Tracked packageView full profile for quickbooks-online-mcp-server →

MCPSafe.io

Security pre-install checks for MCP servers.

Mostly safe — a couple of notes worth reading.

Compare to another server

github · quickbooks-online-mcp-server3794133db157

Item: quickbooks-online-mcp-server
Rating: 4
Author: MCPSafe

Scanned 5/1/2026, 8:07:22 PM·Cached result·Fast Scan·45 rules·How we decide ↗

AIVSS Score

2.8/ 10

Low

Severity Breakdown

critical

high

medium

low

MCP Server Information

Packagequickbooks-online-mcp-server

Version3794133db157

SourceGITHUB

LicenseApache-2.0

Publisherintuit

Package age6mo

Stars190

Downloads/wk—

Dependencies0

Repositoryhttps://github.com/intuit/quickbooks-online-mcp-server

Findings

6 of 6 findings

medium (6)

6 findings

medium (6)

AIVSS 2.8CVSS 3.5

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

Evidence

return new Promise((resolve, reject) => {
      // Create temporary server for OAuth callback
      const server = http.createServer(async (req, res) => {
        console.log(`[auth-server] ${req.method} ${req.url}`);

        // Respond to anything that isn't /callback so diagnostic probes (curl,
        // ngrok health checks, favicon requests, etc.) don't hang the server.

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Report false positive →

AIVSS 2.3CVSS 3.5

Package declares an install-time hook (npm postinstall/preinstall/prepare, setup.py cmdclass override, custom setuptools install class, or non-default pyproject build-backend). Anyone installing this package runs the hook. Confirm the hook is necessary and review its contents; prefer shipping a plain library without install-time execution.

Evidence

],
    "scripts": {
        "build": "tsc && shx chmod +x dist/*.js",
        "prepare": "npm run build",
        "watch": "tsc --watch",
        "lint:fix": "eslint --fix",
        "lint": "eslint .",

Remediation

Prefer libraries that do not require install-time code execution: - Drop `postinstall`/`preinstall`/`prepare` scripts if the work can happen at runtime or build-time instead. - Ship pre-built native binaries rather than compiling via a custom `cmdclass` or `build_ext` override. - For Dockerfiles: replace `RUN curl … | sh` with a pinned download + checksum verification + explicit `RUN` of a named script. - If the hook is unavoidable, document exactly what it does so downstream reviewers

Report false positive →

AIVSS 2.3CVSS 3.5

GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.

Evidence

actions: read # Required for Claude to read CI results on PRs
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

Remediation

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

- name: Run Claude Code Review
        id: claude-review
        uses: anthropics/claude-code-action@v1
        with:
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'

Remediation

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

- name: Run Claude Code
        id: claude
        uses: anthropics/claude-code-action@v1
        with:
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

Remediation

Report false positive →

LLM summary— quickbooks-online-mcp-server:3794133db157

This package scores 87/100 on safety with a B security grade, but carries six medium-severity findings centered on server configuration issues and one ansi escape injection vulnerability. The configuration weaknesses could expose the server to misuse or unexpected behavior, though no critical or high-severity flaws were detected. You should review the specific server configuration recommendations before deployment.

Signal scores

CVE check100

Static100

Publisher identity50

Permissions100

Supply chain60

Typosquat100

Package health75

Community82

Secrets & exfil100

Injection risks92

Destructive ops100

LLM judge panel

CVE check

No known CVEs found for this package or its dependencies.

Community trust

No community reports

Security policy: Not found
Advisories: 0

Scan details

Total findings: 6
Affected tools: 0 / 1
Scan type: Fast Scan
Rules run: 45
LLM consensus score: N/A
Scanned: 13d ago
Source: GITHUB

MCP Server Information

Source: GITHUB
Package: quickbooks-online-mcp-server
Version: 3794133db157
License: Apache-2.0
Publisher: intuit
Verified: No
Account age: 13y 7m
Added: 6 months ago
Versions: 190
Repository: https://github.com/intuit/quickbooks-online-mcp-server
Ecosystem: GitHub
Stars: 190
Forks: 101
Open issues: 10
Dependencies: 0

AIVSS Score

2.8/ 10Low

Internal score: 87/100

Severity breakdown

Scan Details

Total findings6

Affected tools0 / 1

Scanned13d ago

Scan modeFAST

SourceGITHUB

Scan IDpubfast150f3b8dfb3730f97ad9

Want deeper analysis?

Fast scan found 6 findings using rule-based analysis. Upgrade for LLM consensus across 5 judges, AI-generated remediation, and cross-file taint analysis.

View plans Scan another package

Building your own MCP server?

Run this exact engine on your private repo — before users see it on /scan.

Same rules, same LLM judges, same grade. Private scans stay isolated to your account and never appear in the public registry. Required for code your team hasn’t shipped yet.

See plans with Private scans How private scans stay private

6 of 6 findings

medium (6)

6 findings

medium (6)

AIVSS 2.8CVSS 3.5

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

Evidence

return new Promise((resolve, reject) => {
      // Create temporary server for OAuth callback
      const server = http.createServer(async (req, res) => {
        console.log(`[auth-server] ${req.method} ${req.url}`);

        // Respond to anything that isn't /callback so diagnostic probes (curl,
        // ngrok health checks, favicon requests, etc.) don't hang the server.

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

],
    "scripts": {
        "build": "tsc && shx chmod +x dist/*.js",
        "prepare": "npm run build",
        "watch": "tsc --watch",
        "lint:fix": "eslint --fix",
        "lint": "eslint .",

Remediation

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

actions: read # Required for Claude to read CI results on PRs
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

Remediation

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

Remediation

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

- name: Run Claude Code Review
        id: claude-review
        uses: anthropics/claude-code-action@v1
        with:
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'

Remediation

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

- name: Run Claude Code
        id: claude
        uses: anthropics/claude-code-action@v1
        with:
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

Remediation

Report false positive →

83	return new Promise((resolve, reject) => {
84	// Create temporary server for OAuth callback
85	const server = http.createServer(async (req, res) => {
86	console.log(`[auth-server] ${req.method} ${req.url}`);
87
88	// Respond to anything that isn't /callback so diagnostic probes (curl,
89	// ngrok health checks, favicon requests, etc.) don't hang the server.

11	],
12	"scripts": {
13	"build": "tsc && shx chmod +x dist/*.js",
14	"prepare": "npm run build",
15	"watch": "tsc --watch",
16	"lint:fix": "eslint --fix",
17	"lint": "eslint .",

26	actions: read # Required for Claude to read CI results on PRs
27	steps:
28	- name: Checkout repository
29	uses: actions/checkout@v4
30	with:
31	fetch-depth: 1

33	- name: Run Claude Code Review
34	id: claude-review
35	uses: anthropics/claude-code-action@v1
36	with:
37	claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
38	plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'

32	- name: Run Claude Code
33	id: claude
34	uses: anthropics/claude-code-action@v1
35	with:
36	claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}