Static scan: 2 manifest/implementation gap(s)

[Tetsurohhori]

I ran a static analyzer over MCP server manifests and implementations, looking for gaps between declared tool capabilities and what the code actually does. I found 2 item(s) in this repository that may be worth a look.

Findings

undeclared network access

• Location: unstract/sdk1/src/unstract/sdk1/cache.py:93 (commit 6b916eac0f42)
• Observed: network: requests.delete()
• Why flagged: Declared MCP surface does not mention this undeclared network access.

response = requests.delete(url, headers=headers)

undeclared network access

• Location: workers/log_consumer/process_log_history.py:62 (commit 6b916eac0f42)
• Observed: network: httpx.HTTPTransport()
• Why flagged: Declared MCP surface does not mention this undeclared network access.

transport = httpx.HTTPTransport(retries=3)

Reproduce

pip install mcp-blast-radius && mcp-blast-radius scan /path/to/your/mcp-server

If any of this is a false positive, please say so — I am tuning the detector.