# io.github.IvanRublev/keyphrases-mcp

> An MCP server to extract keyphrases from a text with the BERT model

- name: io.github.IvanRublev/keyphrases-mcp
- version: 0.0.4
- connection class: L0 (run_local_package)
- trust: 70/100
- quality: –/100 (not scored)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.IvanRublev%2Fkeyphrases-mcp
- tools: https://api.protogrid.dev/v1/servers/io.github.IvanRublev%2Fkeyphrases-mcp/tools

**Runs on your machine: something must execute the package.** Only local packages are published (npm, PyPI, OCI, …). The registry never executes them, so tools are unknown until you run it.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "keyphrases-mcp": {
      "command": "uvx",
      "args": [
        "keyphrases-mcp-server",
        "--allowed-dir",
        "keyphrases-mcp==0.0.4"
      ]
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: n/a
- freshness: 25
- provenance: 80
- drivers: +repository +namespace-matches-repo ~liveness-unmeasured -stale-370d
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality –/100 (not scored)

Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package.

### protocol: n/a (weight 25)

- n/a `protocol.modern`, `protocol.stateless`, `protocol.transport`, `protocol.list_ttl`: no remote answered a protocol handshake (not probed yet, unreachable, or local-only)

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: n/a (weight 30)

- n/a `tools.descriptions`, `tools.description_length`, `tools.schemas`, `tools.annotations`, `tools.directory_hints`, `tools.token_cost`, `tools.api_dump`: tool list unknown (behind auth, not probed, or empty)

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`: tool list unknown

### dependencies: 67 (weight 15)

- fail `deps.known_vulns`: 1 advisory to act on (malicious, or rated high or critical with a fix available): GHSA-53q9-r3pm-6pq6 in torch@2.2.2 (direct, fixed in 2.6.0); 20 more of lower severity or without a fix
- pass `deps.mcp_sdk_version`: mcp 2.2.0, no known advisory
- pass `deps.resolvable`: keyphrases-mcp@0.0.4 resolved: 142 packages

- tools: unknown
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.IvanRublev/keyphrases-mcp.svg)](https://protogrid.dev/servers/io.github.IvanRublev/keyphrases-mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Dependencies

