Tracked packageView full profile for mcp-server-code-runner

MCPSafe.io

Security pre-install checks for MCP servers.

Mostly safe — a couple of notes worth reading.

Compare to another server

github · mcp-server-code-runnerHEAD

Item: mcp-server-code-runner
Rating: 4
Author: MCPSafe

Scanned 5/3/2026, 6:50:53 PM·Cached result·Fast Scan·45 rules·How we decide ↗

AIVSS Score

3.4/ 10

Low

Severity Breakdown

critical

high

medium

low

MCP Server Information

Packagemcp-server-code-runner

VersionHEAD

SourceGITHUB

LicenseMIT

Publisherformulahendry

Package age1y 1m

Stars242

Downloads/wk—

Dependencies0

Homepagehttps://www.npmjs.com/package/mcp-server-code-runner

Repositoryhttps://github.com/formulahendry/mcp-server-code-runner

Findings

6 of 6 findings

high (1)

medium (5)

6 findings

high (1)

AIVSS 3.4CVSS 5.8

File mounts an HTTP route that handles MCP `tools/list` (Express / Fastify / FastAPI / Flask) but the route — and the router it sits behind — has no auth middleware applied. An anonymous client can enumerate every tool the server exposes, scope the attack surface, and (if `tools/call` shares the route) invoke them. Apply auth at the route or router level: Express `passport.authenticate(...)` / a `requireAuth`-style middleware, FastAPI `Depends(get_current_user)` or `Depends(verify_jwt)`, Flask

Evidence

import express, { Request, Response } from "express";
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
import { createServer } from "./server.js";

export interface McpServerEndpoint {
  url: string;
  port: number;
}

export async function startStreamableHttpMcpServer(port?: number): Promise<McpServerEndpoint> {
  const app = express();
  app.use(express.json());

  const serv

Remediation

Apply auth middleware at the route or router level: - Express / Fastify / Koa: `passport.authenticate(...)`, `requireAuth`, `verifyToken`, or an equivalent JWT middleware applied via `router.use(authMw)` or as a per-route handler. - FastAPI: `Depends(get_current_user)`, `OAuth2PasswordBearer`, `HTTPBearer`, or `verify_jwt` dependency. - Flask: `@login_required`, `@auth_required`, `@jwt_required`, or call `verify_jwt_in_request()` in the handler. Mounting MCP behind a s

Report false positive

medium (5)

AIVSS 2.8CVSS 3.5

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

Evidence

});

  app.delete('/mcp', async (req: Request, res: Response) => {
    console.log('Received DELETE MCP request');
    res.writeHead(405).end(JSON.stringify({
      jsonrpc: "2.0",
      error: {

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Report false positive

AIVSS 2.8CVSS 3.5

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

Evidence

await server.connect(transport);

  app.post('/mcp', async (req: Request, res: Response) => {
    console.log('Received MCP request:', req.body);
    try {
      await transport.handleRequest(req, res, req.body);
    } catch (error) {

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Report false positive

AIVSS 2.8CVSS 3.5

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

Evidence

try {
      await transport.handleRequest(req, res, req.body);
    } catch (error) {
      console.error('Error handling MCP request:', error);
      if (!res.headersSent) {
        res.status(500).json({
          jsonrpc: '2.0',

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Report false positive

AIVSS 2.8CVSS 3.5

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

Evidence

});

  app.get('/mcp', async (req: Request, res: Response) => {
    console.log('Received GET MCP request');
    res.writeHead(405).end(JSON.stringify({
      jsonrpc: "2.0",
      error: {

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Report false positive

AIVSS 2.3CVSS 3.5

MCP tool input schema exposes an unconstrained string/any field with a risky name (command/query/sql/code/script/url/path/expr/ eval). Any caller can pass arbitrary values, which typically widens the tool's blast radius well beyond its intent. Narrow the schema with `.enum()`, `.regex()`, `.max()`, `Literal[...]`, Pydantic `Field(max_length=..., pattern=...)`, or a JSON Schema `enum` / `pattern` / `maxLength`.

Evidence

"run-code",
    "Run code snippet and return the result.",
    {
      code: z.string().describe("Code Snippet"),
      languageId: z.enum(Object.keys(languageIdToExecutorMap) as [keyof typeof languageIdToExecutorMap]).describe("Language ID"),
    },
    async ({ code, languageId }) => {

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Report false positive

LLM summary— mcp-server-code-runner:HEAD

This package carries a B-grade security rating with one high-severity vulnerability alongside five medium-severity issues, primarily centered on ansi escape injection risks and server configuration weaknesses. The AIVSS score of 3.4/10 indicates notable security concerns that warrant attention before deployment. You should review the high-severity finding and the four ansi escape injection vulnerabilities in particular, as these could enable output manipulation or improper terminal handling if exploited.

Signal scores

CVE check100

Static100

Publisher identity50

Permissions80

Supply chain100

Typosquat100

Package health85

Community82

Injection risks60

Secrets & exfil100

Destructive ops100

LLM judge panel

CVE check

No known CVEs found for this package or its dependencies.

