Tracked packageView full profile for mcp-proxy →

MCPSafe.io

Security pre-install checks for MCP servers.

Mostly safe — a couple of notes worth reading.

Compare to another server

github · mcp-proxyHEAD

Item: mcp-proxy
Rating: 4
Author: MCPSafe

Scanned 5/3/2026, 6:35:29 PM·Cached result·Fast Scan·45 rules·How we decide ↗

AIVSS Score

3.2/ 10

Low

Severity Breakdown

critical

high

medium

low

MCP Server Information

Packagemcp-proxy

VersionHEAD

SourceGITHUB

LicenseMIT

Publishersparfenyuk

Package age1y 4m

Stars2.5K

Downloads/wk—

Dependencies0

Repositoryhttps://github.com/sparfenyuk/mcp-proxy

Findings

4 of 4 findings

medium (4)

4 findings

medium (4)

AIVSS 2.3CVSS 3.5

Service binds to 0.0.0.0 — all network interfaces. For MCP servers that only need to talk to a single parent process, bind to 127.0.0.1 (or a Unix domain socket) instead.

Evidence

# Start the MCP server behind the proxy with a custom host and port
# (deprecated) mcp-proxy --sse-host=0.0.0.0 --sse-port=8080 uvx mcp-server-fetch
mcp-proxy --host=0.0.0.0 --port=8080 uvx mcp-server-fetch

# Start the MCP server behind the proxy with a custom user agent
# Note that the `--` separator is used to separate the `mcp-proxy` arguments from the `mcp-server-fetch` arguments

Remediation

Bind to 127.0.0.1 for local-only access. If cross-host access is truly required, put the service behind an authenticated reverse proxy rather than exposing it on 0.0.0.0.

Report false positive →

AIVSS 3.2CVSS 4.4

Container base image uses the floating :latest tag. This provides no reproducibility — the image content can change under you, and there is no signature to verify.

Evidence

```Dockerfile
# file: mcp-proxy.Dockerfile

FROM ghcr.io/sparfenyuk/mcp-proxy:latest

# Install the 'uv' package
RUN python3 -m ensurepip && pip install --no-cache-dir uv

Remediation

Pin the base image by digest (e.g. python@sha256:...) or at minimum an exact semver tag (e.g. python:3.12.4-slim-bookworm). Never use :latest in production Dockerfiles.

Report false positive →

AIVSS 3.2CVSS 4.4

Dockerfile never sets a non-root `USER` directive, so the CMD runs as root by default. Any RCE or library-level vulnerability exploited inside this container gets full privileges (MCP Top-10 R3). Add `USER <non-root>` before CMD / ENTRYPOINT in the final stage — e.g. `USER 1000`, `USER nobody`, or `USER nonroot` on distroless.

Evidence

# Build stage with explicit platform specification
FROM ghcr.io/astral-sh/uv:python3.13-alpine AS uv

# Install the project into /app
WORKDIR /app

# Enable bytecode compilation
ARG UV_COMPILE_BYTECODE=1

# Copy from the cache instead of linking since it's a mounted volume
ARG UV_LINK_MODE=copy

# Install the project's dependencies using the lockfile and settings
RUN --mount=type=cache,target=/root/.cache/uv \
    --mount=type=bind,source=uv.lock,target=uv.lock \
    --mount=type=bind,source=pyp

Remediation

Create and switch to a non-root user before the CMD / ENTRYPOINT: RUN adduser --system --uid 1000 app USER 1000 Or reuse the base image's shipped non-root account (e.g. `USER nobody`, `USER nonroot` on distroless). Multi-stage builds only need the USER directive in the final stage.

Report false positive →

AIVSS 2.3CVSS 3.5

GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.

Evidence

steps:
      - name: Fetch metadata
        id: metadata
        uses: dependabot/fetch-metadata@v2
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
      - name: Auto-merge Patch PRs

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Report false positive →

LLM summary— mcp-proxy:HEAD

This package receives a B grade with a safety score of 90/100 but has a moderate AIVSS score of 3.2/10, driven by four medium-severity findings related to server configuration and insecure container image practices. While no critical or high-risk issues were detected, you should review the configuration hardening recommendations and container image security improvements before deployment. The findings suggest this is generally safe to use with standard security practices, though addressing the medium-severity issues would strengthen your security posture.

Signal scores

Static100

CVE check100

Publisher identity50

Permissions92

Supply chain76

Typosquat100

Package health85

Community82

Secrets & exfil100

Injection risks100

Destructive ops100

LLM judge panel

CVE check

No known CVEs found for this package or its dependencies.

Community trust

No community reports

Security policy: Not found
Advisories: 0

Scan details

Total findings: 4
Affected tools: 0 / 1
Scan type: Fast Scan
Rules run: 45
LLM consensus score: N/A
Scanned: 11d ago
Source: GITHUB

MCP Server Information

Source: GITHUB
Package: mcp-proxy
Version: HEAD
License: MIT
Publisher: sparfenyuk
Verified: No
Account age: 16y 7m
Added: 1y 4m ago
Versions: 2482
Repository: https://github.com/sparfenyuk/mcp-proxy
Ecosystem: GitHub
Stars: 2.5K
Forks: 229
Open issues: 47
Dependencies: 0

mcpmcp-serverproxyssestreamable-http

AIVSS Score

3.2/ 10Low

Internal score: 90/100

Severity breakdown

Scan Details

Total findings4

Affected tools0 / 1

Scanned11d ago

Scan modeFAST

SourceGITHUB

Scan IDpubfastd61ba71c8e44e66ead07

Want deeper analysis?

Fast scan found 4 findings using rule-based analysis. Upgrade for LLM consensus across 5 judges, AI-generated remediation, and cross-file taint analysis.

View plans Scan another package

Building your own MCP server?

Run this exact engine on your private repo — before users see it on /scan.

Same rules, same LLM judges, same grade. Private scans stay isolated to your account and never appear in the public registry. Required for code your team hasn’t shipped yet.

See plans with Private scans How private scans stay private

4 of 4 findings

medium (4)

4 findings

medium (4)

AIVSS 2.3CVSS 3.5

Service binds to 0.0.0.0 — all network interfaces. For MCP servers that only need to talk to a single parent process, bind to 127.0.0.1 (or a Unix domain socket) instead.

Evidence

# Start the MCP server behind the proxy with a custom host and port
# (deprecated) mcp-proxy --sse-host=0.0.0.0 --sse-port=8080 uvx mcp-server-fetch
mcp-proxy --host=0.0.0.0 --port=8080 uvx mcp-server-fetch

# Start the MCP server behind the proxy with a custom user agent
# Note that the `--` separator is used to separate the `mcp-proxy` arguments from the `mcp-server-fetch` arguments

Remediation

Bind to 127.0.0.1 for local-only access. If cross-host access is truly required, put the service behind an authenticated reverse proxy rather than exposing it on 0.0.0.0.

Report false positive →

AIVSS 3.2CVSS 4.4

Container base image uses the floating :latest tag. This provides no reproducibility — the image content can change under you, and there is no signature to verify.

Evidence

