{
  "slug": "airtable",
  "tool_id": "npm/@felores/airtable-mcp-server",
  "verdict_url": "/verdict/airtable",
  "verdict_content_hash": "sha256:6b8e00907b9bdfc91079188a2a19a32be87fe740318ba4ed05598c69007510d2",
  "version": "0.3.0",
  "commit": "80a4f496d815efcef9873762ad637df0d0db35fa",
  "dist_shasum": "23c30d8a4d47ef5b48fef46fccbad85309092985",
  "scanned_at": "2026-06-14T00:00:00Z",
  "capture_self_test": "verified — a beacon decoy was emitted from the tool's network context; its presence in the intercept means a 'no egress' result would have been trustworthy.",
  "method": "Installed and run in an isolated container; fed traceable decoy data; all outbound traffic intercepted (TLS broken via own CA, iptables transparent redirect). Endpoints, resolved geo/jurisdiction and frequency are observed facts. Capture self-test passed.",
  "request_count": 12,
  "captured_requests": [
    {
      "method": "GET",
      "scheme": "https",
      "host": "api.airtable.com",
      "path": "/v0/meta/bases",
      "headers": {
        "Accept": "application/json, text/plain, */*",
        "Authorization": "Bearer canary-dummy",
        "User-Agent": "axios/1.17.0",
        "Accept-Encoding": "gzip, compress, deflate, br",
        "Host": "api.airtable.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "GET",
      "scheme": "https",
      "host": "api.airtable.com",
      "path": "/v0/meta/bases/FILE-CONTENT::canary-0fa89825-file-55aa9420ffe9::END/tables",
      "headers": {
        "Accept": "application/json, text/plain, */*",
        "Authorization": "Bearer canary-dummy",
        "User-Agent": "axios/1.17.0",
        "Accept-Encoding": "gzip, compress, deflate, br",
        "Host": "api.airtable.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "POST",
      "scheme": "https",
      "host": "api.airtable.com",
      "path": "/v0/meta/bases/FILE-CONTENT::canary-0fa89825-file-55aa9420ffe9::END/tables",
      "headers": {
        "Accept": "application/json, text/plain, */*",
        "Content-Type": "application/json",
        "Authorization": "Bearer canary-dummy",
        "User-Agent": "axios/1.17.0",
        "Content-Length": "591",
        "Accept-Encoding": "gzip, compress, deflate, br",
        "Host": "api.airtable.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "{\"name\":\"Canary canary-0fa89825-name-8c99b794a2bb\",\"description\":\"FILE-CONTENT::canary-0fa89825-file-55aa9420ffe9::END\",\"fields\":[{\"0\":\"F\",\"1\":\"I\",\"2\":\"L\",\"3\":\"E\",\"4\":\"-\",\"5\":\"C\",\"6\":\"O\",\"7\":\"N\",\"8\":\"T\",\"9\":\"E\",\"10\":\"N\",\"11\":\"T\",\"12\":\":\",\"13\":\":\",\"14\":\"c\",\"15\":\"a\",\"16\":\"n\",\"17\":\"a\",\"18\":\"r\",\"19\":\"y\",\"20\":\"-\",\"21\":\"0\",\"22\":\"f\",\"23\":\"a\",\"24\":\"8\",\"25\":\"9\",\"26\":\"8\",\"27\":\"2\",\"28\":\"5\",\"29\":\"-\",\"30\":\"f\",\"31\":\"i\",\"32\":\"l\",\"33\":\"e\",\"34\":\"-\",\"35\":\"5\",\"36\":\"5\",\"37\":\"a\",\"38\":\"a\",\"39\":\"9\",\"40\":\"4\",\"41\":\"2\",\"42\":\"0\",\"43\":\"f\",\"44\":\"f\",\"45\":\"e\",\"46\":\"9\",\"47\":\":\",\"48\":\":\",\"49\":\"E\",\"50\":\"N\",\"51\":\"D\"}]}",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "PATCH",
      "scheme": "https",
      "host": "api.airtable.com",
      "path": "/v0/meta/bases/FILE-CONTENT::canary-0fa89825-file-55aa9420ffe9::END/tables/FILE-CONTENT::canary-0fa89825-file-55aa9420ffe9::END",
      "headers": {
        "Accept": "application/json, text/plain, */*",
        "Content-Type": "application/json",
        "Authorization": "Bearer canary-dummy",
        "User-Agent": "axios/1.17.0",
        "Content-Length": "120",
        "Accept-Encoding": "gzip, compress, deflate, br",
        "Host": "api.airtable.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "{\"name\":\"Canary canary-0fa89825-name-8c99b794a2bb\",\"description\":\"FILE-CONTENT::canary-0fa89825-file-55aa9420ffe9::END\"}",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "POST",
      "scheme": "https",
      "host": "api.airtable.com",
      "path": "/v0/meta/bases/FILE-CONTENT::canary-0fa89825-file-55aa9420ffe9::END/tables/FILE-CONTENT::canary-0fa89825-file-55aa9420ffe9::END/fields",
      "headers": {
        "Accept": "application/json, text/plain, */*",
        "Content-Type": "application/json",
        "Authorization": "Bearer canary-dummy",
        "User-Agent": "axios/1.17.0",
        "Content-Length": "2",
        "Accept-Encoding": "gzip, compress, deflate, br",
        "Host": "api.airtable.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "{}",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "PATCH",
      "scheme": "https",
      "host": "api.airtable.com",
      "path": "/v0/meta/bases/FILE-CONTENT::canary-0fa89825-file-55aa9420ffe9::END/tables/FILE-CONTENT::canary-0fa89825-file-55aa9420ffe9::END/fields/FILE-CONTENT::canary-0fa89825-file-55aa9420ffe9::END",
