# io.github.yashdoke7/skeletongraph

> Zero-LLM structural code retrieval for AI coding agents, served over MCP.

- name: io.github.yashdoke7/skeletongraph
- version: 0.2.0
- connection class: L0 (run_local_package)
- trust: 96/100
- quality: –/100 (not scored)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.yashdoke7%2Fskeletongraph
- tools: https://api.protogrid.dev/v1/servers/io.github.yashdoke7%2Fskeletongraph/tools

**Runs on your machine: something must execute the package.** Only local packages are published (npm, PyPI, OCI, …). The registry never executes them, so tools are unknown until you run it.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "skeletongraph": {
      "command": "uvx",
      "args": [
        "skeletongraph==0.2.0",
        "serve",
        "--path"
      ]
    }
  }
}
```


## Trust

- hygiene: 100
- liveness: n/a
- freshness: 100
- provenance: 90
- drivers: +repository +namespace-matches-repo +website ~liveness-unmeasured +updated-25d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality –/100 (not scored)

Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package.

### protocol: n/a (weight 25)

- n/a `protocol.modern`, `protocol.stateless`, `protocol.transport`, `protocol.list_ttl`: no remote answered a protocol handshake (not probed yet, unreachable, or local-only)

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: n/a (weight 30)

- n/a `tools.descriptions`, `tools.description_length`, `tools.schemas`, `tools.annotations`, `tools.directory_hints`, `tools.token_cost`, `tools.api_dump`: tool list unknown (behind auth, not probed, or empty)

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`: tool list unknown

### dependencies: 50 (weight 15)

- fail `deps.known_vulns`: 4 advisories to act on (malicious, or rated high or critical with a fix available): GHSA-jhr6-gm9c-rqjv in sentence-transformers@3.4.1 (direct, fixed in 5.6.0), GHSA-29pf-2h5f-8g72 in transformers@4.50.3 (indirect, fixed in 5.3.0), GHSA-fgcw-684q-jj6r in transformers@4.50.3 (indirect, fixed in 5.5.0), ...; 19 more of lower severity or without a fix
- n/a `deps.mcp_sdk_version`: the official MCP SDK is not in the dependency graph
- pass `deps.resolvable`: skeletongraph@0.2.0 resolved: 70 packages

- tools: unknown
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.yashdoke7/skeletongraph.svg)](https://protogrid.dev/servers/io.github.yashdoke7/skeletongraph)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Dependencies

- pypi skeletongraph@0.2.0: resolved, 69 dependencies
  - GHSA-jhr6-gm9c-rqjv (critical) in `` sentence-transformers@3.4.1 ``, direct, fixed in `` 5.6.0 ``, advisory summary: "sentence-transformers local model loading bypasses trust\_remote\_code and executes custom Python" https://osv.dev/vulnerability/GHSA-jhr6-gm9c-rqjv
  - GHSA-29pf-2h5f-8g72 (high) in `` transformers@4.50.3 ``, indirect, fixed in `` 5.3.0 ``, advisory summary: "HuggingFace transformers vulnerable to remote code execution" https://osv.dev/vulnerability/GHSA-29pf-2h5f-8g72
  - GHSA-fgcw-684q-jj6r (high) in `` transformers@4.50.3 ``, indirect, fixed in `` 5.5.0 ``, advisory summary: "huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path" https://osv.dev/vulnerability/GHSA-fgcw-684q-jj6r
  - GHSA-xrqw-3rrv-vx5w (high) in `` transformers@4.50.3 ``, indirect, fixed in `` 5.10.0 ``, advisory summary: "Transformers save\_pretrained path traversal allows arbitrary file writes through chat template names" https://osv.dev/vulnerability/GHSA-xrqw-3rrv-vx5w
  - GHSA-x9r9-c232-4q39 (high) in `` transformers@4.50.3 ``, indirect, no fix yet, advisory summary: "Hugging Face Transformers downloads custom generation code before trust consent" https://osv.dev/vulnerability/GHSA-x9r9-c232-4q39
  - GHSA-37mw-44qp-f5jm (moderate) in `` transformers@4.50.3 ``, indirect, fixed in `` 4.52.1 ``, advisory summary: "Transformers is vulnerable to ReDoS attack through its DonutProcessor class" https://osv.dev/vulnerability/GHSA-37mw-44qp-f5jm
