npm · lazy-mcp2.4.0

Item: lazy-mcp
Rating: 4
Author: MCPSafe

Scanned 5/1/2026, 12:11:54 PM·Cached result·Fast Scan·45 rules·View source ↗·How we decide ↗

1 of 1 finding

medium (1)

LLM summary— lazy-mcp:2.4.0

This package earns a B grade with a safety score of 87/100 and carries one medium-severity finding related to server configuration that could affect how it operates in your environment. The single issue doesn't pose an immediate critical threat, but you should review the configuration recommendation before deployment to ensure it aligns with your security requirements. Overall, it's reasonably safe to install with standard precautions around the flagged configuration aspect.

Want deeper analysis?

Fast scan found 1 finding using rule-based analysis. Upgrade for LLM consensus across 5 judges, AI-generated remediation, and cross-file taint analysis.

View plans Scan another package

Building your own MCP server?

Run this exact engine on your private repo — before users see it on /scan.

Same rules, same LLM judges, same grade. Private scans stay isolated to your account and never appear in the public registry. Required for code your team hasn’t shipped yet.

See plans with Private scans How private scans stay private

1 of 1 finding

187	lazy-mcp --config servers.json --transport http --port 3000 --host 127.0.0.1 --path /mcp --auth-token "my-secret"
188	```
189
190	Security note: `--host 0.0.0.0` exposes the HTTP server on all network interfaces. Use it only inside Docker or trusted networks.
191
192	> Reverse proxy note: The default Origin check uses the scheme visible to
193	> lazy-mcp's own socket plus the incoming `Host` header. If you run lazy-mcp

187	lazy-mcp --config servers.json --transport http --port 3000 --host 127.0.0.1 --path /mcp --auth-token "my-secret"
188	```
189
190	Security note: `--host 0.0.0.0` exposes the HTTP server on all network interfaces. Use it only inside Docker or trusted networks.
191
192	> Reverse proxy note: The default Origin check uses the scheme visible to
193	> lazy-mcp's own socket plus the incoming `Host` header. If you run lazy-mcp

npm · lazy-mcp2.4.0

medium (1)

medium (1)

LLM summary— lazy-mcp:2.4.0

Signal scores

LLM judge panel

CVE check

Community trust

Scan details

MCP Server Information

Run this exact engine on your private repo — before users see it on /scan.

medium (1)

medium (1)

Severity breakdown