Community trust

No community reports

Security policy: Not found
Advisories: 0

Scan details

Total findings: 6
Affected tools: 0 / 1
Scan type: Fast Scan
Rules run: 45
LLM consensus score: N/A
Scanned: 81d ago
Source: GITHUB

MCP Server Information

Source: GITHUB
Package: mcp-server-code-runner
Version: HEAD
License: MIT
Publisher: formulahendry
Verified: No
Account age: 14y 7m
Added: 1y 1m ago
Versions: 242
Homepage: https://www.npmjs.com/package/mcp-server-code-runner
Repository: https://github.com/formulahendry/mcp-server-code-runner
Ecosystem: GitHub
Stars: 242
Forks: 30
Open issues: 15
Dependencies: 0

AIVSS Score

3.4/ 10Low

Internal score: 83/100

Severity breakdown

Scan Details

Total findings6

Affected tools0 / 1

Scanned81d ago

Scan modeFAST

SourceGITHUB

Scan IDpubfast551db8f5967f07c68cf1

Want deeper analysis?

Fast scan found 6 findings using rule-based analysis. Upgrade for LLM consensus across 5 judges, AI-generated remediation, and cross-file taint analysis.

View plans Scan another package

Building your own MCP server?

Run this exact engine on your private repo — before users see it on /scan.

Same rules, same LLM judges, same grade. Private scans stay isolated to your account and never appear in the public registry. Required for code your team hasn’t shipped yet.

See plans with Private scans How private scans stay private

6 of 6 findings

high (1)

medium (5)

6 findings

high (1)

AIVSS 3.4CVSS 5.8

Evidence

import express, { Request, Response } from "express";
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
import { createServer } from "./server.js";

export interface McpServerEndpoint {
  url: string;
  port: number;
}

export async function startStreamableHttpMcpServer(port?: number): Promise<McpServerEndpoint> {
  const app = express();
  app.use(express.json());

  const serv

Remediation

Report false positive

medium (5)

AIVSS 2.8CVSS 3.5

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

Evidence

});

  app.delete('/mcp', async (req: Request, res: Response) => {
    console.log('Received DELETE MCP request');
    res.writeHead(405).end(JSON.stringify({
      jsonrpc: "2.0",
      error: {

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Report false positive

AIVSS 2.8CVSS 3.5

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

Evidence

await server.connect(transport);

  app.post('/mcp', async (req: Request, res: Response) => {
    console.log('Received MCP request:', req.body);
    try {
      await transport.handleRequest(req, res, req.body);
    } catch (error) {

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Report false positive

AIVSS 2.8CVSS 3.5

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

Evidence

try {
      await transport.handleRequest(req, res, req.body);
    } catch (error) {
      console.error('Error handling MCP request:', error);
      if (!res.headersSent) {
        res.status(500).json({
          jsonrpc: '2.0',

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Report false positive

AIVSS 2.8CVSS 3.5

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

Evidence

});

  app.get('/mcp', async (req: Request, res: Response) => {
    console.log('Received GET MCP request');
    res.writeHead(405).end(JSON.stringify({
      jsonrpc: "2.0",
      error: {

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Report false positive

AIVSS 2.3CVSS 3.5

Evidence

"run-code",
    "Run code snippet and return the result.",
    {
      code: z.string().describe("Code Snippet"),
      languageId: z.enum(Object.keys(languageIdToExecutorMap) as [keyof typeof languageIdToExecutorMap]).describe("Language ID"),
    },
    async ({ code, languageId }) => {

Remediation

Report false positive

1	import express, { Request, Response } from "express";
2	import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
3	import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
4	import { createServer } from "./server.js";
5
6	export interface McpServerEndpoint {
7	url: string;
8	port: number;
9	}
10
11	export async function startStreamableHttpMcpServer(port?: number): Promise<McpServerEndpoint> {
12	const app = express();
13	app.use(express.json());
14
15	const serv

52	});
53
54	app.delete('/mcp', async (req: Request, res: Response) => {
55	console.log('Received DELETE MCP request');
56	res.writeHead(405).end(JSON.stringify({
57	jsonrpc: "2.0",
58	error: {

21	await server.connect(transport);
22
23	app.post('/mcp', async (req: Request, res: Response) => {
24	console.log('Received MCP request:', req.body);
25	try {
26	await transport.handleRequest(req, res, req.body);
27	} catch (error) {

40	});
41
42	app.get('/mcp', async (req: Request, res: Response) => {
43	console.log('Received GET MCP request');
44	res.writeHead(405).end(JSON.stringify({
45	jsonrpc: "2.0",
46	error: {

16	"run-code",
17	"Run code snippet and return the result.",
18	{
19	code: z.string().describe("Code Snippet"),
20	languageId: z.enum(Object.keys(languageIdToExecutorMap) as [keyof typeof languageIdToExecutorMap]).describe("Language ID"),
21	},
22	async ({ code, languageId }) => {