Resource-scan receipts

yzfly/Awesome-MCP-ZH

Canonical URL: https://github.com/yzfly/Awesome-MCP-ZH · Fetched from: https://raw.githubusercontent.com/yzfly/Awesome-MCP-ZH/HEAD/README.md · Machine form: /v1/resource-scans/github-com-yzfly-awesome-mcp-zh-ff17cd51a2 · Markdown

Latest receipt: 4 of 8 checks flagged — the findings below are the record. SHA-256 of the exact bytes scanned: ecd1e589dbf84aeb3c6e4e117c03b6e6f9410c56d70ea90f3a5a6903feb30290 · 352942 bytes · scanned 2026-10-27T12:22:23.518Z · scanner resource-scan-v1 · ledger entry 1578.

Analysis is static only: the bytes were read as text and were never executed, installed or run. Nothing was fetched from behind a login.

Checks (latest receipt)

• Outbound network references — flag

  The scanned bytes reference outbound network activity to these domains: 5ire.app, a16z.com, agentskills.io, api.eulerpool.com, api.star-history.com, api.you.com, app.taisly.com, better-design.com, bibigpt.co, blog.modelcontextprotocol.io, call4.me, callmemcp.com, canlicapital.com, chainflip-broker.io, chatwise.app, clawsearch.cc, cli.nylas.com, cloud.siliconflow.cn, crates.io, cursor.sh, dchub.cloud, deepchat.thinkinai.xyz, developer.huaweicloud.com, dino.markets, docs.anthropic.com, docs.chatwise.app, docs.formo.so, docs.qq.com, ee.chat, eulerpool.com, evermind-ai.github.io, files.mdnice.com, flujo.com.co, formo.so, getyoutubetranscript.com, gitea.com, github.com, gitlab.wikimedia.org, gitmcp.io, glama.ai, gumpbox.com, gwmcp.lkcoffee.com, hc.jiandaoyun.com, img.shields.io, leanctx.com, lumify.ai, magichour.ai, manto.xin, markwang90.github.io, mcp.buywhere.ai, mcp.contextstream.io, mcp.didichuxing.com, mcp.finlight.me, mcp.folay.top, mcp.gomdori.app, mcp.ing, mcp.magichour.ai, mcp.mailkite.dev, mcp.meeting.tencent.com, mcp.mnemoverse.com, mcp.openshorts.app, mcp.pianam.cn, mcp.posteverywhere.ai, mcp.prisma.io, mcp.remotearc.app, mcp.runcomfy.com, mcp.so, mcp.squirrelscan.com, mcp.tapetide.com, mcp.tryunsora.com, mcp.worklittle.com, mcplato.com, meeting.tencent.com, memory.agentage.io, modelcontextprotocol.io, motomarks.io, mp.weixin.qq.com, mydreamthreads.xyz, npmscan.com, omentir.com, onlyclaws.world, open-mcp.org, open.lkcoffee.com, open.wps.cn, openchainbench.com, openhook.dev, phinn.github.io, piszczek.pl, pypi.org, registry.modelcontextprotocol.io, stack.convex.dev, talivia.com, threatcluster.io, transcriptapi.com, transcriptfetch.com, uizze.com, vibemarketing.ninja, vidwords.com, vixl.app, www.aionui.com, www.anthropic.com, www.e-stat.go.jp, www.ee.chat, www.hype-stack.dev, www.npmjs.com, www.prisma.io, www.reddit.com, www.runcomfy.com, www.star-history.com, xiaocai.sque.site, youjb.com, youtu.be, yunsoft.com, zapier.com. Any resource that reaches the network can send data out as well as bring data in; the findings name what the bytes reference, and the reader decides whether that fits the resource's stated purpose.

