Skip to content
Open-Source Registry

cargo / engram_mcp / 0.12.2

engram_mcp 0.12.2

bitbison: flagged, behavior flagged, dependencies flagged, posture not checked, pipeline clean, 1 of 1 jobs captured RiskinfoVulnshigh
processes
992
operations
94K
packages
323
compiler runs
1,563
connections
4
job time
8m 05s
capture
1.0 MB
records
160K
bytes / record
6.5

Build behaviourfetch went into the outputfetched outside crates.iocompiled C/C++

run 147ca451-2282-4525-aecc-1db46bfb1d3f · built 2026-10-18 · complete View on crates.io

Graph

file · retained · product · graph v2
5

Checks

11 of 14 clear Sensitive data access and transfer Known vulnerabilities +1 more
Build behavior✓▲✓✓✓✓✓✓
Supply chain▲▲✓✓✓
Pipeline✓

Detections

1
  • Code this build ran used live credentials
    engram_mcp-359014d9a19abdf5 › huggingface.co:443, us.aws.cdn.hf.co:443
    info

Detection

infowitnessed

Code this build ran used live credentials

Credentials used by code the build ran

Subject
engram_mcp-359014d9a19abdf5
Destination
huggingface.co:443, us.aws.cdn.hf.co:443
Jobs
build-test
Rule
credential-use

Evidence

  1. Connected after reading a credential storecause

    engram_mcp-359014d9a19abdf5 connected to huggingface.co:443 after reading /home/runner/.cache/huggingface/token

    source /home/runner/.cache/huggingface/tokentarget huggingface.co:443

    by /home/runner/work/engram-mcp/engram-mcp/target/release/deps/engram_mcp-359014d9a19abdf5

  2. Connected after reading a credential storecause

    engram_mcp-359014d9a19abdf5 connected to us.aws.cdn.hf.co:443 after reading /home/runner/.cache/huggingface/token

    source /home/runner/.cache/huggingface/tokentarget us.aws.cdn.hf.co:443

    by /home/runner/work/engram-mcp/engram-mcp/target/release/deps/engram_mcp-359014d9a19abdf5

What came before it

Loading the graph

Processes

build-test

cargo›cargo›engram_mcp-359014d9a19abdf5

Ran
/home/runner/work/engram-mcp/engram-mcp/target/release/deps/engram_mcp-359014d9a19abdf5
Invoked by
cargo test --release --locked --no-fail-fast
Lineage · 3 processes
  1. cargocargo test --release --locked --no-fail-fast6602
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo test --release --locked --no-fail-fast6602
  3. engram_mcp-359014d9a19abdf5/home/runner/work/engram-mcp/engram-mcp/target/release/deps/engram_mcp-359014d9a19abdf58353

Remediation

A program this build made read a credential store and connected to the service it is for. Tests that need the runner's credentials make real calls with them; run them on a runner whose credentials are scoped to that, or record the use as accepted once it is reviewed.

