DeskcommCRM MCP Server

by melgarafael• 5k•• Scanned•Claim this listing•Request removal
Sales & CRMaiai agentschatbotcrmcustomer support

Open-source AI sales OS — self-hosted CRM with native AI agents + WhatsApp (WAHA). Open alternative to Kommo, Octadesk & Intercom for any business that sells by chat. MCP-ready, multi-tenant, LGPD.

DeskcommCRM is an open-source mcp server by melgarafael, written mainly in TypeScript, with 5,017 GitHub stars and the MIT license. Its code was last updated Nov 1, 2026.

Scan summary: scanned Nov 5, 2026 at commit 04eeb38. Seen able to run dynamic code, connect to the internet. Scan policy

aboutREADMEsecurityreviews
Scanned
Full scan at 04eeb38 · Nov 5, 2026
Scanned
Static code scanwarn
Secrets scanfail
Dependency audit4 known vulnerabilitiespass
Manifestnonewarn
Buildfail
Boot & handshaken/a
Network egresswarn
Reproducible (×3)n/a

Findings (80)

  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • medium
    Contacts a hard-coded IP address instead of a domain name.
    lib/automation/actions/call-webhook.ts:472
  • medium
    Contacts a hard-coded IP address instead of a domain name.
    lib/channels/adapters/zernio.ts:350
  • medium
    Turns off TLS certificate checking, allowing traffic interception.
    lib/external-db/conexao.ts:47
  • medium
    Turns off TLS certificate checking, allowing traffic interception.
    lib/external-db/dialetos/mysql/conexao.ts:61
  • medium
    Install or build failed in a clean environment
    a · optimizePackageImports Creating an optimized production build ... ✓ Compiled successfully in 3.0min Running next.config.js provided runAfterProductionCompile ... ✓ Completed runAfterProductionCompile in 1613ms Running TypeScript ... Killed  ELIFECYCLE  Command failed with exit code 137.
  • medium
    Install contacted hosts other than package registries
    o1.ingest.sentry.io, telemetry.nextjs.org
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    app/api/v1/products/import/route.test.ts:524
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    app/api/v1/proposals/[id]/send/route.test.ts:725
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    app/app/settings/servidor-mcp-externo/_components/CadastroDoServidorMcpExterno.test.tsx:42
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    curso/jornada.test.ts:101
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    lib/automation/outbound-url.test.ts:16
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    lib/extensions/download.test.ts:147
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    lib/extensions/download.test.ts:148
  • low
    In tests/examples/docs: Turns off TLS certificate checking, allowing traffic interception.
    lib/external-db/dialetos/mysql/conexao.test.ts:89
  • low
    In tests/examples/docs: Turns off TLS certificate checking, allowing traffic interception.
    lib/external-db/dialetos/mysql/conexao.test.ts:90
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    lib/mcp/servidor-externo/externo.test.ts:404
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    lib/messaging/media/url-de-midia-externa.test.ts:14
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    lib/messaging/media/url-de-midia-externa.test.ts:16
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    lib/notifications/servicos-de-push.test.ts:24
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    lib/supabase/cookie-secure.test.ts:21
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    lib/webhooks/formulario.test.ts:51
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    app/actions/auth/signInWithPassword.test.ts:69
  • low
    Possible example credential in docs/tests: generic-api-key
    4 matches in this file
    app/api/v1/channels/graph-partner/route.test.ts:51
  • low
    Possible example credential in docs/tests: generic-api-key
    app/api/v1/tenants/provision/route.test.ts:161
  • low
    Possible example credential in docs/tests: generic-api-key
    app/app/ai/credentials/_components/AddCredentialDialog.test.tsx:59
  • low
    Possible example credential in docs/tests: generic-api-key
    docs/apostila-contribuidor.md:330
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    evidence/canais/baseline/e2e.txt:26
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    evidence/canais/baseline/e2e-paralelo.txt:13
  • low
    Possible example credential in docs/tests: generic-api-key
    lib/mcp/servidor-externo/externo.test.ts:47
  • low
    Possible example credential in docs/tests: generic-api-key
    lib/sentry/replay.test.ts:11
