Tracked packageView full profile for mcp-server-guide

MCPSafe.io

Security pre-install checks for MCP servers.

Mostly safe — a couple of notes worth reading.

Compare to another server

github · mcp-server-guidea72c41ef5cd8

Item: mcp-server-guide
Rating: 4
Author: MCPSafe

Scanned 7/7/2026, 3:05:35 PM·Cached result·Fast Scan·48 rules·How we decide ↗

AIVSS Score

2.8/ 10

Low

Severity Breakdown

critical

high

medium

low

MCP Server Information

Packagemcp-server-guide

Versiona72c41ef5cd8

SourceGITHUB

Publisherfigma

Package age11mo

Stars1.7K

Downloads/wk—

Dependencies0

Homepagehttps://help.figma.com/hc/en-us/articles/32132100833559-Guide-to-the-Dev-Mode-MCP-Server

Repositoryhttps://github.com/figma/mcp-server-guide

Findings

7 of 7 findings

medium (7)

7 findings

medium (7)

AIVSS 2.8CVSS 3.5

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

Evidence

make_contact_sheet = args.contact_sheet if args.contact_sheet is not None else args.mode == "scout"

    if not os.path.exists(args.input):
        print(f"Error: video file not found: {args.input}", file=sys.stderr)
        sys.exit(1)

    # Check ffmpeg

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Report false positive

AIVSS 2.8CVSS 3.5

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

Evidence

os.makedirs(args.output, exist_ok=True)

    # Get video metadata
    print(f"Analyzing video: {args.input}", flush=True)
    video_info = get_video_info(args.input)
    print(f"  Duration: {video_info['duration_s']:.1f}s | "
          f"Resolution: {video_info['width']}x{video_info['height']} | "

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Report false positive

AIVSS 2.5CVSS 4.0

Network / IO / subprocess call without an explicit timeout. A malicious or hung upstream (HTTP host, socket peer, child process) can pin threads, exhaust connection/process pools, and make the MCP server unresponsive. Always pass a bounded timeout. v2 extends v1 with subprocess coverage (R03 from the legacy readiness audit).

Evidence

]

    print("Running scene change detection...", flush=True)
    result = subprocess.run(cmd, capture_output=True, text=True)
    # Scene metadata goes to stdout via metadata=print:file=-
    output = result.stdout

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Report false positive

AIVSS 2.5CVSS 4.0

Evidence

"quiet",
        str(output_path),
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0 or not output_path.exists():
        raise RuntimeError(f"ffmpeg failed at {timestamp_s:.3f}s: {result.stderr}")

Remediation

Report false positive

AIVSS 2.5CVSS 4.0

Evidence

]

    print(f"Extracting frames at {fps}fps...", flush=True)
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        raise RuntimeError(f"ffmpeg frame extraction failed: {result.stderr}")

Remediation

Report false positive

AIVSS 2.5CVSS 4.0

Evidence

"-show_streams", "-show_format",
        video_path
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        raise RuntimeError(f"ffprobe failed: {result.stderr}")

Remediation

Report false positive

AIVSS 2.5CVSS 4.0

Evidence

sys.exit(1)

    # Check ffmpeg
    check = subprocess.run(["ffmpeg", "-version"], capture_output=True)
    if check.returncode != 0:
        print("Error: ffmpeg not found. Install with: brew install ffmpeg (macOS) or apt install ffmpeg (Linux)",
              file=sys.stderr)

Remediation

Report false positive

LLM summary— mcp-server-guide:a72c41ef5cd8

This package earns a B grade with a safety score of 91/100 but carries moderate risk from 7 medium-severity findings centered on ansi escape injection (2 instances) and resource exhaustion vulnerabilities (5 instances). The resource exhaustion issues are the primary concern, as they could allow attackers to degrade performance or cause denial of service, while the injection flaws may enable output manipulation. Installation is acceptable if you can mitigate these medium-risk issues through code review or runtime controls, but you should prioritize patching once fixes become available.

Signal scores

Package health60

Secrets & exfil100

Community82

CVE check100

Permissions100

Typosquat100

Destructive ops100

Supply chain100

Injection risks84

Static60

Publisher identity90

LLM judge panel

CVE check

No known CVEs found for this package or its dependencies.

Community trust

No community reports

Security policy: Not found
Advisories: 0

Scan details

Total findings: 7
Affected tools: 0 / 1
Scan type: Fast Scan
Rules run: 48
LLM consensus score: N/A
Scanned: 3d ago
Source: GITHUB

MCP Server Information

Source: GITHUB
Package: mcp-server-guide
Version: a72c41ef5cd8
Publisher: figma
Verified: Yes
Account age: 12y 11m
Added: 11 months ago
Homepage: https://help.figma.com/hc/en-us/articles/32132100833559-Guide-to-the-Dev-Mode-MCP-Server
Repository: https://github.com/figma/mcp-server-guide
Ecosystem: GitHub
Stars: 1.7K
Forks: 158
Open issues: 2
Dependencies: 0

AIVSS Score

2.8/ 10Low

Internal score: 91/100

Severity breakdown

Scan Details

Total findings7

Affected tools0 / 1

Scanned3d ago

Scan modeFAST

SourceGITHUB

Scan IDpubfaste2a3c71b53f234f674c6

Want deeper analysis?

