# io.github.bmoldo/terraback

> Scan AWS/Azure/GCP and generate Terraform HCL with import blocks, deterministically, for AI agents.

- name: io.github.bmoldo/terraback
- version: 0.6.0
- connection class: L0 (run_local_package)
- trust: 61/100 flags: no-repository
- quality: –/100 (not scored)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.bmoldo%2Fterraback
- tools: https://api.protogrid.dev/v1/servers/io.github.bmoldo%2Fterraback/tools

**Runs on your machine: something must execute the package.** Only local packages are published (npm, PyPI, OCI, …). The registry never executes them, so tools are unknown until you run it.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "terraback": {
      "command": "uvx",
      "args": [
        "terraback==0.6.0",
        "mcp"
      ],
      "env": {
        "TERRABACK_LICENSE": "${TERRABACK_LICENSE}"
      }
    }
  }
}
```

Placeholders to fill: `${TERRABACK_LICENSE}`.

## Trust

- hygiene: 80
- liveness: n/a
- freshness: 65
- provenance: 45
- drivers: +website ~liveness-unmeasured ~updated-96d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality –/100 (not scored)

Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package.

### protocol: n/a (weight 25)

- n/a `protocol.modern`, `protocol.stateless`, `protocol.transport`, `protocol.list_ttl`: no remote answered a protocol handshake (not probed yet, unreachable, or local-only)

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: n/a (weight 30)

- n/a `tools.descriptions`, `tools.description_length`, `tools.schemas`, `tools.annotations`, `tools.directory_hints`, `tools.token_cost`, `tools.api_dump`: tool list unknown (behind auth, not probed, or empty)

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`: tool list unknown

### dependencies: 67 (weight 15)

- fail `deps.known_vulns`: 14 advisories to act on (malicious, or rated high or critical with a fix available): GHSA-2g87-pp6c-29x5 in aiohttp@3.14.3 (indirect, fixed in 3.14.4), GHSA-5wr8-gcqf-gqf3 in aiohttp@3.14.3 (indirect, fixed in 3.14.4), GHSA-7gcm-g887-7qv7 in protobuf@4.25.9 (indirect, fixed in 5.29.6), ...; 17 more of lower severity or without a fix
- pass `deps.mcp_sdk_version`: mcp 1.30.0, no known advisory
- pass `deps.resolvable`: terraback@0.6.0 resolved: 131 packages

- tools: unknown
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.bmoldo/terraback.svg)](https://protogrid.dev/servers/io.github.bmoldo/terraback)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Dependencies

- pypi terraback@0.6.0: resolved, 130 dependencies, MCP SDK mcp 1.30.0
  - GHSA-ffc3-869f-jxw9 (critical) in `` pyjwt@2.10.1 ``, direct, fixed in `` 2.14.0 ``, advisory summary: "PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard" https://osv.dev/vulnerability/GHSA-ffc3-869f-jxw9
  - GHSA-2g87-pp6c-29x5 (high) in `` aiohttp@3.14.3 ``, indirect, fixed in `` 3.14.4 ``, advisory summary: "aiohttp: Multiple instances of excessive or unbounded memory/CPU use" https://osv.dev/vulnerability/GHSA-2g87-pp6c-29x5
  - GHSA-5wr8-gcqf-gqf3 (high) in `` aiohttp@3.14.3 ``, indirect, fixed in `` 3.14.4 ``, advisory summary: "aiohttp server lacks an initial request/header timeout" https://osv.dev/vulnerability/GHSA-5wr8-gcqf-gqf3
