gcf-proxy

v0.1.0 suspicious
5.0
Medium Risk

MCP proxy that re-encodes JSON tool responses as GCF. Zero code changes.

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package shows minimal direct risks but raises concerns due to high metadata risk, including recent repository creation and incomplete author information.

  • High metadata risk
  • Recent repository creation
Per-check LLM notes
  • Network: No network calls detected, which is normal unless the package requires external communication.
  • Shell: No shell execution patterns detected, indicating no immediate signs of malicious activities.
  • Obfuscation: No obfuscation patterns detected, indicating low risk.
  • Credentials: No credential harvesting patterns detected, indicating low risk.
  • Metadata: High risk due to recent repository creation, lack of maintainer history, and incomplete author information.

🔬 Heuristic Checks

✓ Outbound Network Calls

No suspicious network call patterns found

✓ Code Obfuscation

No obfuscation patterns detected

✓ Shell / Subprocess Execution

No shell execution patterns detected

✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

No author email provided

✓ Suspicious Page Links

All external links appear legitimate

⚠ Git Repository History score 5.0

Git history flags: Repository created very recently: 1 day(s) ago (2026-06-04T00:29:41Z)

  • Repository created very recently: 1 day(s) ago (2026-06-04T00:29:41Z)
  • Repository has zero stars and zero forks
⚠ Maintainer History score 8.0

4 maintainer concern(s) found

  • Only one version has ever been released — brand new package
  • Package uploaded less than 24 hours ago (2026-06-05T06:13:53.000Z)
  • Author name is missing or very short
  • Author "" appears to have only 1 package on PyPI (new or inactive account)

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!