- pypi keyphrases-mcp@0.0.4: resolved, 141 dependencies, MCP SDK mcp 2.2.0
  - GHSA-53q9-r3pm-6pq6 (critical) in `` torch@2.2.2 ``, direct, fixed in `` 2.6.0 ``, advisory summary: "PyTorch: \`torch.load\` with \`weights\_only=True\` leads to remote code execution" https://osv.dev/vulnerability/GHSA-53q9-r3pm-6pq6
  - GHSA-8mgp-746c-j5xp (high) in `` nltk@3.10.3 ``, indirect, no fix yet, advisory summary: "NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots" https://osv.dev/vulnerability/GHSA-8mgp-746c-j5xp
  - GHSA-887c-mr87-cxwp (moderate) in `` torch@2.2.2 ``, direct, fixed in `` 2.8.0 ``, advisory summary: "PyTorch Improper Resource Shutdown or Release vulnerability" https://osv.dev/vulnerability/GHSA-887c-mr87-cxwp
  - GHSA-vgrw-7cvw-pwgx (moderate) in `` torch@2.2.2 ``, direct, fixed in `` 2.9.1 ``, advisory summary: "PyTorch is vulnerable to memory corruption through its unpack\_sequence function" https://osv.dev/vulnerability/GHSA-vgrw-7cvw-pwgx
  - GHSA-f4hp-rmr7-r7v8 (moderate) in `` torch@2.2.2 ``, direct, no fix yet, advisory summary: "PyTorch is Vulnerable to Memory Consumption through pad\_packed\_sequence Function" https://osv.dev/vulnerability/GHSA-f4hp-rmr7-r7v8
  - GHSA-3749-ghw9-m3mg (low) in `` torch@2.2.2 ``, direct, fixed in `` 2.7.1-rc1 ``, advisory summary: "PyTorch susceptible to local Denial of Service" https://osv.dev/vulnerability/GHSA-3749-ghw9-m3mg
  - GHSA-qfhq-4f3w-5fph (low) in `` torch@2.2.2 ``, direct, fixed in `` 2.10.0 ``, advisory summary: "PyTorch is vulnerable to memory corruption through its torch.lstm\_cell function" https://osv.dev/vulnerability/GHSA-qfhq-4f3w-5fph
  - GHSA-rrmf-rvhw-rf47 (low) in `` torch@2.2.2 ``, direct, fixed in `` 2.13.0 ``, advisory summary: "PyTorch is vulnerable to memory corruption through its torch.jit.script function" https://osv.dev/vulnerability/GHSA-rrmf-rvhw-rf47
  - GHSA-c678-jfcj-6jmf (low) in `` torch@2.2.2 ``, direct, no fix yet, advisory summary: "PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of None Argument" https://osv.dev/vulnerability/GHSA-c678-jfcj-6jmf
  - GHSA-x3gm-94wq-g975 (low) in `` torch@2.2.2 ``, direct, no fix yet, advisory summary: "PyTorch: Manipulation of the argument scale/zero\_point leads to improper initialization via Quantized Sigmoid Module" https://osv.dev/vulnerability/GHSA-x3gm-94wq-g975
  - PYSEC-2024-259 (unrated) in `` torch@2.2.2 ``, direct, fixed in `` 2.5.0 ``, advisory summary: "In PyTorch \<=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing." https://osv.dev/vulnerability/PYSEC-2024-259
  - PYSEC-2025-198 (unrated) in `` torch@2.2.2 ``, direct, fixed in `` 2.7.0 ``, advisory summary: "In PyTorch through 2.6.0, when eager is used, nn.PairwiseDistance(p=2) produces incorrect results." https://osv.dev/vulnerability/PYSEC-2025-198
  - PYSEC-2025-203 (unrated) in `` torch@2.2.2 ``, direct, fixed in `` 2.9.0 ``, advisory summary: "An issue in the component torch.linalg.lu of pytorch v2.8.0 allows attackers to cause a Denial of Service (DoS) when performing a slice operation." https://osv.dev/vulnerability/PYSEC-2025-203
  - PYSEC-2025-204 (unrated) in `` torch@2.2.2 ``, direct, fixed in `` 2.9.0 ``, advisory summary: "pytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn\_like are used together." https://osv.dev/vulnerability/PYSEC-2025-204
  - PYSEC-2025-205 (unrated) in `` torch@2.2.2 ``, direct, fixed in `` 2.7.1 ``, advisory summary: "A syntax error in the component proxy\_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS)." https://osv.dev/vulnerability/PYSEC-2025-205
  - PYSEC-2025-206 (unrated) in `` torch@2.2.2 ``, direct, fixed in `` 2.9.0 ``, advisory summary: "pytorch v2.8.0 was discovered to contain an integer overflow in the component torch.nan\_to\_num-.long()." https://osv.dev/vulnerability/PYSEC-2025-206
  - PYSEC-2025-207 (unrated) in `` torch@2.2.2 ``, direct, fixed in `` 2.7.1 ``, advisory summary: "A Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of Service (DoS)." https://osv.dev/vulnerability/PYSEC-2025-207
  - PYSEC-2025-208 (unrated) in `` torch@2.2.2 ``, direct, fixed in `` 2.7.1 ``, advisory summary: "A buffer overflow occurs in pytorch v2.7.0 when a PyTorch model consists of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view-torch.mv() and is compiled by Inductor, leading to a Denial of Service (DoS)." https://osv.dev/vulnerability/PYSEC-2025-208
  - PYSEC-2025-209 (unrated) in `` torch@2.2.2 ``, direct, fixed in `` 2.7.1 ``, advisory summary: "An issue in pytorch v2.7.0 can lead to a Denial of Service (DoS) when a PyTorch model consists of torch.Tensor.to\_sparse() and torch.Tensor.to\_dense() and is compiled by Inductor." https://osv.dev/vulnerability/PYSEC-2025-209
  - PYSEC-2026-2286 (unrated) in `` torch@2.2.2 ``, direct, fixed in `` 2.10.0 ``, advisory summary: "PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's \`weights\_only\` unpickler allows an attacker to craft a malicious checkpoint file (\`.pth\`) that, when loaded with \`torch.load(..., weights\_only=True)\`, can corrupt memory and potentiall" https://osv.dev/vulnerability/PYSEC-2026-2286
  - PYSEC-2026-139 (unrated) in `` torch@2.2.2 ``, direct, no fix yet, advisory summary: "A vulnerability was identified in PyTorch 2.10.0. The affected element is an unknown function of the component pt2 Loading Handler. The manipulation leads to deserialization. The attack can only be performed from a local environment. The exploit is publicly available and might be used. The project w" https://osv.dev/vulnerability/PYSEC-2026-139

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

_none_

## Packages

- pypi keyphrases-mcp@0.0.4

## Tools (0)

_none observed_