Core MCP Server by opensumi
by opensumiA framework helps you quickly build AI Native IDE products. MCP Client, supports Model Context Protocol (MCP) tools via MCP server.
Core is an open-source mcp server by opensumi, written mainly in TypeScript, with 3,661 GitHub stars and the MIT license. Its code was last updated Oct 15, 2026.
Scan summary: scanned Nov 5, 2026 at commit 9da5ceb. Seen able to run shell commands, run dynamic code. Scan policy
ScannedScanned. The automated checks below ran on the commit shown. Read each line for what was and was not covered.
Full scan at
9da5ceb · Nov 5, 2026 ScannedStatic, secrets and dependency checks completed with no critical findings.
Warning. This check found something worth reading in the findings below. It is not proof of a problem.Static code scanwarnWarning. This check found something worth reading in the findings below. It is not proof of a problem.
Flagged. This check found an issue. See the findings below.Secrets scanfailFlagged. This check found an issue. See the findings below.
Flagged. This check found an issue. See the findings below.Dependency audit582 known vulnerabilitiesfailFlagged. This check found an issue. See the findings below.
Warning. This check found something worth reading in the findings below. It is not proof of a problem.ManifestnonewarnWarning. This check found something worth reading in the findings below. It is not proof of a problem.
Flagged. This check found an issue. See the findings below.BuildfailFlagged. This check found an issue. See the findings below.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Boot & handshaken/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Network egressn/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Reproducible (×3)n/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Findings (175)
- highHigh. Something risky that needs a close look before you install.code-execution issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.code-execution issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.code-execution issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.code-execution issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.code-execution issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
scripts/pkg.ts:61 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
scripts/pkg.ts:80 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
scripts/publish.ts:93 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
tools/dev-tool/cli/rebuild-native.js:53 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
tools/dev-tool/cli/rebuild-native.js:65 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.app-builder-lib@23.6.0: 2 known vulnerabilitiesGHSA-7g7r-gx96-252g, GHSA-r4pf-3v7r-hh55
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@1.1.11: 16 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +11 more
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@2.0.1: 16 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +11 more
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.browserslist@4.21.4: 2 known vulnerabilitiesGHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.browserslist@4.22.2: 2 known vulnerabilitiesGHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.builder-util-runtime@9.1.1: 1 known vulnerabilityGHSA-p2f4-r6v6-j797
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.cross-spawn@7.0.3: 2 known vulnerabilitiesGHSA-3xgq-45jj-v275, GHSA-3xgq-45jj-v275
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.electron@22.3.26: 46 known vulnerabilitiesGHSA-2p8c-gr87-2676, GHSA-3c8v-cfp5-9885, GHSA-3qxv-5xgr-q7w9, GHSA-4f78-qhmw-8j8m, GHSA-4p4r-m79c-wq3v +41 more
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.extract-zip@2.0.1: 4 known vulnerabilitiesGHSA-7pqw-9j4j-h8q3, GHSA-jmr9-qjv8-65gv, GHSA-7pqw-9j4j-h8q3, GHSA-jmr9-qjv8-65gv
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.ip@2.0.1: 1 known vulnerabilityGHSA-2p57-rm9w-gvfp
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@4.1.0: 10 known vulnerabilitiesGHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m +5 more
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.json5@2.2.1: 1 known vulnerabilityGHSA-9c47-m6qq-7p4h
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.lodash@4.17.21: 4 known vulnerabilitiesGHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg, GHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.minimatch@3.0.4: 4 known vulnerabilitiesGHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-f8q6-p94x-37v3
