Tracked packageView full profile for awesome-mcp-servers

MCPSafe.io

Security pre-install checks for MCP servers.

Mostly safe — a couple of notes worth reading.

Compare to another server

github · awesome-mcp-serversHEAD

Item: awesome-mcp-servers
Rating: 4
Author: MCPSafe

Scanned 5/3/2026, 6:58:58 PM·Cached result·Fast Scan·45 rules·How we decide ↗

AIVSS Score

2.3/ 10

Low

Severity Breakdown

critical

high

medium

low

MCP Server Information

Packageawesome-mcp-servers

VersionHEAD

SourceGITHUB

LicenseMIT

Publisherpunkpeye

Package age1y 5m

Stars86.2K

Downloads/wk—

Dependencies0

Homepagehttps://glama.ai/mcp/servers

Repositoryhttps://github.com/punkpeye/awesome-mcp-servers

Findings

3 of 3 findings

medium (3)

3 findings

medium (3)

AIVSS 2.3CVSS 3.5

GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.

Evidence

ref: ${{ github.event.pull_request.base.ref }}

      - name: Validate PR submission
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Report false positive

AIVSS 2.3CVSS 3.5

Evidence

runs-on: ubuntu-latest
    steps:
      - name: Post welcome comment
        uses: actions/github-script@v7
        with:
          script: |
            const { owner, repo } = context.repo;

Remediation

Report false positive

AIVSS 2.3CVSS 3.5

Evidence

runs-on: ubuntu-latest
    steps:
      - name: Checkout base branch
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.base.ref }}

Remediation

Report false positive

LLM summary— awesome-mcp-servers:HEAD

This package earns a B grade with a safety score of 91/100 but carries moderate risk due to three medium-severity server configuration issues that could affect deployment security. While no critical or high-severity vulnerabilities were found, you should review and address the configuration gaps before production use. The AIVSS score of 2.2/10 suggests limited AI/ML safety concerns, making this primarily a operational hardening matter rather than a fundamental security flaw.

Signal scores

CVE check100

Publisher identity50

Permissions100

Supply chain76

Typosquat100

Package health85

Community82

Secrets & exfil100

Injection risks100

Destructive ops100

LLM judge panel

CVE check

No known CVEs found for this package or its dependencies.

Community trust

No community reports

Security policy: Not found
Advisories: 0

Scan details

Total findings: 3
Affected tools: 0 / 1
Scan type: Fast Scan
Rules run: 45
LLM consensus score: N/A
Scanned: 54d ago
Source: GITHUB

MCP Server Information

Source: GITHUB
Package: awesome-mcp-servers
Version: HEAD
License: MIT
Publisher: punkpeye
Verified: No
Account age: 3y 10m
Added: 1y 5m ago
Versions: 86162
Homepage: https://glama.ai/mcp/servers
Repository: https://github.com/punkpeye/awesome-mcp-servers
Ecosystem: GitHub
Stars: 86.2K
Forks: 9.8K
Open issues: 861
Dependencies: 0

aimcp

AIVSS Score

2.3/ 10Low

Internal score: 91/100

Severity breakdown

Scan Details

Total findings3

Affected tools0 / 1

Scanned54d ago

Scan modeFAST

SourceGITHUB

Scan IDpubfastcc26eebdcdce76fcba0d

Want deeper analysis?

Fast scan found 3 findings using rule-based analysis. Upgrade for LLM consensus across 5 judges, AI-generated remediation, and cross-file taint analysis.

View plans Scan another package

Building your own MCP server?

Run this exact engine on your private repo — before users see it on /scan.

Same rules, same LLM judges, same grade. Private scans stay isolated to your account and never appear in the public registry. Required for code your team hasn’t shipped yet.

See plans with Private scans How private scans stay private

3 of 3 findings

medium (3)

3 findings

medium (3)

AIVSS 2.3CVSS 3.5

Evidence

ref: ${{ github.event.pull_request.base.ref }}

      - name: Validate PR submission
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');

Remediation

Report false positive

AIVSS 2.3CVSS 3.5

Evidence

runs-on: ubuntu-latest
    steps:
      - name: Post welcome comment
        uses: actions/github-script@v7
        with:
          script: |
            const { owner, repo } = context.repo;

Remediation

Report false positive

AIVSS 2.3CVSS 3.5

Evidence

runs-on: ubuntu-latest
    steps:
      - name: Checkout base branch
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.base.ref }}

Remediation

Report false positive

54	ref: ${{ github.event.pull_request.base.ref }}
55
56	- name: Validate PR submission
57	uses: actions/github-script@v7
58	with:
59	script: \|
60	const fs = require('fs');

16	runs-on: ubuntu-latest
17	steps:
18	- name: Post welcome comment
19	uses: actions/github-script@v7
20	with:
21	script: \|
22	const { owner, repo } = context.repo;

49	runs-on: ubuntu-latest
50	steps:
51	- name: Checkout base branch
52	uses: actions/checkout@v4
53	with:
54	ref: ${{ github.event.pull_request.base.ref }}