Lunar MCP Server
by TheLunarCompanylunar.dev: Agent native MCP Gateway for governance and security
Lunar is an open-source mcp server by TheLunarCompany, written mainly in TypeScript, with 506 GitHub stars and the MIT license. Its code was last updated Nov 1, 2026.
Scan summary: scanned Nov 5, 2026 at commit 09951a1. Seen able to run shell commands, run dynamic code. Scan policy
ScannedScanned. The automated checks below ran on the commit shown. Read each line for what was and was not covered.
Full scan at
09951a1 · Nov 5, 2026 ScannedStatic, secrets and dependency checks completed with no critical findings.
Warning. This check found something worth reading in the findings below. It is not proof of a problem.Static code scanwarnWarning. This check found something worth reading in the findings below. It is not proof of a problem.
Flagged. This check found an issue. See the findings below.Secrets scanfailFlagged. This check found an issue. See the findings below.
Flagged. This check found an issue. See the findings below.Dependency audit605 known vulnerabilitiesfailFlagged. This check found an issue. See the findings below.
Warning. This check found something worth reading in the findings below. It is not proof of a problem.ManifestnonewarnWarning. This check found something worth reading in the findings below. It is not proof of a problem.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Buildn/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Boot & handshaken/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Network egressn/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Reproducible (×3)n/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Findings (99)
- highHigh. Something risky that needs a close look before you install.dropper issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.code-execution issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
ai-gateway-shared/public/build-deps.cjs:18 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
mcpx/build-dep-select.cjs:32 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
mcpx/build-deps.cjs:13 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
mcpx/mcpx-e2e-tests/run-all-scenarios.js:19 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
mcpx/mcpx-e2e-tests/run-all-with-image.cjs:53 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
proxy/integration-tests/features/steps/flow.py:100 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
proxy/integration-tests/features/steps/policies_reload.py:46 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
proxy/integration-tests/features/steps/policies_reload.py:53 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.zod@3.25.76: 5 known vulnerabilitiesGHSA-mrhx-c7xc-m3w5, GHSA-mrhx-c7xc-m3w5, GHSA-mrhx-c7xc-m3w5, GHSA-mrhx-c7xc-m3w5, GHSA-mrhx-c7xc-m3w5
ai-gateway-shared/public/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@modelcontextprotocol/sdk@1.29.0: 18 known vulnerabilitiesGHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +13 more
mcpx/demo-client/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.body-parser@2.2.2: 8 known vulnerabilitiesGHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6, GHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6, GHSA-27r3-jxmh-p828 +3 more
mcpx/demo-client/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.browserslist@4.26.2: 2 known vulnerabilitiesGHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
mcpx/demo-client/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.fast-uri@3.1.2: 55 known vulnerabilitiesGHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf +50 more
mcpx/demo-client/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.ip-address@10.2.0: 32 known vulnerabilitiesGHSA-22jq-vg5j-6vgg, GHSA-2vr4-cq9g-pvrc, GHSA-4xrf-jv44-h6hh, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv +27 more
mcpx/demo-client/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@grpc/grpc-js@1.14.4: 2 known vulnerabilitiesGHSA-f596-whhp-79r4, GHSA-m9gg-hp2v-232j
mcpx/mcpx-e2e-tests/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.axios@1.16.1: 42 known vulnerabilitiesGHSA-3pq3-5fj3-cg6v, GHSA-42h9-826w-cgv3, GHSA-44g4-m2mj-wpvx, GHSA-4hqw-qxg8-jxx2, GHSA-542g-h47m-68v8 +37 more