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.minimatch@3.1.2: 6 known vulnerabilitiesGHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26 +1 more
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.minimatch@5.1.1: 3 known vulnerabilitiesGHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.nanoid@3.3.7: 8 known vulnerabilitiesGHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-mwcw-c2x4-8c55, GHSA-xwg4-73v4-xw9w, GHSA-28wg-ghj8-5hjv +3 more
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.picomatch@2.3.1: 4 known vulnerabilitiesGHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj, GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.postcss@8.4.33: 4 known vulnerabilitiesGHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.semver@6.3.0: 1 known vulnerabilityGHSA-c2qf-rxjj-qqgw
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.semver@7.0.0: 2 known vulnerabilitiesGHSA-c2qf-rxjj-qqgw, GHSA-c2qf-rxjj-qqgw
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.semver@7.3.8: 1 known vulnerabilityGHSA-c2qf-rxjj-qqgw
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.serialize-javascript@6.0.2: 6 known vulnerabilitiesGHSA-5c6j-r48x-rmvq, GHSA-m5mm-p8h7-m29v, GHSA-qj8w-gfj5-8c6v, GHSA-5c6j-r48x-rmvq, GHSA-m5mm-p8h7-m29v +1 more
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.source-map-js@1.0.2: 2 known vulnerabilitiesGHSA-68fv-2mgg-jv7q, GHSA-68fv-2mgg-jv7q
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.svgo@2.8.0: 8 known vulnerabilitiesGHSA-2p49-hgcm-8545, GHSA-4vpr-x523-8j87, GHSA-w27v-7q3p-w38r, GHSA-xpqw-6gx7-v673, GHSA-2p49-hgcm-8545 +3 more
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.tmp@0.2.1: 2 known vulnerabilitiesGHSA-52f5-9888-hmc6, GHSA-ph9p-34f9-6g65
tools/electron/yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@modelcontextprotocol/sdk@1.11.4: 7 known vulnerabilitiesGHSA-345p-7cg4-v4c7, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-8r9q-7v3j-jr4g, GHSA-f897-62hf-6gxq +2 more
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@xmldom/xmldom@0.8.10: 15 known vulnerabilitiesGHSA-27p8-2357-5qqv, GHSA-2v35-w6hq-6mfw, GHSA-4w3w-2rp5-g8jm, GHSA-6gmq-8vp8-gcm6, GHSA-6h8r-xr42-gp59 +10 more
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.axios@1.6.7: 31 known vulnerabilitiesGHSA-35jp-ww65-95wh, GHSA-3g43-6gmg-66jw, GHSA-3p68-rc4w-qgx5, GHSA-3w6x-2g7m-8v23, GHSA-42h9-826w-cgv3 +26 more
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.body-parser@1.20.3: 2 known vulnerabilitiesGHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.body-parser@2.2.0: 3 known vulnerabilitiesGHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6, GHSA-wqch-xfxh-vrr4
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.browserslist@4.23.0: 2 known vulnerabilitiesGHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.compressing@1.10.0: 2 known vulnerabilitiesGHSA-4c3q-x735-j3r5, GHSA-cc8f-xg8v-72m3
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.compression@1.7.4: 1 known vulnerabilityGHSA-vc2v-76pw-4v95
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.cross-spawn@4.0.2: 1 known vulnerabilityGHSA-3xgq-45jj-v275
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.cross-spawn@6.0.5: 1 known vulnerabilityGHSA-3xgq-45jj-v275
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.decode-uri-component@0.4.1: 2 known vulnerabilitiesGHSA-qr28-fpjm-wq7f, GHSA-vcc3-ghjq-m6fr
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.electron@22.3.27: 46 known vulnerabilitiesGHSA-2p8c-gr87-2676, GHSA-3c8v-cfp5-9885, GHSA-3qxv-5xgr-q7w9, GHSA-4f78-qhmw-8j8m, GHSA-4p4r-m79c-wq3v +41 more
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.fast-uri@3.0.2: 12 known vulnerabilitiesGHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-hrr3-gc8f-f4qj +7 more
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.flatted@3.3.1: 2 known vulnerabilitiesGHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.glob@10.3.10: 2 known vulnerabilitiesGHSA-3g3m-2fjr-6pw4, GHSA-5j98-mcp5-4vw2
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.glob@10.3.12: 2 known vulnerabilitiesGHSA-3g3m-2fjr-6pw4, GHSA-5j98-mcp5-4vw2
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.ip@1.1.9: 1 known vulnerabilityGHSA-2p57-rm9w-gvfp
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.ip-address@9.0.5: 6 known vulnerabilitiesGHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-mwp4-54f8-5fhr, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5 +1 more
