{
  "slug": "io-github-agigante80-actual-mcp-server",
  "name": "Actual Budget MCP Server",
  "auditedAt": "2026-11-02T12:22:37Z",
  "version": "0.25.1",
  "ecosystem": "npm",
  "package": "actual-mcp-server",
  "disclaimer": "Automated smoke test, not a security guarantee.",
  "complete": true,
  "checks": {
    "versionPin": {
      "status": "pass",
      "detail": "Pinned npm actual-mcp-server@0.25.1",
      "version": "0.25.1"
    },
    "vulnerabilities": {
      "status": "fail",
      "detail": "Critical or high advisories were returned.",
      "critical": 0,
      "high": 1,
      "medium": 0,
      "low": 0,
      "packagesScanned": 182
    },
    "license": {
      "status": "pass",
      "detail": "MIT",
      "spdx": "MIT"
    },
    "installScripts": {
      "status": "pass",
      "detail": "No preinstall, install, postinstall, or prepare script.",
      "scripts": []
    },
    "secrets": {
      "status": "pass",
      "detail": "No credential patterns in the published artifact.",
      "findings": []
    },
    "packageSize": {
      "status": "pass",
      "detail": "1223915 bytes",
      "bytes": 1223915
    },
    "activity": {
      "status": "pass",
      "detail": "Active 7 days ago.",
      "ageDays": 7
    },
    "sandbox": {
      "status": "warn",
      "detail": "Requires credentials. Started with none.",
      "starts": false,
      "handshake": false,
      "timeToReadyMs": null,
      "toolCount": 0,
      "resourceCount": null,
      "promptCount": null,
      "requiresCredentials": true,
      "stderrExcerpt": "2026-11-02 09:22:37.777 error: \n\u274c Missing or invalid environment variables:\n  \u2022 ACTUAL_SERVER_URL: Invalid input: expected string, received undefined\n  \u2022 ACTUAL_BUDGET_SYNC_ID: Invalid input: expected string, received undefined\n\nSet them in a .env file in the current directory, or export them before running.\nRequired: ACTUAL_SERVER_URL, ACTUAL_PASSWORD, ACTUAL_BUDGET_SYNC_ID\nSee: https://github.com/agigante80/actual-mcp-server",
      "network": "disabled",
      "networkAttemptedWhileOffline": false,
      "outboundHosts": []
    }
  },
  "tier": "listed",
  "tierReason": "Requires credentials, so the sandbox handshake was not completed.",
  "logExcerpt": "2026-11-02 09:22:37.777 error: \n\u274c Missing or invalid environment variables:\n  \u2022 ACTUAL_SERVER_URL: Invalid input: expected string, received undefined\n  \u2022 ACTUAL_BUDGET_SYNC_ID: Invalid input: expected string, received undefined\n\nSet them in a .env file in the current directory, or export them before running.\nRequired: ACTUAL_SERVER_URL, ACTUAL_PASSWORD, ACTUAL_BUDGET_SYNC_ID\nSee: https://github.com/agigante80/actual-mcp-server"
}