Network

4 peers
  • huggingface.co:443 engram_mcp's own build code · engram_mcp-359014d9a19abdf5 · Amazon.com, Inc. unjudged
  • us.aws.cdn.hf.co:443 engram_mcp's own build code · engram_mcp-359014d9a19abdf5 · Amazon.com, Inc. unjudged
  • cdn.pyke.io:443 build code of ort-sys · build-script-main via accepted download (policy ccde352b-ab68-44a3-9448-3767958fbfdd: pkg:cargo/ort-sys, a prebuilt ONNX Runtime from cdn.pyke.io) · Cloudflare, Inc. · 1 file · went into an output accepted
  • static.crates.io:8080 the package manager · cargo (engram-mcp) via crates.io · 20,117 files · went into an output ecosystem
Vulnerabilities4PackageFixSeverity
RUSTSEC-2026-0346rustls 0.23.42>=0.23.46high
RUSTSEC-2026-0348rustls 0.23.42>=0.23.46high
RUSTSEC-2026-0349rustls 0.23.42>=0.23.46high
GHSA-2mjx-qc3c-rqvcrustls 0.23.42>=0.23.45medium
Dependencies337Build behaviour
ahash0.8.12build script
aho-corasick1.1.4
anstream1.0.0
anstyle1.0.14
anstyle-parse1.0.0
anstyle-query1.1.5
anyhow1.0.104build script
base640.13.1
base640.22.1
base640.23.0
bitflags2.13.1
byteorder1.5.0
bytes1.12.1
castaway0.2.4
cfg-if1.0.4
chacha200.10.1
chrono0.4.45
clap4.6.4
clap_builder4.6.2
clap_lex1.1.0
colorchoice1.0.5
compact_str0.9.1
console0.16.4
cpufeatures0.3.0
crc32fast1.5.0build script
crossbeam-channel0.5.16
crossbeam-deque0.8.7build script
crossbeam-epoch0.9.20build script
crossbeam-utils0.8.22build script
dary_heap0.3.9
derive_builder0.20.2
dirs6.0.0
dirs-sys0.5.0
dyn-clone1.0.20
either1.17.0
equivalent1.0.2
errno0.3.14
esaxx-rs0.1.10build script
fallible-iterator0.3.0
fallible-streaming-iterator0.1.9
fastrand2.5.0
flate21.1.9
foldhash0.2.0
futures0.3.33
futures-channel0.3.33
futures-core0.3.33
futures-executor0.3.33
futures-io0.3.33
futures-sink0.3.33
futures-task0.3.33
futures-util0.3.33
getrandom0.2.17
getrandom0.3.4build script
getrandom0.4.3build script
hashbrown0.17.1
hashlink0.12.1
hf-hub0.5.0
http1.4.2
httparse1.10.1build script
iana-time-zone0.1.65
indicatif0.18.6
is_terminal_polyfill1.70.2
itertools0.14.0
itoa1.0.18
lazy_static1.5.0
ld-linux-x86-64.so.2system library
libc0.2.189build script
libc.so.6system library
libcrypto.so.3system library
libgcc_s.so.1system library
libm.so.6system library
libmvec.so.1system library
libsqlite3-sys0.38.1build script
libssl.so.3system library
linux-raw-sys0.12.1
lock_api0.4.14
log0.4.33
macro_rules_attribute0.2.2
matchers0.2.0
matrixmultiply0.3.11build script
memchr2.8.3
miniz_oxide0.8.9
mio1.2.2
moka0.12.15
monostate0.1.18
ndarray0.17.2
nom7.1.3
nu-ansi-term0.50.3
num-complex0.4.6
num-integer0.1.46
num-traits0.2.19build script
once_cell1.21.4
onig6.5.3
onig_sys69.9.3build script
option-ext0.2.0
ort2.0.0-rc.12
ort-sys2.0.0-rc.12build scriptnetworkcdn.pyke.io
parking_lot0.12.5
parking_lot_core0.9.12build script
percent-encoding2.3.2
pin-project-lite0.2.17
portable-atomic1.14.0build script
ppv-lite860.2.21
rand0.10.2
rand0.9.5
rand_chacha0.9.0
rand_core0.10.1
rand_core0.9.5
rawpointer0.2.1
rayon1.12.0
rayon-cond0.4.0
rayon-core1.13.0build script
ref-cast1.0.26build script
regex1.13.1
regex-automata0.4.16
regex-syntax0.8.11
ring0.17.14build scriptprebuilt objects
rmcp2.2.0build script
rusqlite0.40.1
rustix1.1.4build script
rustls0.23.42build script
rustls-pki-types1.15.1
rustls-webpki0.103.13
ryu1.0.23
schemars1.2.2
scopeguard1.2.0
serde1.0.229build script
serde_core1.0.229build script
serde_json1.0.151build script
sharded-slab0.1.7
signal-hook-registry1.4.8
simd-adler320.3.10
slab0.4.12
smallvec1.15.2
socket20.6.5
socks0.3.4
spm_precompiled0.1.4
static_assertions1.1.0
strsim0.11.1
subtle2.6.1
tagptr0.2.0
tempfile3.27.0
thiserror2.0.19build script
thread_local1.1.10
tokenizers0.22.2
tokio1.53.1
tokio-util0.7.19
tracing0.1.44
tracing-core0.1.36
tracing-log0.2.0
tracing-subscriber0.3.23
unicode-normalization-alignments0.1.12
unicode-segmentation1.13.3
unicode-width0.2.2
unicode_categories0.1.1
unit-prefix0.5.2
untrusted0.9.0
ureq3.3.0
ureq-proto0.6.0
utf8-zero0.8.1
utf8parse0.2.2
uuid1.24.0
webpki-roots1.0.9
zerocopy0.8.55build script
zeroize1.9.0
zmij1.0.23build script
adler22.0.1
base64ct1.8.3
der0.8.1
foreign-types0.3.2
foreign-types-shared0.1.1
minimal-lexical0.2.1
native-tls0.2.18build script
openssl0.10.81build script
openssl-probe0.2.1