  • low
    Possible example credential in docs/tests: generic-api-key
    lib/sentry/privacidade.sdk.test.ts:24
  • low
    Possible example credential in docs/tests: generic-api-key
    lib/mcp/servidor-externo/do-agente/oauth-por-contato.test.ts:31
  • low
    Possible example credential in docs/tests: generic-api-key
    lib/sentry/scrub.test.ts:14
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/e2e/admin-credencial-google.spec.ts:55
  • low
    Possible example credential in docs/tests: generic-api-key
    supabase/migrations/MANIFEST.md:189
  • low
    Possible example credential in docs/tests: jwt
    tests/sonda-radar-isolamento-orgs.ts:34
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/shell/stack-local.test.sh:76
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/shell/senha-do-cron-vazada.test.sh:74
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    tests/unit/admin-credencial-e-marca-sem-texto-cru.test.ts:30
  • low
    Possible example credential in docs/tests: jwt
    tests/shell/single-server-traefik-rota-publica.test.sh:64
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/invariants/webhooks-secret-encryption.test.ts:25
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/assinatura-uma-rotacao-por-janela.test.ts:24
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    tests/unit/assinatura-recusa-diz-o-motivo.test.ts:30
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/app-da-meta-tela-nao-devolve-segredo.test.tsx:216
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/cadastro-do-mcp-externo-e-o-platform-admin.test.ts:24
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/invariants/webhooks-inbound.test.ts:363
  • low
    Possible example credential in docs/tests: stripe-access-token
    3 matches in this file
    tests/unit/chave-stripe-de-teste-recusa-producao.test.ts:5
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    tests/unit/credenciais-aceita-a-chave-do-jev.test.ts:56
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    tests/unit/credenciais-login-codex-por-empresa.test.ts:28
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/credenciais-ia-rotacao.test.ts:15
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/datafy-credentials.test.ts:76
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    tests/unit/cron-auth.test.ts:9
  • low
    Possible example credential in docs/tests: generic-api-key
    6 matches in this file
    tests/unit/dreno-escopado-do-webhook.test.ts:113
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    tests/unit/google-oauth-secret-formato.test.ts:29
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    tests/unit/fiacao-da-assinatura-no-caminho-do-agente.test.ts:35
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/mcp-externo-turno-no-atendimento.test.ts:52
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/nome-interno-sobrevive-a-salvar-a-credencial.test.ts:130
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/prospecting-scavio.test.ts:229
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    tests/unit/onboarding-chave-da-ia-vale-para-a-empresa.test.ts:179
  • low
    Possible example credential in docs/tests: generic-api-key
    tests/unit/supabase-server-url-opcional.test.ts:215
  • low
    @vitest/mocker@4.1.11: 2 known vulnerabilities
    GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp
    pnpm-lock.yaml
  • low
    glob@13.0.6: 1 known vulnerability
    GHSA-3g3m-2fjr-6pw4
    pnpm-lock.yaml
  • low
    minimatch@10.2.6: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    pnpm-lock.yaml
  • low
    No manifest declaring network access and environment variables (agent.json)

Network activity

During install
o1.ingest.sentry.ioregistry.npmjs.orgtelemetry.nextjs.org
While running
Not run — the code wasn't started in this scan

Automated result for the commit shown. See our scan policy. View the scan log

Maintainers can claim the listing to rescan, or dispute a result.

DeskcommCRM alternatives

View more →

Similar mcp servers in Sales & CRM, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

NameStarsLicenceLast updatedScan
DeskcommCRM (this page)
melgarafael
5kMITNov 1, 2026Scanned, no flagged issues
Relaticle
relaticle
1.8kAGPL-3.0Nov 1, 2026Scanned, no flagged issues
Line Harness Oss
Shudesu
613MITNov 1, 2026Scanned, no flagged issues
MCP Server Salesforce
tsmztech
165MITOct 30, 2026Scanned, no flagged issues
MCP Hosted
forcedotcom
136Apache-2.0Jul 23, 2026Scanned, no flagged issues
Twenty CRM MCP Server
mhenry3164
106MITJul 30, 2026Scanned, no flagged issues