LeashIndex Get the report

Index / storage

io.github.electron-stagewright/core

io-github-electron-stagewright-core declares 55 capabilities across 55 tools, with 2 critical issues.

90/100 exposureHigh exposure

Manifest recorded 2026-10-21 from tools/list answered by the npm package @electron-stagewright/core@0.6.3 (published to npm as @electron-stagewright/core, listed in the official MCP registry as io.github.electron-stagewright/core 0.6.3), run in an isolated container with no network access and no credentials. The date changes only when the manifest does. Not verified by a maintainer.

Issues

These describe what this server's manifest declares. A product can provide controls that MCP has no way to express — token revocation, an admin console, audit logs — and this page cannot see them. The absence of a declaration is not evidence that a control is absent.

critical · no-revocation · All 55 tools

55 of 55 tools declare no way for the customer to switch them off once granted. This applies to every tool because MCP has no field in which to declare a revocation mechanism; the product may provide one outside MCP that a manifest cannot show.

critical · irreversible-uncapped · 3 of 55 tools

3 tools are classified as irreversible and declare no limit.

high · no-expiry · All 55 tools

55 of 55 tools declare no expiry. This applies to every tool because MCP has no field in which to declare an expiry; the product may provide one outside MCP that a manifest cannot show.

high · no-audit-trail · All 55 tools

55 of 55 tools declare no record of their actions that the customer can read. This applies to every tool because MCP has no field in which to declare an audit requirement; the product may provide one outside MCP that a manifest cannot show.

high · uncapped-write · 17 of 55 tools

17 tools can modify data and declare no limit.

low · uncapped-read · 35 of 55 tools

35 tools can read data and declare no limit.

Declared capabilities

How each tool was read. declared means the server's own annotation said so — self-reported and unverified. inferred is from the tool's name. assumed means nothing indicated either way.

ToolRead asBasis
electron_assert_patternread declared
electron_attachread inferred
electron_checkread inferred
electron_clear_inputwrite inferred
electron_clickwrite assumed
electron_console_logsread declared
electron_detachwrite assumed
electron_dialog_handlerread inferred
electron_discover_runningread declared
electron_doctorread declared
electron_dragwrite assumed
electron_drop_filedelete inferred
electron_elements_listread declared
electron_existsread declared
electron_expect_countread declared
electron_expect_stateread declared
electron_expect_textread declared
electron_expect_urlread declared
electron_expect_valueread declared
electron_expect_visibleread declared
electron_findread declared
electron_focused_elementread declared
electron_force_killdestructive declared
electron_get_attributeread declared
electron_get_bboxread declared
electron_get_computed_styleread declared
electron_get_stateread declared
electron_get_textread declared
electron_get_valueread declared
electron_hoverwrite assumed
electron_inforead declared
electron_injectwrite assumed
electron_keywrite assumed
electron_keyboard_typewrite assumed
electron_launchwrite assumed
electron_press_sequencewrite assumed
electron_screenshotread declared
electron_scrollwrite assumed
electron_scroll_into_viewread inferred
electron_select_optionwrite assumed
electron_set_fileswrite inferred
electron_snapshotread declared
electron_statusread declared
electron_stopdestructive declared
electron_surfaces_listread declared
electron_switch_surfaceread inferred
electron_switch_windowwrite assumed
electron_typewrite inferred
electron_type_into_editorwrite inferred
electron_uncheckwrite assumed
electron_waitread declared
electron_wait_for_eventread declared
electron_wait_for_selectorread declared
electron_wait_for_stateread declared
electron_windows_listread declared

Record history

Earlier records for this server. A correction is added here, never written over the record it corrects.

RecordedExposureSource
2026-10-1590 tools/list answered by the npm package @electron-stagewright/core@0.6.1 (published to npm as @electron-stagewright/core, listed in the official MCP registry as io.github.electron-stagewright/core 0.6.1), run in an isolated container with no network access and no credentials
Answering this question about your own agent? The self-serve stack report applies the same reading to your own stack or server and gives you a dated document you can hand to a customer's security review. It is generated in your browser, with nobody to wait for. Buying one does not change this page, its score or its place in the index — see Independence.
Maintain this server? If this page misreads your manifest, or your server has changed, submit its current tools/list response and it will be re-scored and dated. Corrections are published alongside the original, not in place of it.