Contextplus MCP Server

Findings (43)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @hono/node-server@1.19.9: 6 known vulnerabilities

  GHSA-92pp-h63x-v22m, GHSA-frvp-7c67-39w9, GHSA-wc8c-qw6v-h7f6, GHSA-92pp-h63x-v22m, GHSA-frvp-7c67-39w9 +1 more

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/sdk@1.27.1: 12 known vulnerabilities

  GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +7 more

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@2.2.2: 4 known vulnerabilities

  GHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6, GHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  express-rate-limit@8.2.1: 2 known vulnerabilities

  GHSA-46wh-pxpv-q5gq, GHSA-46wh-pxpv-q5gq

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  fast-uri@3.1.0: 24 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-hrr3-gc8f-f4qj +19 more

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  hono@4.12.3: 70 known vulnerabilities

  GHSA-26pp-8wgv-hjvm, GHSA-2gcr-mfcq-wcc3, GHSA-3hrh-pfw6-9m5x, GHSA-458j-xx4x-4375, GHSA-54fx-42gc-7vw4 +65 more

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ip-address@10.0.1: 12 known vulnerabilities

  GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-mwp4-54f8-5fhr, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5 +7 more

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  nanoid@3.3.11: 6 known vulnerabilities

  GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w, GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8 +1 more

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  path-to-regexp@8.3.0: 4 known vulnerabilities

  GHSA-27v5-c462-wpq7, GHSA-j3q9-mxjg-w52f, GHSA-27v5-c462-wpq7, GHSA-j3q9-mxjg-w52f

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  postcss@8.5.8: 4 known vulnerabilities

  GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  source-map-js@1.2.1: 2 known vulnerabilities

  GHSA-68fv-2mgg-jv7q, GHSA-68fv-2mgg-jv7q

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.25.76: 2 known vulnerabilities

  GHSA-mrhx-c7xc-m3w5, GHSA-mrhx-c7xc-m3w5

  bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @opennextjs/cloudflare@1.17.1: 1 known vulnerability

  GHSA-2vc4-c4r6-p6v6

  landing/bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  brace-expansion@1.1.12: 7 known vulnerabilities

  GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +2 more

  landing/bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  brace-expansion@2.0.2: 7 known vulnerabilities

  GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +2 more

  landing/bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  brace-expansion@5.0.4: 8 known vulnerabilities

  GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-jxxr-4gwj-5jf2, GHSA-mh99-v99m-4gvg +3 more

  landing/bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  browserslist@4.28.1: 2 known vulnerabilities

  GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx

  landing/bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  fast-xml-parser@5.3.6: 4 known vulnerabilities

  GHSA-8gc5-j5rx-235r, GHSA-fj3w-jwp8-x2g3, GHSA-gh4j-gqv2-49f6, GHSA-jp2q-39xq-3w4g

  landing/bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  flatted@3.3.3: 2 known vulnerabilities

  GHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh

  landing/bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  form-data@4.0.5: 1 known vulnerability

  GHSA-hmw2-7cc7-3qxx

  landing/bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  js-yaml@4.1.1: 4 known vulnerabilities

  GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68

  landing/bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  picomatch@2.3.1: 2 known vulnerabilities

  GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj

  landing/bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  picomatch@4.0.3: 2 known vulnerabilities

  GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj

  landing/bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  postcss@8.4.31: 4 known vulnerabilities

  GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849

  landing/bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  postcss@8.5.6: 4 known vulnerabilities

  GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849

  landing/bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  sharp@0.34.5: 3 known vulnerabilities

  GHSA-f88m-g3jw-g9cj, GHSA-rgj7-g3m4-5g8c, GHSA-wq5f-xc86-pv6w

  landing/bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  undici@7.18.2: 32 known vulnerabilities

  GHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-2mjp-6q6p-2qxm, GHSA-35p6-xmwp-9g52 +27 more

  landing/bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ws@8.18.0: 2 known vulnerabilities

  GHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p

  landing/bun.lock
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@4.3.6: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  landing/bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.15.0: 8 known vulnerabilities

  GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-q8mj-m7cp-5q26, GHSA-x5fp-wj9c-mxmx, GHSA-4mjr-xmp4-gh2g +3 more

  bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  @babel/core@7.29.0: 1 known vulnerability

  GHSA-4x5r-pxfx-6jf8

  landing/bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  @humanfs/node@0.16.7: 1 known vulnerability

  GHSA-p498-v437-472g

  landing/bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  baseline-browser-mapping@2.10.0: 1 known vulnerability

