Registry Threats Methodology Docs Pricing Scan Sign in

MCPSafe.io

Security checks for MCP servers — public packages and private repos, fast or deep.

Legal

Privacy Policy Cookie Policy Terms of ServiceSecurity disclosure

Resources

State of MCP Security Support System statusMade in Germany 🇩🇪

© 2026 MCPSafe. All rights reserved.

GDPR — Privacy Policy

mcp-server-cloudflare — Security Grade B | MCPSafe

MCPSafe.io

Security pre-install checks for MCP servers.

B

Mostly safe — a couple of notes worth reading.

github · mcp-server-cloudflareHEAD

Scanned 4/30/2026, 10:02:45 AM·Fast Scan·45 rules·How we decide ↗

AIVSS Score

3.9/ 10

Low

Severity Breakdown

0

critical

1

high

243

medium

0

low

MCP Server Information

Packagemcp-server-cloudflare

VersionHEAD

SourceGITHUB

Package age—

Stars—

Downloads/wk—

Findings

Signal scores

CVE check0

Static0

Permissions100

Supply chain20

Typosquat30

Package health50

Community82

Injection risks0

Secrets & exfil100

Destructive ops100

LLM judge panel

CVE check

513 found

Dependencies

vite (3)

h
GHSA-4w7w-66w2-5vf9 ↗
h
GHSA-93m4-6634-74q7 ↗

@hono/node-server (2)

h
GHSA-92pp-h63x-v22m ↗
h
GHSA-wc8c-qw6v-h7f6 ↗

hono (54)

h
GHSA-26pp-8wgv-hjvm ↗
h
GHSA-3vhc-576x-3qv4 ↗

ai (3)

l
GHSA-rwvc-j5jr-mgvh ↗
l
GHSA-rwvc-j5jr-mgvh ↗

@cloudflare/vite-plugin (1)

m
GHSA-4pfg-2mw5-f8jx ↗

Community trust

No community reports

Security policy: Not found
Advisories: 0

Scan details

Total findings: 16
Affected tools: 1 / 2
Scan type: Fast Scan
Rules run: 45
LLM consensus score: N/A
Scanned: 12d ago
Source: GITHUB

MCP Server Information

Source: GITHUB
Package: mcp-server-cloudflare
Version: HEAD
Ecosystem: GitHub

AIVSS Score

3.9/ 10Low

Internal score: 45/100

Scan Details

Total findings16

Affected tools1 / 2

Scanned12d ago

Scan modeFAST

SourceGITHUB

Scan IDpubfastf4be3e9b54088faac569

Want deeper analysis?

Fast scan found 16 findings using rule-based analysis. Upgrade for LLM consensus across 5 judges, AI-generated remediation, and cross-file taint analysis.

View plans Scan another package

Building your own MCP server?

Run this exact engine on your private repo — before users see it on /scan.

Same rules, same LLM judges, same grade. Private scans stay isolated to your account and never appear in the public registry. Required for code your team hasn’t shipped yet.

See plans with Private scans How private scans stay private

16 of 16 findings

high (1)

medium (15)

16 findings

high (1)

AIVSS 3.4CVSS 5.8

MCP tool returns content marked as HTML (`{type: "html"}`, `Content-Type: text/html`, or `mimeType: "text/html"`) with no sanitiser on the same code path. The host renders HTML directly — anything tainted in the body becomes a script execution / markup-injection vector. Pipe the body through `DOMPurify.sanitize()` (TS), `bleach.clean()` (Python), `lxml.html.clean.Cleaner`, or `sanitize_html` before returning. Better: return `{type: "text"}` / `text/plain` and let the host escape. Distinct from

Evidence

import { McpAgent } from 'agents/mcp'

import { getEnv } from '@repo/mcp-common/src/env'
import { CloudflareMCPServer } from '@repo/mcp-common/src/server'

// The demo day MCP server isn't stateful, so we don't have state/props
export type Props = never

export type State = never

export type Env = {
	ENVIRONMENT: 'development' | 'staging' | 'production'
	AUTORAG_NAME: 'cloudflare-docs-autorag'
	MCP_SERVER_NAME: 'PLACEHOLDER'
	MCP_SERVER_VERSION: 'PLACEHOLDER'
	MCP_OBJECT: DurableObjectNamespace

Remediation

Sanitise the HTML body before return. Prefer `DOMPurify.sanitize(body)` (TS, plenty of MCP servers already bundle it for resource rendering) or `bleach.clean(body, tags=ALLOWED_TAGS, strip=True)` (Python). Even better: return `{type: "text"}` / `Content-Type: text/plain` and let the host's markdown renderer handle escape. HTML output is rarely needed for tool results.

