Tracked packageView full profile for MCPBrowser →

MCPSafe.io

Security pre-install checks for MCP servers.

Mostly safe — a couple of notes worth reading.

Compare to another server

github · MCPBrowser7fdab035637f

Item: MCPBrowser
Rating: 4
Author: MCPSafe

Scanned 5/3/2026, 8:12:57 PM·Cached result·Fast Scan·45 rules·How we decide ↗

AIVSS Score

2.5/ 10

Low

Severity Breakdown

critical

high

medium

low

MCP Server Information

PackageMCPBrowser

Version7fdab035637f

SourceGITHUB

LicenseMIT

Publishercherchyk

Package age4mo

Stars6

Downloads/wk—

Dependencies0

Repositoryhttps://github.com/cherchyk/MCPBrowser

Findings

6 of 6 findings

medium (6)

6 findings

medium (6)

AIVSS 2.5CVSS 4.0

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

Evidence

async devtoolsAvailable() {
    try {
      const url = `http://${this.config.host}:${this.config.port}/json/version`;
      const res = await fetch(url, { method: "GET" });
      if (!res.ok) return false;
      const data = await res.json();
      return Boolean(data.webSocketDebuggerUrl);

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Report false positive →

AIVSS 2.5CVSS 4.0

Evidence

if (this.config.wsEndpoint) return this.config.wsEndpoint;
    
    const url = `http://${this.config.host}:${this.config.port}/json/version`;
    const res = await fetch(url);
    if (!res.ok) {
      throw new Error(`Unable to reach ${this.config.name} devtools at ${url}: ${res.status}`);
    }

Remediation

Report false positive →

AIVSS 2.3CVSS 3.5

GitHub Actions `uses:` reference is not pinned to a 40-character commit SHA. Tags (`@v4`) and branches (`@main`) are mutable — a compromised maintainer or a tag rewrite can substitute malicious code into your CI pipeline silently. Pin to a SHA: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab`. For readability, include the version as a trailing comment: `# v4.1.1`. Tools like `pinact` / `ratchet` automate this. Allowed unpinned forms (excluded by the rule): - Local actions `.

Evidence

runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v4
    
    - name: Setup Node.js
      uses: actions/setup-node@v4

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

- uses: actions/checkout@v4
    
    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: '20.x'
        cache: 'npm'

Remediation

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v4
    
    - name: Setup Node.js
      uses: actions/setup-node@v4

Remediation

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

- uses: actions/checkout@v4
    
    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: '20.x'
        registry-url: 'https://registry.npmjs.org'

Remediation

Report false positive →

LLM summary— MCPBrowser:7fdab035637f

This package scores 88/100 on safety with a B security grade, but carries six medium-severity findings focused on resource exhaustion and server configuration issues that could impact stability under load or with improper setup. The resource exhaustion vulnerabilities suggest the server may be susceptible to denial-of-service attacks or memory leaks, while the server configuration gaps indicate it may not follow security best practices out of the box. You should review the specific configuration recommendations and resource limits before deploying this in production.

Signal scores

CVE check100

Static84

Publisher identity50

Permissions100

Supply chain68

Typosquat100

Package health65

Community82

Injection risks100

Secrets & exfil100

Destructive ops100

LLM judge panel

CVE check

No known CVEs found for this package or its dependencies.

Community trust

No community reports

Security policy: Not found
Advisories: 0

Scan details

Total findings: 6
Affected tools: 0 / 1
Scan type: Fast Scan
Rules run: 45
LLM consensus score: N/A
Scanned: 10d ago
Source: GITHUB

MCP Server Information

Source: GITHUB
Package: MCPBrowser
Version: 7fdab035637f
License: MIT
Publisher: cherchyk
Verified: No
Account age: 14y 0m
Added: 4 months ago
Versions: 6
Repository: https://github.com/cherchyk/MCPBrowser
Ecosystem: GitHub
Stars: 6
Forks: 1
Open issues: 2
Dependencies: 0

AIVSS Score

2.5/ 10Low

Internal score: 88/100

Severity breakdown

Scan Details

Total findings6

Affected tools0 / 1

Scanned10d ago

Scan modeFAST

SourceGITHUB

Scan IDpubfastd62be23df27963cad7bc

Want deeper analysis?

Fast scan found 6 findings using rule-based analysis. Upgrade for LLM consensus across 5 judges, AI-generated remediation, and cross-file taint analysis.

View plans Scan another package

Building your own MCP server?

Run this exact engine on your private repo — before users see it on /scan.

Same rules, same LLM judges, same grade. Private scans stay isolated to your account and never appear in the public registry. Required for code your team hasn’t shipped yet.

See plans with Private scans How private scans stay private

6 of 6 findings

medium (6)

6 findings

medium (6)

AIVSS 2.5CVSS 4.0

Evidence

async devtoolsAvailable() {
    try {
      const url = `http://${this.config.host}:${this.config.port}/json/version`;
      const res = await fetch(url, { method: "GET" });
      if (!res.ok) return false;
      const data = await res.json();
      return Boolean(data.webSocketDebuggerUrl);

Remediation

Report false positive →

AIVSS 2.5CVSS 4.0

Evidence

if (this.config.wsEndpoint) return this.config.wsEndpoint;
    
    const url = `http://${this.config.host}:${this.config.port}/json/version`;
    const res = await fetch(url);
    if (!res.ok) {
      throw new Error(`Unable to reach ${this.config.name} devtools at ${url}: ${res.status}`);
    }

Remediation

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v4
    
    - name: Setup Node.js
      uses: actions/setup-node@v4

Remediation

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

- uses: actions/checkout@v4
    
    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: '20.x'
        cache: 'npm'

Remediation

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v4
    
    - name: Setup Node.js
      uses: actions/setup-node@v4

Remediation

Report false positive →

AIVSS 2.3CVSS 3.5

Evidence

- uses: actions/checkout@v4
    
    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: '20.x'
        registry-url: 'https://registry.npmjs.org'

Remediation

Report false positive →

204	if (this.config.wsEndpoint) return this.config.wsEndpoint;
205
206	const url = `http://${this.config.host}:${this.config.port}/json/version`;
207	const res = await fetch(url);
208	if (!res.ok) {
209	throw new Error(`Unable to reach ${this.config.name} devtools at ${url}: ${res.status}`);
210	}

204	if (this.config.wsEndpoint) return this.config.wsEndpoint;
205
206	const url = `http://${this.config.host}:${this.config.port}/json/version`;
207	const res = await fetch(url);
208	if (!res.ok) {
209	throw new Error(`Unable to reach ${this.config.name} devtools at ${url}: ${res.status}`);
210	}

78	async devtoolsAvailable() {
79	try {
80	const url = `http://${this.config.host}:${this.config.port}/json/version`;
81	const res = await fetch(url, { method: "GET" });
82	if (!res.ok) return false;
83	const data = await res.json();
84	return Boolean(data.webSocketDebuggerUrl);

11	runs-on: ubuntu-latest
12
13	steps:
14	- uses: actions/checkout@v4
15
16	- name: Setup Node.js
17	uses: actions/setup-node@v4