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@3.14.1: 5 known vulnerabilitiesGHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.jsondiffpatch@0.6.0: 2 known vulnerabilitiesGHSA-33vc-wfww-vjfv, GHSA-j4fx-xxwh-2485
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.launch-editor@2.6.1: 5 known vulnerabilitiesGHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-c27g-q93r-2cwf, GHSA-r825-w8mm-5pxw, GHSA-v6wh-96g9-6wx3
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.linkify-it@4.0.1: 2 known vulnerabilitiesGHSA-22p9-wv53-3rq4, GHSA-v245-v573-v5vm
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.lodash-es@4.17.21: 2 known vulnerabilitiesGHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.markdown-it@13.0.2: 5 known vulnerabilitiesGHSA-253c-mchw-3w2r, GHSA-38c4-r59v-3vqw, GHSA-6v5v-wf23-fmfq, GHSA-r7fv-28h4-cvq7, GHSA-vfgh-jcmw-g37q
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.minimatch@3.0.5: 3 known vulnerabilitiesGHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.minimatch@5.1.6: 3 known vulnerabilitiesGHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.minimatch@7.4.6: 4 known vulnerabilitiesGHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-g3hv-75wg-m249
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.minimatch@8.0.4: 4 known vulnerabilitiesGHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-g3hv-75wg-m249
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.minimatch@9.0.3: 4 known vulnerabilitiesGHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-g3hv-75wg-m249
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.minimatch@9.0.4: 4 known vulnerabilitiesGHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-g3hv-75wg-m249
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.nanoid@3.3.8: 3 known vulnerabilitiesGHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.node-forge@1.3.1: 18 known vulnerabilitiesGHSA-2328-f5f3-gj25, GHSA-4487-j8r4-4g2f, GHSA-4642-5mcj-2rqw, GHSA-525v-9gp9-w22h, GHSA-554w-wpv2-vw27 +13 more
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.nx@18.0.8: 4 known vulnerabilitiesGHSA-g2r8-wvmj-jf5w, GHSA-hrvq-x7jp-36xv, GHSA-w2vw-w76x-qr89, GHSA-w3vv-58gj-gw77
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.pacote@17.0.6: 1 known vulnerabilityGHSA-w4pp-8pjf-rmxw
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.path-to-regexp@0.1.10: 2 known vulnerabilitiesGHSA-37ch-88jc-xwx2, GHSA-rhx6-c78j-4q9w
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.path-to-regexp@8.2.0: 2 known vulnerabilitiesGHSA-27v5-c462-wpq7, GHSA-j3q9-mxjg-w52f
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.playwright@1.43.0: 1 known vulnerabilityGHSA-7mvr-c777-76hp
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.postcss@8.4.35: 4 known vulnerabilitiesGHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.postcss@8.4.47: 4 known vulnerabilitiesGHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.probe-image-size@7.2.3: 1 known vulnerabilityGHSA-gjj5-9665-rwrc
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.sigstore@1.9.0: 1 known vulnerabilityGHSA-52v5-jr5w-gjxr
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.sigstore@2.2.2: 1 known vulnerabilityGHSA-52v5-jr5w-gjxr
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.source-map-js@1.2.1: 1 known vulnerabilityGHSA-68fv-2mgg-jv7q
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.tar-fs@2.1.1: 3 known vulnerabilitiesGHSA-8cj5-5rvv-wf4v, GHSA-pq67-2wwv-3xjx, GHSA-vj76-c3g6-qr5v
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.tmp@0.0.33: 2 known vulnerabilitiesGHSA-52f5-9888-hmc6, GHSA-ph9p-34f9-6g65
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.tmp@0.2.3: 2 known vulnerabilitiesGHSA-52f5-9888-hmc6, GHSA-ph9p-34f9-6g65
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.uuid@3.4.0: 1 known vulnerabilityGHSA-w5hq-g745-h8pq
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.uuid@8.3.2: 1 known vulnerabilityGHSA-w5hq-g745-h8pq
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.uuid@9.0.1: 1 known vulnerabilityGHSA-w5hq-g745-h8pq
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.webpack-dev-middleware@7.2.1: 1 known vulnerabilityGHSA-g84c-rxfj-3j2c
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.ws@6.2.3: 1 known vulnerabilityGHSA-96hv-2xvq-fx4p
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.ws@7.5.10: 1 known vulnerabilityGHSA-96hv-2xvq-fx4p