  Evidence: domain: 5ire.app; domain: a16z.com; domain: agentskills.io; domain: api.eulerpool.com; domain: api.star-history.com; domain: api.you.com; domain: app.taisly.com; domain: better-design.com; domain: bibigpt.co; domain: blog.modelcontextprotocol.io; domain: call4.me; domain: callmemcp.com; domain: canlicapital.com; domain: chainflip-broker.io; domain: chatwise.app; domain: clawsearch.cc; domain: cli.nylas.com; domain: cloud.siliconflow.cn; domain: crates.io; domain: cursor.sh; domain: dchub.cloud; domain: deepchat.thinkinai.xyz; domain: developer.huaweicloud.com; domain: dino.markets; domain: docs.anthropic.com; domain: docs.chatwise.app; domain: docs.formo.so; domain: docs.qq.com; domain: ee.chat; domain: eulerpool.com; domain: evermind-ai.github.io; domain: files.mdnice.com; domain: flujo.com.co; domain: formo.so; domain: getyoutubetranscript.com; domain: gitea.com; domain: github.com; domain: gitlab.wikimedia.org; domain: gitmcp.io; domain: glama.ai; domain: gumpbox.com; domain: gwmcp.lkcoffee.com; domain: hc.jiandaoyun.com; domain: img.shields.io; domain: leanctx.com; domain: lumify.ai; domain: magichour.ai; domain: manto.xin; domain: markwang90.github.io; domain: mcp.buywhere.ai; domain: mcp.contextstream.io; domain: mcp.didichuxing.com; domain: mcp.finlight.me; domain: mcp.folay.top; domain: mcp.gomdori.app; domain: mcp.ing; domain: mcp.magichour.ai; domain: mcp.mailkite.dev; domain: mcp.meeting.tencent.com; domain: mcp.mnemoverse.com; domain: mcp.openshorts.app; domain: mcp.pianam.cn; domain: mcp.posteverywhere.ai; domain: mcp.prisma.io; domain: mcp.remotearc.app; domain: mcp.runcomfy.com; domain: mcp.so; domain: mcp.squirrelscan.com; domain: mcp.tapetide.com; domain: mcp.tryunsora.com; domain: mcp.worklittle.com; domain: mcplato.com; domain: meeting.tencent.com; domain: memory.agentage.io; domain: modelcontextprotocol.io; domain: motomarks.io; domain: mp.weixin.qq.com; domain: mydreamthreads.xyz; domain: npmscan.com; domain: omentir.com; domain: onlyclaws.world; domain: open-mcp.org; domain: open.lkcoffee.com; domain: open.wps.cn; domain: openchainbench.com; domain: openhook.dev; domain: phinn.github.io; domain: piszczek.pl; domain: pypi.org; domain: registry.modelcontextprotocol.io; domain: stack.convex.dev; domain: talivia.com; domain: threatcluster.io; domain: transcriptapi.com; domain: transcriptfetch.com; domain: uizze.com; domain: vibemarketing.ninja; domain: vidwords.com; domain: vixl.app; domain: www.aionui.com; domain: www.anthropic.com; domain: www.e-stat.go.jp; domain: www.ee.chat; domain: www.hype-stack.dev; domain: www.npmjs.com; domain: www.prisma.io; domain: www.reddit.com; domain: www.runcomfy.com; domain: www.star-history.com; domain: xiaocai.sque.site; domain: youjb.com; domain: youtu.be; domain: yunsoft.com; domain: zapier.com

• Credential and environment access — flag

  The scanned bytes contain credential or environment access patterns: secret-named variables (API_KEY, SECRET, TOKEN, PASSWORD and similar names). The receipt names the pattern kinds only; no credential value is reproduced here.

  Evidence: secret-named variables (API_KEY, SECRET, TOKEN, PASSWORD and similar names)

• Install and postinstall hooks — pass

  No install or postinstall hooks were found in the scanned bytes.

• Obfuscation and encoded payloads — pass

  No obfuscation or encoded-payload signs were found in the scanned bytes.

• Shell-outs and download-and-execute — flag

  The scanned bytes contain shell-out or download patterns: shell command tools named in the bytes (curl, wget, powershell); download-and-execute pattern (fetched content passed to an executor in the same file). Code that runs shell commands acts with the full permissions of whoever runs it.

  Evidence: shell command tools named in the bytes (curl, wget, powershell); download-and-execute pattern (fetched content passed to an executor in the same file)

• Permission declarations vs behavior — flag

  The bytes show network, credentials behavior, and no permissions declaration was found in the scanned bytes to compare it against.

  Evidence: behavior: network; behavior: credentials

• Known-bad indicators — pass

  None of the scanner's published known-bad indicator patterns matched the scanned bytes.

• Provenance facts (weak signals) — pass

  Provenance facts, labeled weak signals — they say where the bytes sit, not what the bytes do: source host: github.com; repository: yzfly/Awesome-MCP-ZH; bytes scanned: 352942; fetched from: https://raw.githubusercontent.com/yzfly/Awesome-MCP-ZH/HEAD/README.md.

  Evidence: source host: github.com; repository: yzfly/Awesome-MCP-ZH; bytes scanned: 352942; fetched from: https://raw.githubusercontent.com/yzfly/Awesome-MCP-ZH/HEAD/README.md

History

Every receipt for this artifact so far names the same SHA-256: the bytes have not changed between scans.

• 2026-10-27 — 4 of 8 checks flagged · SHA-256 ecd1e589dbf84aeb… · 352942 bytes · scanner resource-scan-v1 · ledger entry 1578