Interactive MCP

Findings (33)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/commands/input/index.ts:129
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/commands/input/index.ts:147
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/commands/input/index.ts:156
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/commands/intensive-chat/index.ts:128
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/commands/intensive-chat/index.ts:144
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/commands/intensive-chat/index.ts:152
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/sdk@1.10.2: 7 known vulnerabilities

  GHSA-345p-7cg4-v4c7, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-8r9q-7v3j-jr4g, GHSA-f897-62hf-6gxq +2 more

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@2.2.0: 3 known vulnerabilities

  GHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6, GHSA-wqch-xfxh-vrr4

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  brace-expansion@1.1.11: 8 known vulnerabilities

  GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +3 more

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  brace-expansion@2.0.1: 8 known vulnerabilities

  GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +3 more

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  flatted@3.3.3: 2 known vulnerabilities

  GHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  js-yaml@4.1.0: 5 known vulnerabilities

  GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  lodash@4.17.21: 2 known vulnerabilities

  GHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  lodash-es@4.17.21: 2 known vulnerabilities

  GHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  minimatch@3.1.2: 3 known vulnerabilities

  GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  minimatch@9.0.5: 4 known vulnerabilities

  GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-g3hv-75wg-m249

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  path-to-regexp@8.2.0: 2 known vulnerabilities

  GHSA-27v5-c462-wpq7, GHSA-j3q9-mxjg-w52f

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  picomatch@2.3.1: 2 known vulnerabilities

  GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  uuid@8.3.2: 1 known vulnerability

  GHSA-w5hq-g745-h8pq

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ws@8.18.1: 2 known vulnerabilities

  GHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.24.3: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Install contacted hosts other than package registries

  34.11.16.104.in-addr.arpa
• lowLow. Minor, or common in normal tools. Shown for information.
  @eslint/plugin-kit@0.2.8: 1 known vulnerability

  GHSA-xffm-g5w8-qvg7

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  @humanfs/node@0.16.6: 1 known vulnerability

  GHSA-p498-v437-472g

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  ajv@6.12.6: 1 known vulnerability

  GHSA-2g4f-4pwh-qvx6

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  deepmerge@4.3.1: 1 known vulnerability

  GHSA-gcqx-w48m-w2h4

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  fast-copy@3.0.2: 1 known vulnerability

  GHSA-jggr-w7fw-pc2j

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.14.0: 5 known vulnerabilities

  GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-6rw7-vpxm-498p, GHSA-q8mj-m7cp-5q26, GHSA-w7fw-mjwx-w883

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  yaml@2.7.1: 1 known vulnerability

  GHSA-48c2-rrv3-qjmp

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  package.json has a prepare script

  husky

  package.json
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)

Network activity

Tools exposed (5)

• request_user_input

  <description> Send a question to the user via a pop-up command prompt. **Crucial for clarifying requirements, confirming plans, or resolving ambiguity.** You should call this tool whenever it has **any** uncertainty or needs clarification or confirmation, even for trivial or silly questions. Feel fr

• message_complete_notification

  <description> Notify when a response has completed. Use this tool **once** at the end of **each and every** message to signal completion to the user. </description> <importantNotes> - (!important!) **MANDATORY:** ONLY use this tool exactly once per message to signal completion. **Do not forget this

• start_intensive_chat

  <description> Start an intensive chat session for gathering multiple answers quickly from the user. **Highly recommended** for scenarios requiring a sequence of related inputs or confirmations. Very useful for gathering multiple answers from the user in a short period of time. Especially useful for

• ask_intensive_chat

  <description> Ask a new question in an active intensive chat session previously started with 'start_intensive_chat'. </description> <importantNotes> - (!important!) Requires a valid session ID from 'start_intensive_chat'. - (!important!) Supports predefined options for quick selection. - (!importan

• stop_intensive_chat

  <description> Stop and close an active intensive chat session. **Must be called** after all questions have been asked using 'ask_intensive_chat'. </description> <importantNotes> - (!important!) Closes the console window for the intensive chat. - (!important!) Frees up system resources. - (!import