  GHSA-w5vr-8v7q-w6rv

  landing/bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  esbuild@0.27.3: 1 known vulnerability

  GHSA-g7r4-m6w7-qqqr

  landing/bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  glob@12.0.0: 1 known vulnerability

  GHSA-3g3m-2fjr-6pw4

  landing/bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  glob@9.3.5: 1 known vulnerability

  GHSA-3g3m-2fjr-6pw4

  landing/bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@10.2.4: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  landing/bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@8.0.7: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  landing/bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  yaml@2.8.2: 1 known vulnerability

  GHSA-48c2-rrv3-qjmp

  landing/bun.lock
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)

Network activity

Tools exposed (17)

• get_context_tree

  Get the structural tree of the project with file headers, function names, classes, enums, and line ranges. Automatically reads 2-line headers for file purpose. Dynamic token-aware pruning: Level 2 (deep symbols) -> Level 1 (headers only) -> Level 0 (file names only) based on project size.

• semantic_identifier_search

  Search semantic intent at identifier level (functions, methods, classes, variables) with definition lines and ranked call sites. Uses embeddings over symbol signatures and source context, then returns line-numbered definition/call chains.

• get_file_skeleton

  Get detailed function signatures, class methods, and type definitions of a specific file WITHOUT reading the full body. Shows the API surface: function names, parameters, return types, and line ranges. Perfect for understanding how to use code without loading it all.

• semantic_code_search

  Search the codebase by MEANING, not just exact variable names. Uses Ollama embeddings over file headers and symbol names. Example: searching 'user authentication' finds files about login, sessions, JWT even if those exact words aren't used, with matched definition lines.

• get_blast_radius

  Before deleting or modifying code, check the BLAST RADIUS. Traces every file and line where a specific symbol (function, class, variable) is imported or used. Prevents orphaned code. Also warns if usage count is low (candidate for inlining).

• run_static_analysis

  Run the project's native linter/compiler to find unused variables, dead code, type errors, and syntax issues. Delegates detection to deterministic tools instead of LLM guessing. Supports TypeScript, Python, Rust, Go.

• propose_commit

  The ONLY way to write code. Validates the code against strict rules before saving: 2-line header comments, no inline comments, max nesting depth, max file length. Creates a shadow restore point before writing. REJECTS code that violates formatting rules.

• list_restore_points

  List all shadow restore points created by propose_commit. Each point captures the file state before the AI made changes. Use this to find a restore point ID for undoing a bad change.

• undo_change

  Restore files to their state before a specific AI change. Uses the shadow restore point system. Does NOT affect git history. Call list_restore_points first to find the point ID.

• semantic_navigate

  Browse the codebase by MEANING, not directory structure. Uses spectral clustering on Ollama embeddings to group semantically related files into labeled clusters. Inspired by Gabriella Gonzalez's semantic navigator. Requires Ollama running with an embedding model and a chat model for labeling.

• get_feature_hub

  Obsidian-style feature hub navigator. Hub files are .md files containing [[path/to/file]] wikilinks that act as a Map of Content. Modes: (1) No args = list all hubs, (2) hub_path or feature_name = show hub with bundled skeletons of all linked files, (3) show_orphans = find files not linked to any hu

• upsert_memory_node

  Create or update a memory node in the linking graph. Nodes represent concepts, files, symbols, or notes with auto-generated embeddings. If a node with the same label and type exists, it updates content and increments access count. Returns the node ID for use in create_relation.

• create_relation

  Create a typed edge between two memory nodes. Supports relation types: relates_to, depends_on, implements, references, similar_to, contains. Edges have weights (0-1) that decay over time via e^(-λt). Duplicate edges update weight instead of creating new ones.

• search_memory_graph

  Search the memory graph by meaning with graph traversal. First finds direct matches via embedding similarity, then traverses 1st/2nd-degree neighbors to discover linked context. Returns both direct hits and graph-connected neighbors with relevance scores.

• prune_stale_links

  Remove stale memory graph edges whose weight has decayed below threshold via e^(-λt) formula. Also removes orphan nodes with no edges, low access count, and >7 days since last access. Keeps the graph lean.

• add_interlinked_context

  Bulk-add multiple memory nodes with automatic similarity linking. Computes embeddings for all items, then creates similarity edges between any pair (new-to-new and new-to-existing) with cosine similarity ≥ 0.72. Ideal for importing related concepts, files, or notes at once.

• retrieve_with_traversal

  Start from a specific memory node and traverse the graph outward. Returns the starting node plus all reachable neighbors within the depth limit, scored by edge weight decay and depth penalty. Use after search_memory_graph to explore a specific node's neighborhood.