ToolTrust
F87/100
Smithery

powerly-powerly

mcpsmithery

@Smithery

Build and manage white-label EV charging mobile apps without writing code. Create Android (APK/AAB) and iOS builds connected to your OCPP-compatible charge point network. Stripe payment integration included. Manage and track your app builds directly from any MCP-compatible AI assistant.

By Smithery | 24 findings | Scanned 4/19/2026 | tooltrust-scanner/v0.3.8

12 High1 Medium4 Low7 Info

Risk Summary

Block in Production

Secret Handling + Dep Visibility risk is significant. Avoid using this in production agents.

Potential impact: Sensitive credentials may be read, logged, or leaked to external systems.

Recommended action: This tool should stay disabled in production agents until the flagged risks are fixed and the scan is clean.

{
  "mcpServers": {
    "powerly-powerly": {
      "disabled": true
    }
  }
}

Security Findings (24)

  • HighAS-002

    ⚠️Excessive Permissions ×3

    tool declares network permission

    auth_set_api_keybranded_app_create_buildbranded_app_get_build

    Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

  • HighAS-010

    🔑Insecure Secret Handling ×9

    input parameter "api_key" appears to accept a secret or credential

    auth_set_api_key

    input parameter "session_token" appears to accept a secret or credential

    branded_app_create_buildbranded_app_list_buildsbranded_app_get_buildcpms_list_sitescpms_list_charge_points

    input parameter "store_password" appears to accept a secret or credential

    branded_app_create_build

    input parameter "key_password" appears to accept a secret or credential

    branded_app_create_build

    input parameter "places_api_key" appears to accept a secret or credential

    branded_app_create_build

    Fix: Avoid accepting raw credentials as input parameters. Use secret managers (e.g. 1Password CLI, AWS Secrets Manager) and ensure credentials are never logged or stored in agent traces.

  • MediumAS-002

    ⚠️Excessive Permissions

    branded_app_create_build:tool declares fs permission

    Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

  • LowAS-011

    ℹ️Missing Rate-Limit / Timeout ×3

    tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

    auth_set_api_keybranded_app_create_buildbranded_app_get_build

    Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

  • LowAS-002

    ⚠️Excessive Permissions

    branded_app_create_build:input schema exposes 18 properties (threshold: 10)

    Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

  • InfoAS-014

    ℹ️Dependency Inventory Unavailable ×7

    Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

    pingauth_set_api_keybranded_app_create_buildbranded_app_list_buildsbranded_app_get_buildcpms_list_sitescpms_list_charge_points

    Fix: Review and remediate the identified issue.

Scan this tool yourself

Reproduce this audit locally, integrate into CI, or let your agent audit its own tools.

Install once, then scan any MCP server:

$ curl -sfL https://raw.githubusercontent.com/AgentSafe-AI/tooltrust-scanner/main/install.sh | bash
$ tooltrust-scanner scan --server "npx -y powerly-powerly"

Adjust the package name if your npm registry name differs from the tool ID. View source

Add badge to your README

Copy this Markdown to show your ToolTrust grade on GitHub.

[![ToolTrust Grade F](https://raw.githubusercontent.com/AgentSafe-AI/tooltrust-directory/main/docs/badges/grade-f.svg)](https://github.com/AgentSafe-AI/tooltrust-directory)