mcpx/mcpx-e2e-tests/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@2.1.0: 12 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +7 more
mcpx/mcpx-e2e-tests/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.browserslist@4.25.1: 2 known vulnerabilitiesGHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
mcpx/mcpx-e2e-tests/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.follow-redirects@1.16.0: 6 known vulnerabilitiesGHSA-8r9p-f939-6h3c, GHSA-mrwp-f3q8-3g9p, GHSA-q3jh-wrc6-jgq8, GHSA-8r9p-f939-6h3c, GHSA-mrwp-f3q8-3g9p +1 more
mcpx/mcpx-e2e-tests/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@3.14.2: 12 known vulnerabilitiesGHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, GHSA-2883-xcg3-v3hh +7 more
mcpx/mcpx-e2e-tests/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@4.1.1: 4 known vulnerabilitiesGHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68
mcpx/mcpx-e2e-tests/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.uuid@10.0.0: 1 known vulnerabilityGHSA-w5hq-g745-h8pq
mcpx/mcpx-e2e-tests/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.zod@4.4.3: 1 known vulnerabilityGHSA-mrhx-c7xc-m3w5
mcpx/mcpx-e2e-tests/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.body-parser@2.2.1: 2 known vulnerabilitiesGHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6
mcpx/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@1.1.15: 6 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +1 more
mcpx/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@2.1.1: 6 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +1 more
mcpx/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@5.0.6: 6 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +1 more
mcpx/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.browserslist@4.28.1: 2 known vulnerabilitiesGHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
mcpx/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.dompurify@3.4.0: 13 known vulnerabilitiesGHSA-55q2-fjhq-7xh7, GHSA-6688-9rhm-gjv2, GHSA-76mc-f452-cxcm, GHSA-c2j3-45gr-mqc4, GHSA-c6gr-qvv4-5v3f +8 more
mcpx/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.engine.io@6.6.9: 1 known vulnerabilityGHSA-2gc4-cqfq-p2gv
mcpx/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.happy-dom@20.9.0: 3 known vulnerabilitiesGHSA-5fpq-26gf-qwcr, GHSA-834v-8h66-3h79, GHSA-c8p4-j97h-3vg8
mcpx/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@4.2.0: 3 known vulnerabilitiesGHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj
mcpx/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.nanoid@3.3.12: 2 known vulnerabilitiesGHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8
mcpx/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.postcss@8.5.10: 3 known vulnerabilitiesGHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849
mcpx/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.postcss@8.5.15: 2 known vulnerabilitiesGHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849
mcpx/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.react-router@7.15.1: 5 known vulnerabilitiesGHSA-337j-9hxr-rhxg, GHSA-chx6-hx7r-mcp5, GHSA-h8fp-f39c-q6mh, GHSA-qwww-vcr4-c8h2, GHSA-wrjc-x8rr-h8h6
mcpx/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.socket.io-parser@4.2.6: 1 known vulnerabilityGHSA-2m8v-j782-fhvr
mcpx/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.source-map-js@1.2.1: 1 known vulnerabilityGHSA-68fv-2mgg-jv7q
mcpx/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.undici@7.30.0: 8 known vulnerabilitiesGHSA-2m5v-pch6-74hx, GHSA-4qv8-2p9j-2685, GHSA-4w7w-5xrc-9h26, GHSA-55wc-3pg8-jfw6, GHSA-9fm3-97px-rjf6 +3 more
mcpx/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.vite@6.4.3: 5 known vulnerabilitiesGHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22
mcpx/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@1.1.14: 6 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +1 more
mcpx/packages/webapp-protocol/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@5.0.5: 7 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-jxxr-4gwj-5jf2, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +2 more