  - GHSA-7gcm-g887-7qv7 (high) in `` protobuf@4.25.9 ``, indirect, fixed in `` 5.29.6 ``, advisory summary: "protobuf affected by a JSON recursion depth bypass" https://osv.dev/vulnerability/GHSA-7gcm-g887-7qv7
  - GHSA-752w-5fwx-jx9f (high) in `` pyjwt@2.10.1 ``, direct, fixed in `` 2.12.0 ``, advisory summary: "PyJWT accepts unknown \`crit\` header extensions" https://osv.dev/vulnerability/GHSA-752w-5fwx-jx9f
  - GHSA-9v7f-9g4p-ffgj (high) in `` pyjwt@2.10.1 ``, direct, fixed in `` 2.14.0 ``, advisory summary: "PyJWT: PyJWKClient follows redirects when fetching JWKS" https://osv.dev/vulnerability/GHSA-9v7f-9g4p-ffgj
  - GHSA-p4g4-x82p-q773 (high) in `` pyjwt@2.10.1 ``, direct, fixed in `` 2.14.0 ``, advisory summary: "PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard" https://osv.dev/vulnerability/GHSA-p4g4-x82p-q773
  - GHSA-xgmm-8j9v-c9wx (high) in `` pyjwt@2.10.1 ``, direct, fixed in `` 2.13.0 ``, advisory summary: "PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed" https://osv.dev/vulnerability/GHSA-xgmm-8j9v-c9wx
  - GHSA-2xpw-w6gg-jr37 (high) in `` urllib3@1.26.20 ``, direct, fixed in `` 2.6.0 ``, advisory summary: "urllib3 streaming API improperly handles highly compressed data" https://osv.dev/vulnerability/GHSA-2xpw-w6gg-jr37
  - GHSA-38jv-5279-wg99 (high) in `` urllib3@1.26.20 ``, direct, fixed in `` 2.6.3 ``, advisory summary: "Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)" https://osv.dev/vulnerability/GHSA-38jv-5279-wg99
  - GHSA-8988-9cw3-xx77 (high) in `` urllib3@1.26.20 ``, direct, fixed in `` 2.8.0 ``, advisory summary: "urllib3: HTTPS proxy TLS configuration may be ignored or overridden" https://osv.dev/vulnerability/GHSA-8988-9cw3-xx77
  - GHSA-gm62-xv2j-4w53 (high) in `` urllib3@1.26.20 ``, direct, fixed in `` 2.6.0 ``, advisory summary: "urllib3 allows an unbounded number of links in the decompression chain" https://osv.dev/vulnerability/GHSA-gm62-xv2j-4w53
  - GHSA-qccp-gfcp-xxvc (high) in `` urllib3@1.26.20 ``, direct, fixed in `` 2.7.0 ``, advisory summary: "urllib3: Sensitive headers forwarded across origins in proxied low-level redirects" https://osv.dev/vulnerability/GHSA-qccp-gfcp-xxvc
  - GHSA-vxq7-64xx-v4gw (high) in `` urllib3@1.26.20 ``, direct, fixed in `` 2.8.0 ``, advisory summary: "urllib3: HTTPResponse.stream()/read\_chunked() buffers an unbounded chunk-size line into memory" https://osv.dev/vulnerability/GHSA-vxq7-64xx-v4gw
  - GHSA-m5vv-6r4h-3vj9 (moderate) in `` azure-identity@1.15.0 ``, direct, fixed in `` 1.16.1 ``, advisory summary: "Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability" https://osv.dev/vulnerability/GHSA-m5vv-6r4h-3vj9
  - GHSA-hj66-6f7g-4r5v (moderate) in `` oauthlib@3.3.1 ``, indirect, fixed in `` 4.0.0 ``, advisory summary: "Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation" https://osv.dev/vulnerability/GHSA-hj66-6f7g-4r5v
  - GHSA-xpv3-w29h-x7cv (moderate) in `` oauthlib@3.3.1 ``, indirect, fixed in `` 4.0.0 ``, advisory summary: "Oauthlib: Timing Attack Vulnerability in PKCE code\_verifier Comparison (CWE-208)" https://osv.dev/vulnerability/GHSA-xpv3-w29h-x7cv
  - GHSA-2gx3-rcp4-g85q (moderate) in `` pyjwt@2.10.1 ``, direct, fixed in `` 2.14.0 ``, advisory summary: "PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)" https://osv.dev/vulnerability/GHSA-2gx3-rcp4-g85q