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.ws@8.17.1: 2 known vulnerabilitiesGHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.zod@3.24.1: 1 known vulnerabilityGHSA-mrhx-c7xc-m3w5
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.zod@4.4.3: 1 known vulnerabilityGHSA-mrhx-c7xc-m3w5
yarn.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Install or build failed in a clean environmentdetails. ➤ YN0000: └ Completed ➤ YN0000: ┌ Fetch step ➤ YN0000: └ Completed in 2s 595ms ➤ YN0000: ┌ Link step ➤ YN0001: │ Error: EPERM: operation not permitted, chmod '/w/node_modules/@opensumi/ide-dev-tool/cli/index.js' ➤ YN0000: └ Completed in 54s 570ms ➤ YN0000: · Failed with errors in 57s 562ms
- lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
packages/ai-native/__test__/browser/acp-debug-log.test.tsx:190 - lowLow. Minor, or common in normal tools. Shown for information.@tootallnate/once@2.0.0: 2 known vulnerabilitiesGHSA-vpq2-c234-7xj6, GHSA-vpq2-c234-7xj6
tools/electron/yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.ajv@6.12.6: 2 known vulnerabilitiesGHSA-2g4f-4pwh-qvx6, GHSA-2g4f-4pwh-qvx6
tools/electron/yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.ajv@8.12.0: 2 known vulnerabilitiesGHSA-2g4f-4pwh-qvx6, GHSA-2g4f-4pwh-qvx6
tools/electron/yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.colord@2.9.3: 2 known vulnerabilitiesGHSA-2wm5-q62r-hmrv, GHSA-2wm5-q62r-hmrv
tools/electron/yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.deepmerge@4.2.2: 1 known vulnerabilityGHSA-gcqx-w48m-w2h4
tools/electron/yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.ejs@3.1.8: 1 known vulnerabilityGHSA-ghr5-ch3p-vcr6
tools/electron/yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.postcss-selector-parser@6.0.11: 1 known vulnerabilityGHSA-rj75-hqrm-r3gf
tools/electron/yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.postcss-selector-parser@6.0.15: 1 known vulnerabilityGHSA-rj75-hqrm-r3gf
tools/electron/yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.qs@6.11.0: 4 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-6rw7-vpxm-498p, GHSA-w7fw-mjwx-w883
tools/electron/yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.webpack@5.90.0: 3 known vulnerabilitiesGHSA-38r7-794h-5758, GHSA-4vvj-4cpr-p986, GHSA-8fgc-7cc6-rx7x
tools/electron/yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.webpack@5.94.0: 4 known vulnerabilitiesGHSA-38r7-794h-5758, GHSA-8fgc-7cc6-rx7x, GHSA-38r7-794h-5758, GHSA-8fgc-7cc6-rx7x
tools/electron/yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.yaml@1.10.2: 2 known vulnerabilitiesGHSA-48c2-rrv3-qjmp, GHSA-48c2-rrv3-qjmp
tools/electron/yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.@ai-sdk/provider-utils@2.1.10: 1 known vulnerabilityGHSA-866g-f22w-33x8
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.@ai-sdk/provider-utils@2.1.9: 1 known vulnerabilityGHSA-866g-f22w-33x8
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.@ai-sdk/provider-utils@2.2.8: 1 known vulnerabilityGHSA-866g-f22w-33x8
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.@babel/core@7.24.0: 1 known vulnerabilityGHSA-4x5r-pxfx-6jf8
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.@babel/helpers@7.24.0: 1 known vulnerabilityGHSA-968p-4wvh-cqc8
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.@babel/runtime@7.24.0: 1 known vulnerabilityGHSA-968p-4wvh-cqc8
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.@babel/runtime@7.24.1: 1 known vulnerabilityGHSA-968p-4wvh-cqc8
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.@babel/runtime@7.25.7: 1 known vulnerabilityGHSA-968p-4wvh-cqc8
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.@babel/runtime@7.4.5: 1 known vulnerabilityGHSA-968p-4wvh-cqc8
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.@octokit/plugin-paginate-rest@6.1.2: 1 known vulnerabilityGHSA-h5c3-5r3r-rr8q
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.@octokit/request@6.2.8: 1 known vulnerabilityGHSA-rmvr-2pp2-xj38
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.@octokit/request-error@3.0.3: 1 known vulnerabilityGHSA-xx4v-prfh-6cgc
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.@sigstore/core@1.0.0: 1 known vulnerabilityGHSA-jfc7-64v2-mr8c
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.ai@4.3.16: 1 known vulnerabilityGHSA-rwvc-j5jr-mgvh
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.ajv@8.17.1: 1 known vulnerabilityGHSA-2g4f-4pwh-qvx6
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.bn.js@4.12.0: 1 known vulnerabilityGHSA-378v-28hj-76wf
