Tracked packageView full profile for mcp-adapter

MCPSafe.io

Security pre-install checks for MCP servers.

Mostly safe — a couple of notes worth reading.

Compare to another server

github · mcp-adapterce0f0cee3ce6

Item: mcp-adapter
Rating: 4
Author: MCPSafe

Scanned 5/12/2026, 7:14:03 PM·Cached result·Fast Scan·48 rules·How we decide ↗

AIVSS Score

2.3/ 10

Low

Severity Breakdown

critical

high

medium

low

MCP Server Information

Packagemcp-adapter

Versionce0f0cee3ce6

SourceGITHUB

Package age—

Stars—

Downloads/wk—

Findings

5 of 5 findings

medium (5)

5 findings

medium (5)

AIVSS 2.3CVSS 3.5

GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.

Evidence

with:
          token: ${{ secrets.GH_TOKEN_PULL_REQUESTS }}

      - uses: pnpm/action-setup@v4
        name: Install pnpm
        id: pnpm-setup
        with:

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Report false positive

AIVSS 2.3CVSS 3.5

Evidence

id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.GH_TOKEN_PULL_REQUESTS }}

Remediation

Report false positive

AIVSS 2.3CVSS 3.5

Evidence

run: pnpm install --frozen-lockfile

      - name: Create Release PR or Publish Packages
        uses: changesets/action@v1
        with:
          publish: pnpm release
          version: pnpm version-packages

Remediation

Report false positive

AIVSS 2.3CVSS 3.5

Evidence

id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.GH_TOKEN_PULL_REQUESTS }}

Remediation

Report false positive

AIVSS 2.3CVSS 3.5

Evidence

with:
          token: ${{ secrets.GH_TOKEN_PULL_REQUESTS }}

      - uses: pnpm/action-setup@v4
        name: Install pnpm
        id: pnpm-setup
        with:

Remediation

Report false positive

LLM summary— mcp-adapter:ce0f0cee3ce6

This package earned a B grade with a safety score of 91/100 but has five medium-severity findings all related to server configuration issues. While no critical or high-severity vulnerabilities were detected, you should review and address the configuration weaknesses before deploying this in production. The AIVSS score of 2.2/10 suggests limited AI/ML security concerns, making it relatively safe from that perspective.

Signal scores

Static100

CVE check100

Permissions100

Supply chain60

Typosquat100

Package health50

Community82

Injection risks100

Secrets & exfil100

Destructive ops100

LLM judge panel

CVE check

No known CVEs found for this package or its dependencies.

Community trust

No community reports

Security policy: Not found
Advisories: 0

Scan details

Total findings: 5
Affected tools: 0 / 1
Scan type: Fast Scan
Rules run: 48
LLM consensus score: N/A
Scanned: 27d ago
Source: GITHUB

MCP Server Information

Source: GITHUB
Package: mcp-adapter
Version: ce0f0cee3ce6
Ecosystem: GitHub

AIVSS Score

2.3/ 10Low

Internal score: 91/100

Severity breakdown

Scan Details

Total findings5

Affected tools0 / 1

Scanned27d ago

Scan modeFAST

SourceGITHUB

Scan IDpubfast9f55420158d5bcc1dd88

Want deeper analysis?

Fast scan found 5 findings using rule-based analysis. Upgrade for LLM consensus across 5 judges, AI-generated remediation, and cross-file taint analysis.

View plans Scan another package

Building your own MCP server?

Run this exact engine on your private repo — before users see it on /scan.

Same rules, same LLM judges, same grade. Private scans stay isolated to your account and never appear in the public registry. Required for code your team hasn’t shipped yet.

See plans with Private scans How private scans stay private

5 of 5 findings

medium (5)

5 findings

medium (5)

AIVSS 2.3CVSS 3.5

Evidence

with:
          token: ${{ secrets.GH_TOKEN_PULL_REQUESTS }}

      - uses: pnpm/action-setup@v4
        name: Install pnpm
        id: pnpm-setup
        with:

Remediation

Report false positive

AIVSS 2.3CVSS 3.5

Evidence

id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.GH_TOKEN_PULL_REQUESTS }}

Remediation

Report false positive

AIVSS 2.3CVSS 3.5

Evidence

run: pnpm install --frozen-lockfile

      - name: Create Release PR or Publish Packages
        uses: changesets/action@v1
        with:
          publish: pnpm release
          version: pnpm version-packages

Remediation

Report false positive

AIVSS 2.3CVSS 3.5

Evidence

id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.GH_TOKEN_PULL_REQUESTS }}

Remediation

Report false positive

AIVSS 2.3CVSS 3.5

Evidence

with:
          token: ${{ secrets.GH_TOKEN_PULL_REQUESTS }}

      - uses: pnpm/action-setup@v4
        name: Install pnpm
        id: pnpm-setup
        with:

Remediation

Report false positive

24	with:
25	token: ${{ secrets.GH_TOKEN_PULL_REQUESTS }}
26
27	- uses: pnpm/action-setup@v4
28	name: Install pnpm
29	id: pnpm-setup
30	with:

20	id-token: write
21	steps:
22	- name: Checkout
23	uses: actions/checkout@v4
24	with:
25	token: ${{ secrets.GH_TOKEN_PULL_REQUESTS }}

39	run: pnpm install --frozen-lockfile
40
41	- name: Create Release PR or Publish Packages
42	uses: changesets/action@v1
43	with:
44	publish: pnpm release
45	version: pnpm version-packages