  - GHSA-42vr-xj54-vc7v (moderate) in `` pyjwt@2.10.1 ``, direct, fixed in `` 2.15.0 ``, advisory summary: "PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get\_signing\_key\_from\_jwt / verify\_signature=False)" https://osv.dev/vulnerability/GHSA-42vr-xj54-vc7v
  - GHSA-993g-76c3-p5m4 (moderate) in `` pyjwt@2.10.1 ``, direct, fixed in `` 2.13.0 ``, advisory summary: "PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes" https://osv.dev/vulnerability/GHSA-993g-76c3-p5m4
  - GHSA-hxm8-2xgr-2p9m (moderate) in `` pyjwt@2.10.1 ``, direct, fixed in `` 2.14.0 ``, advisory summary: "PyJWT: Non-canonical signature segments enable raw-token revocation bypass" https://osv.dev/vulnerability/GHSA-hxm8-2xgr-2p9m
  - GHSA-jq35-7prp-9v3f (moderate) in `` pyjwt@2.10.1 ``, direct, fixed in `` 2.13.0 ``, advisory summary: "PyJWT: Algorithm allow-list bypass when decoding with \`PyJWK\` / \`PyJWKClient\` keys" https://osv.dev/vulnerability/GHSA-jq35-7prp-9v3f
  - GHSA-jwrc-g2q2-pq5p (moderate) in `` pyjwt@2.10.1 ``, direct, fixed in `` 2.14.0 ``, advisory summary: "PyJWT: ReDoS vulnerability when calling the \`is\_pem\_format\` function." https://osv.dev/vulnerability/GHSA-jwrc-g2q2-pq5p
  - GHSA-w6j9-cwv2-h6wq (moderate) in `` pyjwt@2.10.1 ``, direct, fixed in `` 2.14.0 ``, advisory summary: "PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set" https://osv.dev/vulnerability/GHSA-w6j9-cwv2-h6wq
  - GHSA-w7vc-732c-9m39 (moderate) in `` pyjwt@2.10.1 ``, direct, fixed in `` 2.13.0 ``, advisory summary: "PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS" https://osv.dev/vulnerability/GHSA-w7vc-732c-9m39
  - GHSA-x33g-cr3x-6449 (moderate) in `` pyjwt@2.10.1 ``, direct, fixed in `` 2.15.0 ``, advisory summary: "PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion" https://osv.dev/vulnerability/GHSA-x33g-cr3x-6449
  - GHSA-pq67-6m6q-mj2v (moderate) in `` urllib3@1.26.20 ``, direct, fixed in `` 2.5.0 ``, advisory summary: "urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation" https://osv.dev/vulnerability/GHSA-pq67-6m6q-mj2v
  - GHSA-494j-54xm-rwp3 (low) in `` aiohttp@3.14.3 ``, indirect, fixed in `` 3.14.4 ``, advisory summary: "AIOHTTP: Secure attribute not enforced for shared cookie" https://osv.dev/vulnerability/GHSA-494j-54xm-rwp3
  - GHSA-5239-wwwm-4pmq (low) in `` pygments@2.19.1 ``, direct, fixed in `` 2.20.0 ``, advisory summary: "Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching" https://osv.dev/vulnerability/GHSA-5239-wwwm-4pmq
  - GHSA-fhv5-28vv-h8m8 (low) in `` pyjwt@2.10.1 ``, direct, fixed in `` 2.13.0 ``, advisory summary: "PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)" https://osv.dev/vulnerability/GHSA-fhv5-28vv-h8m8
  - PYSEC-2025-183 (unrated) in `` pyjwt@2.10.1 ``, direct, no fix yet, advisory summary: "pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may benefit from a minimum value and a mechanism for opting in to strict enforcement)." https://osv.dev/vulnerability/PYSEC-2025-183

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

_none_

## Packages

- pypi terraback@0.6.0 secrets: TERRABACK_LICENSE

## Tools (0)

_none observed_