  - GHSA-489j-g2vx-39wf (moderate) in `` transformers@4.50.3 ``, indirect, fixed in `` 4.51.0 ``, advisory summary: "Transformers vulnerable to ReDoS attack through its SETTING\_RE variable" https://osv.dev/vulnerability/GHSA-489j-g2vx-39wf
  - GHSA-4w7r-h757-3r74 (moderate) in `` transformers@4.50.3 ``, indirect, fixed in `` 4.53.0 ``, advisory summary: "Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer" https://osv.dev/vulnerability/GHSA-4w7r-h757-3r74
  - GHSA-59p9-h35m-wg4g (moderate) in `` transformers@4.50.3 ``, indirect, fixed in `` 4.53.0 ``, advisory summary: "Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer" https://osv.dev/vulnerability/GHSA-59p9-h35m-wg4g
  - GHSA-69w3-r845-3855 (moderate) in `` transformers@4.50.3 ``, indirect, fixed in `` 5.0.0rc3 ``, advisory summary: "HuggingFace Transformers allows for arbitrary code execution in the \`Trainer\` class" https://osv.dev/vulnerability/GHSA-69w3-r845-3855
  - GHSA-9356-575x-2w9m (moderate) in `` transformers@4.50.3 ``, indirect, fixed in `` 4.53.0 ``, advisory summary: "Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability" https://osv.dev/vulnerability/GHSA-9356-575x-2w9m
  - GHSA-jjph-296x-mrcr (moderate) in `` transformers@4.50.3 ``, indirect, fixed in `` 4.51.0 ``, advisory summary: "Transformers vulnerable to ReDoS attack through its get\_imports() function" https://osv.dev/vulnerability/GHSA-jjph-296x-mrcr
  - GHSA-q2wp-rjmx-x6x9 (moderate) in `` transformers@4.50.3 ``, indirect, fixed in `` 4.51.0 ``, advisory summary: "Transformers's ReDoS vulnerability in get\_configuration\_file can lead to catastrophic backtracking" https://osv.dev/vulnerability/GHSA-q2wp-rjmx-x6x9
  - GHSA-rcv9-qm8p-9p6j (moderate) in `` transformers@4.50.3 ``, indirect, fixed in `` 4.53.0 ``, advisory summary: "Hugging Face Transformers library has Regular Expression Denial of Service" https://osv.dev/vulnerability/GHSA-rcv9-qm8p-9p6j
  - GHSA-phhr-52qp-3mj4 (low) in `` transformers@4.50.3 ``, indirect, fixed in `` 4.52.1 ``, advisory summary: "Transformers's Improper Input Validation vulnerability can be exploited through username injection" https://osv.dev/vulnerability/GHSA-phhr-52qp-3mj4
  - PYSEC-2025-211 (unrated) in `` transformers@4.50.3 ``, indirect, no fix yet, advisory summary: "Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in" https://osv.dev/vulnerability/PYSEC-2025-211
  - PYSEC-2025-212 (unrated) in `` transformers@4.50.3 ``, indirect, no fix yet, advisory summary: "Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerabilit" https://osv.dev/vulnerability/PYSEC-2025-212
  - PYSEC-2025-213 (unrated) in `` transformers@4.50.3 ``, indirect, no fix yet, advisory summary: "Hugging Face Transformers megatron\_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in th" https://osv.dev/vulnerability/PYSEC-2025-213
  - PYSEC-2025-214 (unrated) in `` transformers@4.50.3 ``, indirect, no fix yet, advisory summary: "Hugging Face Transformers SEW convert\_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target" https://osv.dev/vulnerability/PYSEC-2025-214
  - PYSEC-2025-215 (unrated) in `` transformers@4.50.3 ``, indirect, no fix yet, advisory summary: "Hugging Face Transformers SEW-D convert\_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the targe" https://osv.dev/vulnerability/PYSEC-2025-215
  - PYSEC-2025-216 (unrated) in `` transformers@4.50.3 ``, indirect, no fix yet, advisory summary: "Hugging Face Transformers HuBERT convert\_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the targ" https://osv.dev/vulnerability/PYSEC-2025-216
  - PYSEC-2025-217 (unrated) in `` transformers@4.50.3 ``, indirect, no fix yet, advisory summary: "Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vuln" https://osv.dev/vulnerability/PYSEC-2025-217
  - PYSEC-2025-218 (unrated) in `` transformers@4.50.3 ``, indirect, no fix yet, advisory summary: "Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the ta" https://osv.dev/vulnerability/PYSEC-2025-218

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

_none_

## Packages

- pypi skeletongraph@0.2.0

## Tools (0)

_none observed_