Tracked packageView full profile for mcp →

MCPSafe.io

Security pre-install checks for MCP servers.

Mostly safe — a couple of notes worth reading.

Compare to another server

npm · mcp1.1.216

Item: mcp
Rating: 4
Author: MCPSafe

Scanned 5/1/2026, 9:11:56 AM·Cached result·Fast Scan·45 rules·View source ↗·How we decide ↗

AIVSS Score

2.3/ 10

Low

Severity Breakdown

critical

high

medium

low

MCP Server Information

Packagemcp

Version1.1.216

SourceNPM

LicenseISC

Publisherdks333

Package age1y 1m

Stars—

Downloads/wk4.8K

Dependencies16

Findings

3 of 3 findings

medium (3)

3 findings

medium (3)

AIVSS 2.3CVSS 3.5

MCP tool input schema exposes an unconstrained string/any field with a risky name (command/query/sql/code/script/url/path/expr/ eval). Any caller can pass arbitrary values, which typically widens the tool's blast radius well beyond its intent. Narrow the schema with `.enum()`, `.regex()`, `.max()`, `Literal[...]`, Pydantic `Field(max_length=..., pattern=...)`, or a JSON Schema `enum` / `pattern` / `maxLength`.

Evidence

'search',
    `Search across the ${config.name} documentation to fetch relevant context for a given query`,
    {
      query: z.string(),
    },
    async ({ query }) => {
      const results = await search(query, config);

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

return __awaiter(this, void 0, void 0, function* () {
        const config = yield fetchSearchConfigurationAndTools(SUBDOMAIN);
        server.tool('search', `Search across the ${config.name} documentation to fetch relevant context for a given query`, {
            query: z.string(),
        }, (_a) => __awaiter(this, [_a], void 0, function* ({ query }) {
            const results = yield search(query, config);
            const content = results.map((result) => {

Remediation

Report false positive →

AIVSS 2.3CVSS 3.5

Package declares an install-time hook (npm postinstall/preinstall/prepare, setup.py cmdclass override, custom setuptools install class, or non-default pyproject build-backend). Anyone installing this package runs the hook. Confirm the hook is necessary and review its contents; prefer shipping a plain library without install-time execution.

Evidence

},
  "main": "./bin/index.js",
  "scripts": {
    "prepare": "npm run build",
    "build": "tsc --project tsconfig.build.json",
    "clean:build": "rimraf bin",
    "clean:all": "rimraf node_modules .eslintcache && yarn clean:build",

Remediation

Prefer libraries that do not require install-time code execution: - Drop `postinstall`/`preinstall`/`prepare` scripts if the work can happen at runtime or build-time instead. - Ship pre-built native binaries rather than compiling via a custom `cmdclass` or `build_ext` override. - For Dockerfiles: replace `RUN curl … | sh` with a pinned download + checksum verification + explicit `RUN` of a named script. - If the hook is unavoidable, document exactly what it does so downstream reviewers

Report false positive →

LLM summary— mcp:1.1.216

This package earns a B grade with a safety score of 85/100 but carries moderate risk due to three medium-severity server configuration issues that could affect deployment security. While no critical or high-severity vulnerabilities were found, the configuration gaps should be addressed before production use. The AIVSS score of 2.2/10 indicates limited AI/LLM-specific security hardening.

Signal scores

CVE check100

Static100

Publisher identity10

Permissions100

Supply chain92

Typosquat100

Package health90

Community82

Secrets & exfil100

Injection risks84

Destructive ops100

LLM judge panel

CVE check

No known CVEs found for this package or its dependencies.

Community trust

No community reports

Security policy: Not found
Advisories: 0

Scan details

Total findings: 3
Affected tools: 1 / 2
Scan type: Fast Scan
Rules run: 45
LLM consensus score: N/A
Scanned: 12d ago
Source: NPM

Tool heatmap

mMCP tool input schema exposes an unconstrained string/any field with a risky name (command/query/sql/code/script/url/path/expr/ eval). Any caller can pass arbitrary values, which typically widens the tool's blast radius well beyond its intent. Narrow the schema with `.enum()`, `.regex()`, `.max()`, `Literal[...]`, Pydantic `Field(max_length=..., pattern=...)`, or a JSON Schema `enum` / `pattern` / `maxLength`.

MCP Server Information

Source: NPM
Package: mcp
Version: 1.1.216
License: ISC
Publisher: dks333
Verified: No
Added: 1y 1m ago
Versions: 228
Ecosystem: Node.js / npm
Downloads/wk: 4.8K
Dependencies: 16

AIVSS Score

2.3/ 10Low

Internal score: 85/100

Severity breakdown

Scan Details

Total findings3

Affected tools1 / 2

Scanned12d ago

Scan modeFAST

SourceNPM

Scan IDpubfast12bfa779b955daf69577

Want deeper analysis?

Fast scan found 3 findings using rule-based analysis. Upgrade for LLM consensus across 5 judges, AI-generated remediation, and cross-file taint analysis.

View plans Scan another package

Building your own MCP server?

Run this exact engine on your private repo — before users see it on /scan.

Same rules, same LLM judges, same grade. Private scans stay isolated to your account and never appear in the public registry. Required for code your team hasn’t shipped yet.

See plans with Private scans How private scans stay private

3 of 3 findings

medium (3)

3 findings

medium (3)

AIVSS 2.3CVSS 3.5

Evidence

'search',
    `Search across the ${config.name} documentation to fetch relevant context for a given query`,
    {
      query: z.string(),
    },
    async ({ query }) => {
      const results = await search(query, config);

Remediation

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

return __awaiter(this, void 0, void 0, function* () {
        const config = yield fetchSearchConfigurationAndTools(SUBDOMAIN);
        server.tool('search', `Search across the ${config.name} documentation to fetch relevant context for a given query`, {
            query: z.string(),
        }, (_a) => __awaiter(this, [_a], void 0, function* ({ query }) {
            const results = yield search(query, config);
            const content = results.map((result) => {

Remediation

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

},
  "main": "./bin/index.js",
  "scripts": {
    "prepare": "npm run build",
    "build": "tsc --project tsconfig.build.json",
    "clean:build": "rimraf bin",
    "clean:all": "rimraf node_modules .eslintcache && yarn clean:build",

Remediation

Report false positive →

68	'search',
69	`Search across the ${config.name} documentation to fetch relevant context for a given query`,
70	{
71	query: z.string(),
72	},
73	async ({ query }) => {
74	const results = await search(query, config);

62	return __awaiter(this, void 0, void 0, function* () {
63	const config = yield fetchSearchConfigurationAndTools(SUBDOMAIN);
64	server.tool('search', `Search across the ${config.name} documentation to fetch relevant context for a given query`, {
65	query: z.string(),
66	}, (_a) => __awaiter(this, [_a], void 0, function* ({ query }) {
67	const results = yield search(query, config);
68	const content = results.map((result) => {

8	},
9	"main": "./bin/index.js",
10	"scripts": {
11	"prepare": "npm run build",
12	"build": "tsc --project tsconfig.build.json",
13	"clean:build": "rimraf bin",
14	"clean:all": "rimraf node_modules .eslintcache && yarn clean:build",