Trust and health report
after-effects-mcp - trust report
Sourced, dated trust signals - maintenance label posture, repository provenance, and security scan status. Not a composite safety grade.
GraphCanon updated Aug 12, 2026 · GitHub synced Aug 12, 2026
29views this month
Maintenance
Recency and activity heuristics from public GitHub metadata (maintenance label, momentum); methodology: github_public_v1.
Slowing36% signal
last push 133d ago
Provenance
Repository identity and fork provenance (github_public_v1).
- GitHub repo id: 965232391
- Not a fork
- Personal account
- Computed Aug 12, 2026
Security intelligence
Source-by-source security scan results from public intelligence providers. Missing, partial, or failed queries are shown explicitly and are not treated as clean.
OSV dependency advisories
Published findings- Last query
- Aug 9, 2026
- Scanner
- osv@v1
- Stored findings
- 42
OpenSSF Scorecard
Not queried- Scanner
- openssf-scorecard@v1
Weekly public scans omit some checks at scale.
View source evidenceDependency advisories (deduplicated)
GHSA-92pp-h63x-v22m
@hono/node-server@1.19.11 · osv@v1
package-lock.json
GHSA-frvp-7c67-39w9
@hono/node-server@1.19.11 · osv@v1
package-lock.json
GHSA-v422-hmwv-36x6
body-parser@2.2.2 · osv@v1
package-lock.json
GHSA-3jxr-9vmj-r5cp
brace-expansion@1.1.13 · osv@v1
package-lock.json
GHSA-mh99-v99m-4gvg
brace-expansion@1.1.13 · osv@v1
package-lock.json
GHSA-rgw5-rvv9-x895
brace-expansion@1.1.13 · osv@v1
package-lock.json
GHSA-g7r4-m6w7-qqqr
esbuild@0.27.4 · osv@v1
package-lock.json
GHSA-4c8g-83qw-93j6
fast-uri@3.1.0 · osv@v1
package-lock.json
GHSA-7p8r-x3mc-p8w7
fast-uri@3.1.0 · osv@v1
package-lock.json
GHSA-q3j6-qgpj-74h6
fast-uri@3.1.0 · osv@v1
package-lock.json
GHSA-v2hh-gcrm-f6hx
fast-uri@3.1.0 · osv@v1
package-lock.json
GHSA-v39h-62p7-jpjc
fast-uri@3.1.0 · osv@v1
package-lock.json
GHSA-26pp-8wgv-hjvm
hono@4.12.9 · osv@v1
package-lock.json
GHSA-2gcr-mfcq-wcc3
hono@4.12.9 · osv@v1
package-lock.json
GHSA-3hrh-pfw6-9m5x
hono@4.12.9 · osv@v1
package-lock.json
GHSA-458j-xx4x-4375
hono@4.12.9 · osv@v1
package-lock.json
GHSA-54fx-42gc-7vw4
hono@4.12.9 · osv@v1
package-lock.json
GHSA-69xw-7hcm-h432
hono@4.12.9 · osv@v1
package-lock.json
GHSA-79qm-7rj5-m7r9
hono@4.12.9 · osv@v1
package-lock.json
GHSA-88fw-hqm2-52qc
hono@4.12.9 · osv@v1
package-lock.json
GHSA-8j4g-w8fx-2239
hono@4.12.9 · osv@v1
package-lock.json
GHSA-9vqf-7f2p-gf9v
hono@4.12.9 · osv@v1
package-lock.json
GHSA-f23p-vx2j-j53r
hono@4.12.9 · osv@v1
package-lock.json
GHSA-f577-qrjj-4474
hono@4.12.9 · osv@v1
package-lock.json
GHSA-hm8q-7f3q-5f36
hono@4.12.9 · osv@v1
package-lock.json
GHSA-hvrm-45r6-mjfj
hono@4.12.9 · osv@v1
package-lock.json
GHSA-j6c9-x7qj-28xf
hono@4.12.9 · osv@v1
package-lock.json
GHSA-p77w-8qqv-26rm
hono@4.12.9 · osv@v1
package-lock.json
GHSA-qp7p-654g-cw7p
hono@4.12.9 · osv@v1
package-lock.json
GHSA-r5rp-j6wh-rvv4
hono@4.12.9 · osv@v1
package-lock.json
GHSA-rv63-4mwf-qqc2
hono@4.12.9 · osv@v1
package-lock.json
GHSA-w62v-xxxg-mg59
hono@4.12.9 · osv@v1
package-lock.json
GHSA-wgpf-jwqj-8h8p
hono@4.12.9 · osv@v1
package-lock.json
GHSA-wmmm-f939-6g9c
hono@4.12.9 · osv@v1
package-lock.json
GHSA-wwfh-h76j-fc44
hono@4.12.9 · osv@v1
package-lock.json
GHSA-xf4j-xp2r-rqqx
hono@4.12.9 · osv@v1
package-lock.json
GHSA-xgm2-5f3f-mvvc
hono@4.12.9 · osv@v1
package-lock.json
GHSA-xpcf-pg52-r92g
hono@4.12.9 · osv@v1
package-lock.json
GHSA-xrhx-7g5j-rcj5
hono@4.12.9 · osv@v1
package-lock.json
GHSA-mwp4-54f8-5fhr
ip-address@10.1.0 · osv@v1
package-lock.json
GHSA-v2v4-37r5-5v8g
ip-address@10.1.0 · osv@v1
package-lock.json
GHSA-q8mj-m7cp-5q26
qs@6.15.0 · osv@v1
package-lock.json
Method and caveats: these are sourced, dated heuristics from public GitHub data and external security intelligence providers. A status like "no published findings from this source" is not a guarantee of safety. Read the full trust methodology · JSON report at /api/graphcanon/tools/dakkshin-after-effects-mcp/trust.
Common questions
- Is after-effects-mcp maintained?
- GraphCanon rates after-effects-mcp "Slowing" (36% maintenance signal from public GitHub metadata, computed Aug 12, 2026). Last push was 133 days ago. This is a recency heuristic, not a guarantee the project will stay maintained.
- Is after-effects-mcp safe to use?
- Last scanned Aug 9, 2026 (deps profile). Status: 42 low - 42 low finding(s) in the latest scan. GraphCanon does not claim the project is safe or vulnerability-free; review findings on the trust report. GraphCanon does not certify after-effects-mcp as safe - review maintenance, provenance, and scan findings on this page before adopting.
- Is after-effects-mcp a fork?
- No. after-effects-mcp is not flagged as a fork in GitHub metadata at the time of the last refresh.
- Does after-effects-mcp have known security vulnerabilities?
- Last scanned Aug 9, 2026 (deps profile). Status: 42 low - 42 low finding(s) in the latest scan. GraphCanon does not claim the project is safe or vulnerability-free; review findings on the trust report.
- How often is the after-effects-mcp trust report updated?
- Trust signals refresh on GitHub ingest/refresh cycles and optional dependency/MCP scans. This report was computed Aug 12, 2026 (methodology github_public_v1).
- What does GraphCanon never claim about after-effects-mcp?
- We never publish a composite safety grade, pen-test endorsement, or "verified secure" label for after-effects-mcp. Signals are sourced heuristics with explicit limits - see trust methodology.
- How does GraphCanon assess trust for after-effects-mcp?
- Signals are sourced from public GitHub metadata and optional dependency/MCP manifest scans, each tagged with methodology version and computed date. GraphCanon does not publish a composite safety grade. Read trust methodology for full scope and limits.