Capa MCP Server

Findings (45)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  scripts/generate-version.ts:30
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  scripts/update-install-scripts.ts:23
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Turns off TLS certificate checking, allowing traffic interception.

  src/server/http-mcp-transport.ts:101
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Turns off TLS certificate checking, allowing traffic interception.

  src/server/oauth-discovery.ts:13
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @hono/node-server@1.19.9: 3 known vulnerabilities

  GHSA-92pp-h63x-v22m, GHSA-frvp-7c67-39w9, GHSA-wc8c-qw6v-h7f6

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/sdk@1.26.0: 6 known vulnerabilities

  GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@2.2.2: 2 known vulnerabilities

  GHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  express-rate-limit@8.2.1: 1 known vulnerability

  GHSA-46wh-pxpv-q5gq

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  fast-uri@3.1.0: 12 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-hrr3-gc8f-f4qj +7 more

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  hono@4.11.9: 35 known vulnerabilities

  GHSA-26pp-8wgv-hjvm, GHSA-2gcr-mfcq-wcc3, GHSA-3hrh-pfw6-9m5x, GHSA-458j-xx4x-4375, GHSA-5pq2-9x2x-5p6w +30 more

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ip-address@10.0.1: 6 known vulnerabilities

  GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-mwp4-54f8-5fhr, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5 +1 more

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  js-yaml@5.2.0: 3 known vulnerabilities

  GHSA-724g-mxrg-4qvm, GHSA-pm4m-ph32-ghv5, GHSA-r3ph-w7gj-g6xm

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  path-to-regexp@8.3.0: 2 known vulnerabilities

  GHSA-27v5-c462-wpq7, GHSA-j3q9-mxjg-w52f

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  react-router@7.15.0: 6 known vulnerabilities

  GHSA-337j-9hxr-rhxg, GHSA-84g9-w2xq-vcv6, GHSA-chx6-hx7r-mcp5, GHSA-h8fp-f39c-q6mh, GHSA-qwww-vcr4-c8h2 +1 more

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  source-map-js@1.2.1: 1 known vulnerability

  GHSA-68fv-2mgg-jv7q

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@4.3.6: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@4.4.3: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Install or build failed in a clean environment

  added 350 packages in 29s > capa@1.0.0 prebuild > bun run scripts/generate-version.ts && bun run scripts/generate-keyring-addon.ts && bun run scripts/build-web.ts sh: 1: bun: not found
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/cli/commands/install-tasks/__tests__/install-rules.test.ts:128
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/cli/utils/__tests__/hooks-installer.test.ts:294
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/cli/utils/__tests__/hooks-installer.test.ts:308
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/cli/utils/__tests__/hooks-installer.test.ts:362
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/cli/utils/__tests__/hooks-installer.test.ts:379
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/cli/utils/__tests__/hooks-installer.test.ts:397
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/cli/utils/__tests__/hooks-installer.test.ts:826
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/server/__tests__/oauth-manager.test.ts:89
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/shared/__tests__/hooks-validate.test.ts:120
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/shared/__tests__/repo-file.test.ts:113
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/shared/__tests__/repo-file.test.ts:125
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/shared/__tests__/repo-file.test.ts:140
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/shared/__tests__/repo-file.test.ts:153
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/shared/__tests__/repo-file.test.ts:168
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/shared/__tests__/repo-file.test.ts:199
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/shared/__tests__/safe-remote-url.test.ts:53
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/shared/plugin-manifest/__tests__/agent-plugins.test.ts:252
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/shared/registries/__tests__/installer.test.ts:121
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/server/__tests__/mcp-proxy.test.ts:258
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/server/__tests__/secret-redaction.test.ts:263
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: github-pat

  src/server/__tests__/secret-redaction.test.ts:98
• lowLow. Minor, or common in normal tools. Shown for information.
  ajv@8.17.1: 1 known vulnerability

  GHSA-2g4f-4pwh-qvx6

  bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  katex@0.16.47: 1 known vulnerability

  GHSA-238p-pmpm-9mq7

  bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.14.1: 4 known vulnerabilities

  GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-q8mj-m7cp-5q26, GHSA-w7fw-mjwx-w883

  bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)

Network activity