openssl-sys0.9.117build script
pem-rfc74681.0.0
unicode-ident1.0.24
webpki-root-certs1.0.9
alloca0.4.0build script
android_system_properties0.1.5
anes0.1.6
anstyle-wincon3.0.11
assert_cmd2.2.2build script
async-trait0.1.91proc macro
autocfg1.5.1
bstr1.13.0
bumpalo3.20.3
cast0.3.0
cc1.4.0
ciborium0.2.2
ciborium-io0.2.2
ciborium-ll0.2.2
clap_derive4.6.4proc macro
cookie0.18.1build script, not run
cookie_store0.22.1
core-foundation0.10.1
core-foundation-sys0.8.7
criterion0.8.2
criterion-plot0.8.2
crunchy0.2.4build script, not run
darling0.20.11
darling0.23.0
darling_core0.20.11
darling_core0.23.0
darling_macro0.20.11proc macro
darling_macro0.23.0proc macro
deranged0.5.8
derive_builder_core0.20.2
derive_builder_macro0.20.2proc macro
difflib0.4.0
displaydoc0.2.7proc macro
document-features0.2.12proc macro
encode_unicode1.0.0
find-msvc-tools0.1.9
fnv1.0.7
form_urlencoded1.2.2
futures-macro0.3.33proc macro
half2.7.1
hashbrown0.16.1
heck0.5.0
hmac-sha2561.1.14
iana-time-zone-haiku0.1.2build script, not run
icu_collections2.2.0
icu_locale_core2.2.0
icu_normalizer2.2.0
icu_normalizer_data2.2.0build script, not run
icu_properties2.2.0
icu_properties_data2.2.0build script, not run
icu_provider2.2.0
ident_case1.0.1
idna1.1.0
idna_adapter1.2.2
indexmap2.14.0
itertools0.13.0
js-sys0.3.103
libredox0.1.18
litemap0.8.2
litrs1.0.0
lzma-rust20.15.8
macro_rules_attribute-proc_macro0.2.2proc macro
monostate-impl0.1.18proc macro
num-conv0.2.2
once_cell_polyfill1.70.2
oorandom11.1.5
openssl-macros0.1.1proc macro
page_size0.6.0
paste1.0.15build scriptproc macro
pastey0.2.3proc macro
pkg-config0.3.33
plotters0.3.7
plotters-backend0.3.7
plotters-svg0.3.7
portable-atomic-util0.2.7build script, not run
potential_utf0.1.5
powerfmt0.2.0
predicates3.1.4
predicates-core1.0.10
predicates-tree1.0.13
proc-macro21.0.107build script
quote1.0.47build script
r-efi5.3.0
r-efi6.0.0
redox_syscall0.5.18
redox_users0.5.2
ref-cast-impl1.0.26proc macro
rmcp-macros2.2.0proc macro
rsqlite-vfs0.1.1
rustversion1.0.23build scriptproc macro
same-file1.0.6
schannel0.1.29
schemars_derive1.2.2proc macro
security-framework3.7.0
security-framework-sys2.17.0
serde_derive1.0.229proc macro
serde_derive_internals0.30.0
shlex2.0.1
sqlite-wasm-rs0.5.5build script, not run
stable_deref_trait1.2.1
syn2.0.119
syn3.0.3
synstructure0.13.2
termtree0.5.1
thiserror-impl2.0.19proc macro
time0.3.54
time-core0.1.9
time-macros0.2.32proc macro
tinystr0.8.3
tinytemplate1.2.1
tokio-macros2.7.1proc macro
tracing-attributes0.1.31proc macro
url2.5.8
utf8_iter1.0.4
valuable0.1.1build script, not run
vcpkg0.2.15prebuilt objects
version_check0.9.5
wait-timeout0.2.1
walkdir2.5.0
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.4+wasi-0.2.12
wasm-bindgen0.2.126build script, not run
wasm-bindgen-macro0.2.126proc macro
wasm-bindgen-macro-support0.2.126
wasm-bindgen-shared0.2.126build script, not run
web-sys0.3.103
web-time1.1.0
winapi0.3.9build script, not run
winapi-i686-pc-windows-gnu0.4.0build script, not runprebuilt objects
winapi-util0.1.11
winapi-x86_64-pc-windows-gnu0.4.0build script, not runprebuilt objects
windows-core0.62.2
windows-implement0.60.2proc macro
windows-interface0.59.3proc macro
windows-link0.2.1
windows-result0.4.1
windows-strings0.5.1
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
wit-bindgen0.57.1build script, not runprebuilt objects
writeable0.6.3
yoke0.8.3
yoke-derive0.8.2proc macro
zerocopy-derive0.8.55proc macro
zerofrom0.1.8
zerofrom-derive0.1.7proc macro
zerotrie0.2.4
zerovec0.11.6
zerovec-derive0.11.3proc macro
Versions16RiskVulnsPublished
0.11.0not analyzed2026-08-31
0.10.1not analyzed2026-07-31
0.10.0not analyzed2026-07-31
0.9.0not analyzed2026-07-31
0.7.0not analyzed2026-06-28
0.5.5not analyzed2026-06-04
0.5.4not analyzed2026-05-25
0.5.2not analyzed2026-05-21
0.5.1not analyzed2026-05-15
0.5.0not analyzed2026-05-15
0.4.0not analyzed2026-05-10
0.3.1not analyzed2026-03-23
0.3.0not analyzed2026-03-23
0.2.0not analyzed2026-03-21
0.1.0not analyzed2026-02-03
0.12.2infohigh

Raw data

capture
1.0 MB
records
159,779
bytes per record
6.5

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-18 · run 147ca451-2282-4525-aecc-1db46bfb1d3f

analysis 0.1.0 · 2026-10-17 · 0abbde9 · graph v2