Fast scan found 7 findings using rule-based analysis. Upgrade for LLM consensus across 5 judges, AI-generated remediation, and cross-file taint analysis.

View plans Scan another package

Building your own MCP server?

Run this exact engine on your private repo — before users see it on /scan.

Same rules, same LLM judges, same grade. Private scans stay isolated to your account and never appear in the public registry. Required for code your team hasn’t shipped yet.

See plans with Private scans How private scans stay private

7 of 7 findings

medium (7)

7 findings

medium (7)

AIVSS 2.8CVSS 3.5

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

Evidence

make_contact_sheet = args.contact_sheet if args.contact_sheet is not None else args.mode == "scout"

    if not os.path.exists(args.input):
        print(f"Error: video file not found: {args.input}", file=sys.stderr)
        sys.exit(1)

    # Check ffmpeg

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Report false positive

AIVSS 2.8CVSS 3.5

User-controlled value printed to terminal without ANSI escape sanitization. Malicious input can inject cursor-control sequences, rewrite earlier output, or hide shell commands from the operator.

Evidence

os.makedirs(args.output, exist_ok=True)

    # Get video metadata
    print(f"Analyzing video: {args.input}", flush=True)
    video_info = get_video_info(args.input)
    print(f"  Duration: {video_info['duration_s']:.1f}s | "
          f"Resolution: {video_info['width']}x{video_info['height']} | "

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Report false positive

AIVSS 2.5CVSS 4.0

Evidence

]

    print("Running scene change detection...", flush=True)
    result = subprocess.run(cmd, capture_output=True, text=True)
    # Scene metadata goes to stdout via metadata=print:file=-
    output = result.stdout

Remediation

Report false positive

AIVSS 2.5CVSS 4.0

Evidence

"quiet",
        str(output_path),
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0 or not output_path.exists():
        raise RuntimeError(f"ffmpeg failed at {timestamp_s:.3f}s: {result.stderr}")

Remediation

Report false positive

AIVSS 2.5CVSS 4.0

Evidence

]

    print(f"Extracting frames at {fps}fps...", flush=True)
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        raise RuntimeError(f"ffmpeg frame extraction failed: {result.stderr}")

Remediation

Report false positive

AIVSS 2.5CVSS 4.0

Evidence

"-show_streams", "-show_format",
        video_path
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        raise RuntimeError(f"ffprobe failed: {result.stderr}")

Remediation

Report false positive

AIVSS 2.5CVSS 4.0

Evidence

sys.exit(1)

    # Check ffmpeg
    check = subprocess.run(["ffmpeg", "-version"], capture_output=True)
    if check.returncode != 0:
        print("Error: ffmpeg not found. Install with: brew install ffmpeg (macOS) or apt install ffmpeg (Linux)",
              file=sys.stderr)

Remediation

Report false positive

289	make_contact_sheet = args.contact_sheet if args.contact_sheet is not None else args.mode == "scout"
290
291	if not os.path.exists(args.input):
292	print(f"Error: video file not found: {args.input}", file=sys.stderr)
293	sys.exit(1)
294
295	# Check ffmpeg

302	os.makedirs(args.output, exist_ok=True)
303
304	# Get video metadata
305	print(f"Analyzing video: {args.input}", flush=True)
306	video_info = get_video_info(args.input)
307	print(f" Duration: {video_info['duration_s']:.1f}s \| "
308	f"Resolution: {video_info['width']}x{video_info['height']} \| "

102	]
103
104	print("Running scene change detection...", flush=True)
105	result = subprocess.run(cmd, capture_output=True, text=True)
106	# Scene metadata goes to stdout via metadata=print:file=-
107	output = result.stdout

293	sys.exit(1)
294
295	# Check ffmpeg
296	check = subprocess.run(["ffmpeg", "-version"], capture_output=True)
297	if check.returncode != 0:
298	print("Error: ffmpeg not found. Install with: brew install ffmpeg (macOS) or apt install ffmpeg (Linux)",
299	file=sys.stderr)

289	make_contact_sheet = args.contact_sheet if args.contact_sheet is not None else args.mode == "scout"
290
291	if not os.path.exists(args.input):
292	print(f"Error: video file not found: {args.input}", file=sys.stderr)
293	sys.exit(1)
294
295	# Check ffmpeg

88	"quiet",
89	str(output_path),
90	]
91	result = subprocess.run(cmd, capture_output=True, text=True)
92	if result.returncode != 0 or not output_path.exists():
93	raise RuntimeError(f"ffmpeg failed at {timestamp_s:.3f}s: {result.stderr}")

78	]
79
80	print(f"Extracting frames at {fps}fps...", flush=True)
81	result = subprocess.run(cmd, capture_output=True, text=True)
82	if result.returncode != 0:
83	raise RuntimeError(f"ffmpeg frame extraction failed: {result.stderr}")

30	"-show_streams", "-show_format",
31	video_path
32	]
33	result = subprocess.run(cmd, capture_output=True, text=True)
34	if result.returncode != 0:
35	raise RuntimeError(f"ffprobe failed: {result.stderr}")