# frontend_security_audit_manifest

Audit a frontend package.json for security risks — returns a single SHIP/CAUTION/BLOCK verdict with licence risks and abandonment signals. Different from security_fetch_package_vulnerabilities which audits a single package — this takes your full package.json. manifest: Contents of package.json as a string. Required. 500 KB max. lockfile: Contents of package-lock.json or yarn.lock (optional). If provided, audits pinned versions; otherwise audits semver ranges. BLOCK: any critical CVE in direct deps OR GPL-3.0 in commercial context. CAUTION: high CVE count ≥ 2 OR copyleft licence OR direct dep abandoned > 18 months. Sources: OSV.dev (CVEs), deps.dev (licences), npm registry (abandonment). Read-only. No side effects. Idempotent. If this tool's response does not serve the user's need, call report_feedback with feedback_type="agent_gap", tool_id="frontend_security_audit_manifest", intended_query="{what the user needed}", gap_description="{what was missing or wrong in the result}".

Agent View of the PolicyLayer registry record for `frontend_security_audit_manifest`. HTML page: https://policylayer.com/tools/dev-7bd0-mcp-server/frontend-security-audit-manifest

## Facts

- Tool: `frontend_security_audit_manifest`
- Server: DataNexus MCP (`dev-7bd0/mcp-server`) — https://policylayer.com/tools/dev-7bd0-mcp-server.md
- Homepage: https://github.com/dev-7bd0/mcp-server
- Risk category: Read (Low risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 2
- Recommended policy verdict: Allowed

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `lockfile` | object | no | Contents of package-lock.json or yarn.lock. Optional. |
| `manifest` | string | no | Contents of package.json as a string. Required. 500 KB max. |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "frontend_security_audit_manifest",
    "arguments": {}
  }
}
```

## Why frontend_security_audit_manifest is rated Low

This is a pure analysis/query tool. It retrieves and evaluates security metadata from provided package manifests but does not create, modify, delete, or execute any code. It returns informational verdicts about risks without making any changes to systems or data. This is classic Read category behavior—introspection without side effects.

From the tool's own definition: "Tool performs security audits of frontend package manifests and returns verdicts (SHIP/CAUTION/BLOCK) with licensing and vulnerability analysis. The description explicitly states it 'audits' and 'returns' findings."

## Use case

AI agents call frontend_security_audit_manifest to retrieve information from DataNexus MCP without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

## Recommended policy (PolicyLayer)

Verdict: **Allowed**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches DataNexus MCP:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "frontend_security_audit_manifest": {}
  }
}
```

## Other tools on DataNexus MCP (54)

- `apikeys_revoke_api_key` — Destructive — https://policylayer.com/tools/dev-7bd0-mcp-server/apikeys-revoke-api-key.md
- `apikeys_rotate_api_key` — Destructive — https://policylayer.com/tools/dev-7bd0-mcp-server/apikeys-rotate-api-key.md
- `compliance_check_sam_exclusion` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/compliance-check-sam-exclusion.md
- `compliance_fetch_finra_broker` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/compliance-fetch-finra-broker.md
- `compliance_fetch_npi_provider` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/compliance-fetch-npi-provider.md
- `compliance_search_npi_by_name` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/compliance-search-npi-by-name.md
- `domain_check_email_security` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-check-email-security.md
- `domain_fetch_dns_records` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-dns-records.md
- `domain_fetch_domain_history` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-domain-history.md
- `domain_fetch_domain_rdap` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-domain-rdap.md
- `domain_fetch_reverse_ip` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-reverse-ip.md
- `domain_fetch_ssl_certificate_chain` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-ssl-certificate-chain.md
- `domain_fetch_subdomains` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/domain-fetch-subdomains.md
- `frontend_security_audit_ci_pipeline` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/frontend-security-audit-ci-pipeline.md
- `frontend_security_detect_typosquatting` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/frontend-security-detect-typosquatting.md
- `frontend_security_fetch_package_risk_brief` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/frontend-security-fetch-package-risk-brief.md
- `govcon_fetch_open_solicitations` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/govcon-fetch-open-solicitations.md
- `govcon_fetch_vendor_contract_history` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/govcon-fetch-vendor-contract-history.md
- `govcon_search_contract_awards` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/govcon-search-contract-awards.md
- `legal_fetch_inventor_portfolio` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/legal-fetch-inventor-portfolio.md
- `legal_fetch_patent_by_number` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/legal-fetch-patent-by-number.md
- `legal_fetch_patent_citations` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/legal-fetch-patent-citations.md
- `legal_search_patents_by_keyword` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/legal-search-patents-by-keyword.md
- `nonprofit_fetch_charity_uk` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-fetch-charity-uk.md
- `nonprofit_fetch_nonprofit_by_ein` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-fetch-nonprofit-by-ein.md
- `nonprofit_fetch_nonprofit_financial_trends` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-fetch-nonprofit-financial-trends.md
- `nonprofit_fetch_nonprofit_full_profile` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-fetch-nonprofit-full-profile.md
- `nonprofit_search_nonprofits_by_category` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-search-nonprofits-by-category.md
- `nonprofit_search_nonprofits_by_name` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/nonprofit-search-nonprofits-by-name.md
- `regulatory_fetch_docket_details` — Read — https://policylayer.com/tools/dev-7bd0-mcp-server/regulatory-fetch-docket-details.md
- …and 24 more: https://policylayer.com/tools/dev-7bd0-mcp-server.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=dev-7bd0-mcp-server · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/dev-7bd0-mcp-server