Report false positive →

medium (15)

AIVSS 3.9CVSS 5.2

@modelcontextprotocol/sdk==1.20.2 has 3 known CVEs [HIGH]: GHSA-345p-7cg4-v4c7, GHSA-8r9q-7v3j-jr4g, GHSA-w48q-cv73-mx4w. Upgrade to a patched version.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Report false positive →

AIVSS 3.9CVSS 5.2

@modelcontextprotocol/sdk==1.20.2 has 3 known CVEs [HIGH]: GHSA-345p-7cg4-v4c7, GHSA-8r9q-7v3j-jr4g, GHSA-w48q-cv73-mx4w. Upgrade to a patched version.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Report false positive →

AIVSS 3.9CVSS 5.2

@modelcontextprotocol/sdk==1.20.2 has 3 known CVEs [HIGH]: GHSA-345p-7cg4-v4c7, GHSA-8r9q-7v3j-jr4g, GHSA-w48q-cv73-mx4w. Upgrade to a patched version.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Report false positive →

AIVSS 3.9CVSS 5.2

wrangler==4.10.0 has 1 known CVE [HIGH]: GHSA-36p8-mvp6-cv38. Upgrade to a patched version.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Report false positive →

AIVSS 3.9CVSS 5.2

wrangler==4.10.0 has 1 known CVE [HIGH]: GHSA-36p8-mvp6-cv38. Upgrade to a patched version.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Report false positive →

AIVSS 3.9CVSS 5.2

wrangler==4.10.0 has 1 known CVE [HIGH]: GHSA-36p8-mvp6-cv38. Upgrade to a patched version.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Report false positive →

AIVSS 3.9CVSS 5.2

hono==4.7.6 has 20 known CVEs [HIGH]: GHSA-26pp-8wgv-hjvm, GHSA-3vhc-576x-3qv4, GHSA-458j-xx4x-4375 (+17 more). Upgrade to a patched version.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Report false positive →

AIVSS 3.9CVSS 5.2

agents==0.2.19 has 3 known CVEs [MEDIUM]: GHSA-cvhv-6xm6-c3v4, GHSA-r7x9-8ph7-w8cg, GHSA-w5cr-2qhr-jqc5. Upgrade to a patched version.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Report false positive →

AIVSS 3.9CVSS 5.2

agents==0.2.19 has 3 known CVEs [MEDIUM]: GHSA-cvhv-6xm6-c3v4, GHSA-r7x9-8ph7-w8cg, GHSA-w5cr-2qhr-jqc5. Upgrade to a patched version.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Report false positive →

AIVSS 3.9CVSS 5.2

hono==4.7.6 has 20 known CVEs [HIGH]: GHSA-26pp-8wgv-hjvm, GHSA-3vhc-576x-3qv4, GHSA-458j-xx4x-4375 (+17 more). Upgrade to a patched version.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Report false positive →

AIVSS 3.9CVSS 5.2

agents==0.2.19 has 3 known CVEs [MEDIUM]: GHSA-cvhv-6xm6-c3v4, GHSA-r7x9-8ph7-w8cg, GHSA-w5cr-2qhr-jqc5. Upgrade to a patched version.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Report false positive →

AIVSS 3.9CVSS 5.2

ai==4.3.10 has 1 known CVE [LOW]: GHSA-rwvc-j5jr-mgvh. Upgrade to a patched version.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Report false positive →

AIVSS 3.9CVSS 5.2

wrangler==4.10.0 has 1 known CVE [HIGH]: GHSA-36p8-mvp6-cv38. Upgrade to a patched version.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Report false positive →

AIVSS 3.9CVSS 5.2

wrangler==4.10.0 has 1 known CVE [HIGH]: GHSA-36p8-mvp6-cv38. Upgrade to a patched version.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Report false positive →

AIVSS 3.9CVSS 5.2

agents==0.2.19 has 3 known CVEs [MEDIUM]: GHSA-cvhv-6xm6-c3v4, GHSA-r7x9-8ph7-w8cg, GHSA-w5cr-2qhr-jqc5. Upgrade to a patched version.

Remediation

Upgrade the pinned dependency to a patched version. Check the CVE's advisory URL for the recommended safe release, or use `npm audit fix` / `pip-audit --fix`. If no patched release is available yet, pin to a known-good prior version, vendor the fix, or remove the dependency.

Report false positive →

Tool heatmap

mcp_demo_day_info

hMCP tool returns content marked as HTML (`{type: "html"}`, `Content-Type: text/html`, or `mimeType: "text/html"`) with no sanitiser on the same code path. The host renders HTML directly — anything tainted in the body becomes a script execution / markup-injection vector. Pipe the body through `DOMPurify.sanitize()` (TS), `bleach.clean()` (Python), `lxml.html.clean.Cleaner`, or `sanitize_html` before returning. Better: return `{type: "text"}` / `text/plain` and let the host escape. Distinct from

Severity breakdown