Kitbash MCP Server

Findings (8)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@2.3.0: 1 known vulnerability

  GHSA-27r3-jxmh-p828

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  fast-uri@3.1.3: 12 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-5jgf-p345-68v8, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf +7 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ip-address@10.2.0: 8 known vulnerabilities

  GHSA-22jq-vg5j-6vgg, GHSA-2vr4-cq9g-pvrc, GHSA-4xrf-jv44-h6hh, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv +3 more

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  @hono/node-server@1.19.14: 2 known vulnerabilities

  GHSA-frvp-7c67-39w9, GHSA-rmxm-3fg6-px4f

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  hono@4.12.30: 9 known vulnerabilities

  GHSA-54fx-42gc-7vw4, GHSA-5r4p-p66f-jhc7, GHSA-79qm-7rj5-m7r9, GHSA-8j4g-w8fx-2239, GHSA-crvj-82cr-hjcx +4 more

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.15.3: 3 known vulnerabilities

  GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-x5fp-wj9c-mxmx

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  package.json has a prepare script

  tsc

  package.json

Network activity

Tools exposed (2)

• kitbash

  STEP 1 OF 2. Start here when the user describes something they want to build and you need to know which parts already exist as open-source repos, which are worth reading and adapting, and which they should just write themselves. This tool returns a RUBRIC — a set of instructions for you to follow.

• kitbash_verify

  STEP 2 OF 2, AND IT IS NOT OPTIONAL. Fact-checks a slate of components and candidate repos against the live GitHub API, then returns the finished report for the user. Call this immediately after you have followed the rubric from the `kitbash` tool and assembled your components. Pass every component