Concord MCP

Findings (11)

• highHigh. Something risky that needs a close look before you install.
  dropper issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  network issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@2.3.0: 1 known vulnerability

  GHSA-27r3-jxmh-p828

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  vite@8.1.5: 5 known vulnerabilities

  GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  test/cli/cloud.test.ts:31
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  test/cli/cloud-report.test.ts:19
• lowLow. Minor, or common in normal tools. Shown for information.
  fast-uri@3.1.8: 4 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@10.2.6: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.16.0: 1 known vulnerability

  GHSA-6pq8-jhm2-2vcw

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  Reads environment variables not listed in the manifest

  CURSOR_PROJECT_DIR, CONCORD_EXECUTABLE, COPILOT_CLI, CONCORD_TASK, CONCORD_AGENT_KIND, CONCORD_CODEX_APP_SERVER_URL, CI

Network activity

Tools exposed (5)

• start_work

  Enter one task before editing: register or refresh this agent, accept addressed work when needed, claim the declared scope, and return actionable overlap warnings.

• inspect_work

  Read the workspace, one task, one agent communication inbox/outbox, or one durable prompt/reply thread by supplying at most one selector.

• update_work

  Record task context or deliver a live prompt/reply to another promptable workspace agent.

• transfer_work

  Apply one versioned ownership action: assign, accept, decline, release, reassign, offer an evidence-bearing handoff, or reopen terminal work.

• finish_work

  Record completion evidence and atomically leave the task active as a handoff, mark it review-ready, or close it with a complete/closed outcome.