Trust Card · Static snapshot

browserbase__mcp-server-browserbase D

55/100 · 3 findings (3 critical) · scope excessive · Ranked #37 of 53 scanned.

Scanned 2026-09-09 · engine v0.1.0 (8 regex rules, OWASP-mapped) · upstream browserbase/mcp-server-browserbase @ 3e6f534 (2026-07-20)

Score breakdown

security 25

permissions 40

provenance 90

reliability 85

stability 100

Score constrained by 3 critical and 0 high-severity findings.

Fix first (3 critical/high)

Severity	Rule	Finding	Remediation
CRITICAL	`AT-SEC-002` (LLM02)	Hardcoded Credential or API Secret `evals/run-evals.ts:120` Evidence: `" export ANTHROPIC_API_KEY='sk-ant-your_key_here'",`	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	`AT-SEC-002` (LLM02)	Hardcoded Credential or API Secret `evals/run-evals.ts:126` Evidence: `chalk.yellow(" export GEMINI_API_KEY='your_gemini_key_here'"),`	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	`AT-SEC-002` (LLM02)	Hardcoded Credential or API Secret `src/config.ts:59` Evidence: `mergedConfig.browserbaseApiKey = "dummy-browserbase-api-key";`	Move credentials to secure environment variables or a key vault. Never commit API keys.

Permissions

Scope: excessive · Shell: disabled · Network egress: no · File deletion: enabled · Human approval: none

Provenance

License: Apache-2.0 · Lockfile: yes · Security policy: no · Signals: present (documentary, not a safety verdict)

Independently scanned by the AgentTrust registry (not self-reported by the project). Static analysis only — no code executed, findings need human triage, counts may include test/example code. Static snapshot; re-scan before relying on it: npx @eulogik/agenttrust scan https://github.com/browserbase/mcp-server-browserbase. Scores move with every upstream commit; pages refresh weekly. How scoring works.