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.bn.js@5.2.1: 1 known vulnerabilityGHSA-378v-28hj-76wf
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.cookie@0.6.0: 1 known vulnerabilityGHSA-pxg6-pf52-xh8x
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.deepmerge@4.3.1: 1 known vulnerabilityGHSA-gcqx-w48m-w2h4
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.diff@4.0.2: 1 known vulnerabilityGHSA-73rr-hh4g-fpgx
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.diff@7.0.0: 1 known vulnerabilityGHSA-73rr-hh4g-fpgx
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.esbuild@0.19.12: 1 known vulnerabilityGHSA-67mh-4wv8-2f99
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.esbuild@0.24.0: 1 known vulnerabilityGHSA-67mh-4wv8-2f99
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.file-type@16.5.4: 1 known vulnerabilityGHSA-5v7r-6r5c-r473
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.follow-redirects@1.15.6: 1 known vulnerabilityGHSA-r4q5-vmmm-2653
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.glob@9.3.5: 1 known vulnerabilityGHSA-3g3m-2fjr-6pw4
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.got@10.7.0: 1 known vulnerabilityGHSA-pfrx-2q88-qq97
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.http-proxy-middleware@2.0.7: 3 known vulnerabilitiesGHSA-4www-5p9h-95mh, GHSA-64mm-vxmg-q3vj, GHSA-9gqv-wp59-fq42
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.katex@0.16.11: 2 known vulnerabilitiesGHSA-238p-pmpm-9mq7, GHSA-cg87-wmx4-v546
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.micromatch@4.0.5: 1 known vulnerabilityGHSA-952p-6rrq-rcjv
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.moment@2.30.1: 1 known vulnerabilityGHSA-4p3w-j4w9-5jqw
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.on-headers@1.0.2: 1 known vulnerabilityGHSA-76c9-3jph-rj3q
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.postcss-selector-parser@6.0.16: 1 known vulnerabilityGHSA-rj75-hqrm-r3gf
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.protocol-buffers-schema@3.6.0: 1 known vulnerabilityGHSA-j452-xhg8-qg39
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.qs@6.12.0: 5 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-6rw7-vpxm-498p, GHSA-q8mj-m7cp-5q26, GHSA-w7fw-mjwx-w883
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.qs@6.13.0: 5 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-6rw7-vpxm-498p, GHSA-q8mj-m7cp-5q26, GHSA-w7fw-mjwx-w883
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.qs@6.14.0: 5 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-6rw7-vpxm-498p, GHSA-q8mj-m7cp-5q26, GHSA-w7fw-mjwx-w883
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.sanitize-html@2.13.1: 5 known vulnerabilitiesGHSA-cv27-6wvh-8x7j, GHSA-g8qq-57p8-ggw5, GHSA-jxwj-j7wr-gfrw, GHSA-vccv-cmxp-4j9h, GHSA-x3q4-9hxx-gx8m
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.webpack-dev-server@5.0.4: 6 known vulnerabilitiesGHSA-4v9v-hfq4-rm2v, GHSA-79cf-xcqc-c78w, GHSA-9jgg-88mc-972h, GHSA-f5vj-f2hx-8m93, GHSA-m28w-2pqf-7qgj +1 more
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.yaml@2.3.4: 1 known vulnerabilityGHSA-48c2-rrv3-qjmp
yarn.lock - lowLow. Minor, or common in normal tools. Shown for information.package.json has a preinstall scriptnode scripts/preinstall.js && husky install
package.json - lowLow. Minor, or common in normal tools. Shown for information.No manifest declaring network access and environment variables (agent.json)
Network activity
During install
registry.yarnpkg.comrepo.yarnpkg.com
While running
Not run — the code wasn't started in this scan
Automated result for the commit shown. See our scan policy. View the scan log
Maintainers can claim the listing to rescan, or dispute a result.
Core alternatives
View more →Similar mcp servers in Developer Tools, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.
| Name | Stars | Licence | Last updated | Scan |
|---|---|---|---|---|
| Core (this page) opensumi | 3.7k | MIT | Oct 15, 2026 | Scanned, no flagged issues |
| MCP Use mcp-use | 11k | MIT | Oct 30, 2026 | Scanned, no flagged issues |
| MobileBuildMCP getsentry | 6.5k | MIT | Nov 1, 2026 | Scanned, no flagged issues |
| Gemini Notebook MCP CLI jacob-bd | 6.4k | MIT | Oct 27, 2026 | Scanned, no flagged issues |
| Mcporter openclaw | 5.1k | MIT | Oct 27, 2026 | Scanned, no flagged issues |
| Flint Chart microsoft | 4.5k | MIT | Nov 1, 2026 | Scanned, no flagged issues |