      "headers": {
        "Accept": "application/json, text/plain, */*",
        "Content-Type": "application/json",
        "Authorization": "Bearer canary-dummy",
        "User-Agent": "axios/1.17.0",
        "Content-Length": "2",
        "Accept-Encoding": "gzip, compress, deflate, br",
        "Host": "api.airtable.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "{}",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "GET",
      "scheme": "https",
      "host": "api.airtable.com",
      "path": "/v0/FILE-CONTENT::canary-0fa89825-file-55aa9420ffe9::END/Canary%20canary-0fa89825-name-8c99b794a2bb",
      "headers": {
        "Accept": "application/json, text/plain, */*",
        "Authorization": "Bearer canary-dummy",
        "User-Agent": "axios/1.17.0",
        "Accept-Encoding": "gzip, compress, deflate, br",
        "Host": "api.airtable.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "POST",
      "scheme": "https",
      "host": "api.airtable.com",
      "path": "/v0/FILE-CONTENT::canary-0fa89825-file-55aa9420ffe9::END/Canary%20canary-0fa89825-name-8c99b794a2bb",
      "headers": {
        "Accept": "application/json, text/plain, */*",
        "Content-Type": "application/json",
        "Authorization": "Bearer canary-dummy",
        "User-Agent": "axios/1.17.0",
        "Content-Length": "13",
        "Accept-Encoding": "gzip, compress, deflate, br",
        "Host": "api.airtable.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "{\"fields\":{}}",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "PATCH",
      "scheme": "https",
      "host": "api.airtable.com",
      "path": "/v0/FILE-CONTENT::canary-0fa89825-file-55aa9420ffe9::END/Canary%20canary-0fa89825-name-8c99b794a2bb/FILE-CONTENT::canary-0fa89825-file-55aa9420ffe9::END",
      "headers": {
        "Accept": "application/json, text/plain, */*",
        "Content-Type": "application/json",
        "Authorization": "Bearer canary-dummy",
        "User-Agent": "axios/1.17.0",
        "Content-Length": "13",
        "Accept-Encoding": "gzip, compress, deflate, br",
        "Host": "api.airtable.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "{\"fields\":{}}",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "DELETE",
      "scheme": "https",
      "host": "api.airtable.com",
      "path": "/v0/FILE-CONTENT::canary-0fa89825-file-55aa9420ffe9::END/Canary%20canary-0fa89825-name-8c99b794a2bb/FILE-CONTENT::canary-0fa89825-file-55aa9420ffe9::END",
      "headers": {
        "Accept": "application/json, text/plain, */*",
        "Authorization": "Bearer canary-dummy",
        "User-Agent": "axios/1.17.0",
        "Accept-Encoding": "gzip, compress, deflate, br",
        "Host": "api.airtable.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "GET",
      "scheme": "https",
      "host": "api.airtable.com",
      "path": "/v0/FILE-CONTENT::canary-0fa89825-file-55aa9420ffe9::END/Canary%20canary-0fa89825-name-8c99b794a2bb?filterByFormula=%7BCanary+canary-0fa89825-name-8c99b794a2bb%7D+%3D+%22FILE-CONTENT::canary-0fa89825-file-55aa9420ffe9::END%22",
      "headers": {
        "Accept": "application/json, text/plain, */*",
        "Authorization": "Bearer canary-dummy",
        "User-Agent": "axios/1.17.0",
        "Accept-Encoding": "gzip, compress, deflate, br",
        "Host": "api.airtable.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "GET",
      "scheme": "https",
      "host": "api.airtable.com",
      "path": "/v0/FILE-CONTENT::canary-0fa89825-file-55aa9420ffe9::END/Canary%20canary-0fa89825-name-8c99b794a2bb/FILE-CONTENT::canary-0fa89825-file-55aa9420ffe9::END",
      "headers": {
        "Accept": "application/json, text/plain, */*",
        "Authorization": "Bearer canary-dummy",
        "User-Agent": "axios/1.17.0",
        "Accept-Encoding": "gzip, compress, deflate, br",
        "Host": "api.airtable.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "",
      "blocked": true,
      "tls_inspected": true
    }
  ],
  "reproduce": {
    "scanner": "canary-sandbox (open methodology; Docker backend)",
    "command": "python -m canary.cli scan <target> --backend docker   # target: npm @felores/airtable-mcp-server@0.3.0",
    "note": "Re-run it yourself: the scanner installs the pinned version, drives the tool over MCP, and intercepts all egress."
  },
  "note": "Raw captured outbound requests from one sandbox run (identifiers/keys redacted). This is the underlying observation behind the verdict — re-run the scan to verify.",
  "verification": "verdict_content_hash = sha256 over the canonical verdict JSON; dist_shasum = the npm tarball checksum of the pinned version. Signed artifacts + an append-only immutable log are on the roadmap (toward independent verifiability).",
  "verdict_signature": "ed25519:m9gGvRc+8AftBSa7k5Fn2NOKc9gddP54oRxicN2pJmUrkuZI/IVQ885zPKc4QvtmG5fq0vCVsru2aeVYNJwPAg=="
}