```Dockerfile
# file: mcp-proxy.Dockerfile

FROM ghcr.io/sparfenyuk/mcp-proxy:latest

# Install the 'uv' package
RUN python3 -m ensurepip && pip install --no-cache-dir uv

Remediation

Pin the base image by digest (e.g. python@sha256:...) or at minimum an exact semver tag (e.g. python:3.12.4-slim-bookworm). Never use :latest in production Dockerfiles.

Report false positive →

AIVSS 3.2CVSS 4.4

Evidence

# Build stage with explicit platform specification
FROM ghcr.io/astral-sh/uv:python3.13-alpine AS uv

# Install the project into /app
WORKDIR /app

# Enable bytecode compilation
ARG UV_COMPILE_BYTECODE=1

# Copy from the cache instead of linking since it's a mounted volume
ARG UV_LINK_MODE=copy

# Install the project's dependencies using the lockfile and settings
RUN --mount=type=cache,target=/root/.cache/uv \
    --mount=type=bind,source=uv.lock,target=uv.lock \
    --mount=type=bind,source=pyp

Remediation

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

steps:
      - name: Fetch metadata
        id: metadata
        uses: dependabot/fetch-metadata@v2
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
      - name: Auto-merge Patch PRs

Remediation

Report false positive →

148	# Start the MCP server behind the proxy with a custom host and port
149	# (deprecated) mcp-proxy --sse-host=0.0.0.0 --sse-port=8080 uvx mcp-server-fetch
150	mcp-proxy --host=0.0.0.0 --port=8080 uvx mcp-server-fetch
151
152	# Start the MCP server behind the proxy with a custom user agent
153	# Note that the `--` separator is used to separate the `mcp-proxy` arguments from the `mcp-server-fetch` arguments

276	```Dockerfile
277	# file: mcp-proxy.Dockerfile
278
279	FROM ghcr.io/sparfenyuk/mcp-proxy:latest
280
281	# Install the 'uv' package
282	RUN python3 -m ensurepip && pip install --no-cache-dir uv

148	# Start the MCP server behind the proxy with a custom host and port
149	# (deprecated) mcp-proxy --sse-host=0.0.0.0 --sse-port=8080 uvx mcp-server-fetch
150	mcp-proxy --host=0.0.0.0 --port=8080 uvx mcp-server-fetch
151
152	# Start the MCP server behind the proxy with a custom user agent
153	# Note that the `--` separator is used to separate the `mcp-proxy` arguments from the `mcp-server-fetch` arguments

276	```Dockerfile
277	# file: mcp-proxy.Dockerfile
278
279	FROM ghcr.io/sparfenyuk/mcp-proxy:latest
280
281	# Install the 'uv' package
282	RUN python3 -m ensurepip && pip install --no-cache-dir uv

1	# Build stage with explicit platform specification
2	FROM ghcr.io/astral-sh/uv:python3.13-alpine AS uv
3
4	# Install the project into /app
5	WORKDIR /app
6
7	# Enable bytecode compilation
8	ARG UV_COMPILE_BYTECODE=1
9
10	# Copy from the cache instead of linking since it's a mounted volume
11	ARG UV_LINK_MODE=copy
12
13	# Install the project's dependencies using the lockfile and settings
14	RUN --mount=type=cache,target=/root/.cache/uv \
15	--mount=type=bind,source=uv.lock,target=uv.lock \
16	--mount=type=bind,source=pyp

12	steps:
13	- name: Fetch metadata
14	id: metadata
15	uses: dependabot/fetch-metadata@v2
16	with:
17	github-token: "${{ secrets.GITHUB_TOKEN }}"
18	- name: Auto-merge Patch PRs