{"name":"io.github.yaver-io/yaver","slug":"yaver-io-yaver","title":"Yaver","description":"Phone-first local dev MCP for Claude Code and Codex: install Yaver, pair mobile, run, build, deploy.","url":"https://mcp.market/server/yaver-io-yaver","rating":null,"grade":"C","score":57,"certified":false,"status":"active","category":"devtools","tags":["devtools"],"presence":{"score":40,"stars":4,"forks":1,"downloads_week":1374,"last_push_at":"2026-09-19T13:54:44.000Z","license":"NOASSERTION"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/yaver-io/yaver.io","website":"https://yaver.io/docs/mcp","version":"1.99.468","remotes":[],"packages":[{"registryType":"npm","registryBaseUrl":"https://registry.npmjs.org","identifier":"yaver-cli","version":"1.99.468","runtimeHint":"npx","transport":{"type":"stdio"},"environmentVariables":[{"description":"Set to 1 to force device-code OAuth instead of opening a browser (useful in remote / WSL / sandboxed environments).","format":"string","name":"YAVER_HEADLESS"}]}],"tools":[],"scan":{"score":57,"grade":"C","scanned_at":"2026-09-19T21:32:28.516Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-19T21:32:28.521Z","components":{"code":{"score":3,"max":25,"notes":["25 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":15,"max":15,"notes":["last push 0 days ago"]},"identity":{"score":7,"max":10,"notes":["registry namespace matches repository owner"]}},"findings":[{"id":"install.script","severity":"medium","component":"code","title":"npm install lifecycle script present"},{"id":"install.script","severity":"medium","component":"code","title":"npm install lifecycle script present","evidence":"package.json: …est\": \"node --test test/*.test.js\", \"postinstall\": \"node src/postinstall.js\", \"preunin…"},{"id":"exec.shell-concat","severity":"high","component":"code","title":"Shell command built from a string (injection risk)","evidence":"src/commands/doctor.js: …ction commandExists(name) { try { execSync(`command -v ${name}`, { stdio: ['ignore', 'pipe', 'ign…"}],"inputs":{"packages":[{"registryType":"npm","identifier":"yaver-cli","version":"1.99.468","found":true,"license":"Apache-2.0","hasInstallScripts":true,"dependencyCount":2,"publishedAt":"2026-09-19T13:56:02.667Z","repositoryUrl":"git+https://github.com/yaver-io/yaver.io.git"}],"repo":{"found":true,"owner":"yaver-io","repo":"yaver.io","archived":false,"pushedAt":"2026-09-19T13:54:44Z","stars":4,"forks":1,"openIssues":3,"ownerType":"Organization","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/306204995?v=4","ownerCreatedAt":"2026-07-17T12:36:40Z","license":"NOASSERTION"},"icon":{"url":"https://yaver.io/icon-512.png","source":"registry","width":512,"height":512},"presence":{"stars":4,"forks":1,"downloadsWeek":1374,"license":"NOASSERTION","lastPushAt":"2026-09-19T13:54:44.000Z","score":40}}}},"grade_history":[],"reviews":[]}