unicli · mcpa77b90b· 3 months ago
Every check MetaHub ran on this artifact, grouped by area. Static checks run on the source at publish time; behavioral checks run the artifact in a sandbox and judge what it actually does.
Structural
5 passedRepository is reachable
https://github.com/olo-dot-io/Uni-CLI @ a77b90b — ★ 88 · TypeScript · Apache-2.0 · last push 2 days ago
Manifest detected
kind=mcp slug=zenalexa-unicli · source=package.json
Slug is URL-safe
"zenalexa-unicli" matches /^[a-z0-9][a-z0-9-]{0,62}$/
Slug is unique within kind
No collision found for mcp/zenalexa-unicli
Version is semver
0.225.2
Documentation
5 passedDescription quality
13 words · 114 chars — OK but more detail helps
README is present and substantial
52,571 chars · 16 sections · 11 code blocks
Tags / topics declared
24 total — cli, ai-agent, browser-automation, desktop-automation, mcp, cli-hub (+18)
README has usage / example sections
no labeled section but 11 code blocks document usage
Homepage / docs URL declared
https://olo-dot-io.github.io/Uni-CLI/
Safety
2 passed1 warningDependencies: known vulnerabilitieswarn
3 high/critical advisories — [email protected] (HIGH: GHSA-38rv-x7px-6hhq) · [email protected] (HIGH: GHSA-vmh5-mc38-953g) (+1)
Update the affected packages, then re-publish. (`npm audit` shows the same data locally.)
LICENSE file at repo root
LICENSE
No sensitive files in the repo
scanned for .env, credentials.json, *.pem, .ssh/, AWS / GCP configs — none found
Kind-specific
3 passed1 warningMCP: @modelcontextprotocol/sdk in dependencieswarn
No @modelcontextprotocol/sdk dependency declared
Run `npm i @modelcontextprotocol/sdk` so consumers can audit your stack.
MCP: launch path
bin: unicli, unicli-mcp
MCP: ESM package
"type": "module"
MCP: server surface
0 tools
Maintenance
3 passedRecent activity
last push 2 days ago
Tests detected
1 test directory · 419 test files
CI configuration detected
GitHub Actions (4 workflows)
Behavioral
This artifact hasn't produced behavioral results yet: the evaluation sandbox couldn't run it (it may need credentials we don't provide, or a build our environment doesn't support). That's a limitation of our environment, not a verdict on the artifact.