mcpx/packages/webapp-protocol/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.browserslist@4.28.2: 2 known vulnerabilitiesGHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
mcpx/packages/webapp-protocol/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.ip-address@10.1.0: 6 known vulnerabilitiesGHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-mwp4-54f8-5fhr, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5 +1 more
mcpx/packages/webapp-protocol/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.body-parser@1.20.3: 2 known vulnerabilitiesGHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6
mcpx/testkit-mcp-server/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.aiohttp@3.13.4: 22 known vulnerabilitiesPYSEC-2026-2104, PYSEC-2026-2105, PYSEC-2026-2106, PYSEC-2026-2107, PYSEC-2026-2108 +17 more
proxy/integration-tests/Pipfile.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.black@26.3.1: 1 known vulnerabilityGHSA-cg8m-r9f2-5wm2
proxy/integration-tests/Pipfile.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.tornado@6.5.7: 9 known vulnerabilitiesPYSEC-2026-3928, GHSA-3hv7-mjh2-fv65, GHSA-8423-8fgw-73vq, GHSA-c2m8-h5v5-343r, GHSA-chx6-46f5-w4vp +4 more
proxy/integration-tests/Pipfile.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.urllib3@2.7.0: 3 known vulnerabilitiesPYSEC-2026-4175, PYSEC-2026-4176, PYSEC-2026-4177
proxy/integration-tests/Pipfile.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.google.golang.org/grpc@1.81.1: 12 known vulnerabilitiesGO-2026-6061, GO-2026-6348, GO-2026-6441, GO-2026-6443, GO-2026-6061 +7 more
proxy/src/libs/toolkit-core/go.mod - lowLow. Minor, or common in normal tools. Shown for information.deepmerge@4.3.1: 4 known vulnerabilitiesGHSA-gcqx-w48m-w2h4, GHSA-gcqx-w48m-w2h4, GHSA-gcqx-w48m-w2h4, GHSA-gcqx-w48m-w2h4
ai-gateway-shared/public/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.minimatch@10.2.6: 1 known vulnerabilityGHSA-g3hv-75wg-m249
ai-gateway-shared/public/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@babel/core@7.28.4: 1 known vulnerabilityGHSA-4x5r-pxfx-6jf8
mcpx/demo-client/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@hono/node-server@1.19.10: 3 known vulnerabilitiesGHSA-92pp-h63x-v22m, GHSA-frvp-7c67-39w9, GHSA-rmxm-3fg6-px4f
mcpx/demo-client/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.ajv@8.17.1: 3 known vulnerabilitiesGHSA-2g4f-4pwh-qvx6, GHSA-2g4f-4pwh-qvx6, GHSA-2g4f-4pwh-qvx6
mcpx/demo-client/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.baseline-browser-mapping@2.8.9: 1 known vulnerabilityGHSA-w5vr-8v7q-w6rv
mcpx/demo-client/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.hono@4.12.26: 60 known vulnerabilitiesGHSA-54fx-42gc-7vw4, GHSA-5r4p-p66f-jhc7, GHSA-79qm-7rj5-m7r9, GHSA-8j4g-w8fx-2239, GHSA-crvj-82cr-hjcx +55 more
mcpx/demo-client/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.protobufjs@7.6.4: 2 known vulnerabilitiesGHSA-j3f2-48v5-ccww, GHSA-j3f2-48v5-ccww
mcpx/demo-client/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.qs@6.14.2: 12 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-q8mj-m7cp-5q26, GHSA-x5fp-wj9c-mxmx, GHSA-4mjr-xmp4-gh2g +7 more
mcpx/demo-client/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@babel/core@7.28.0: 1 known vulnerabilityGHSA-4x5r-pxfx-6jf8
mcpx/mcpx-e2e-tests/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@hono/node-server@1.19.14: 8 known vulnerabilitiesGHSA-frvp-7c67-39w9, GHSA-rmxm-3fg6-px4f, GHSA-frvp-7c67-39w9, GHSA-rmxm-3fg6-px4f, GHSA-frvp-7c67-39w9 +3 more
mcpx/mcpx-e2e-tests/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@humanfs/node@0.16.7: 2 known vulnerabilitiesGHSA-p498-v437-472g, GHSA-p498-v437-472g
mcpx/mcpx-e2e-tests/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.ajv@6.12.6: 1 known vulnerabilityGHSA-2g4f-4pwh-qvx6
mcpx/mcpx-e2e-tests/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.glob@10.5.0: 3 known vulnerabilitiesGHSA-3g3m-2fjr-6pw4, GHSA-3g3m-2fjr-6pw4, GHSA-3g3m-2fjr-6pw4
mcpx/mcpx-e2e-tests/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.minimatch@9.0.9: 3 known vulnerabilitiesGHSA-g3hv-75wg-m249, GHSA-g3hv-75wg-m249, GHSA-g3hv-75wg-m249
mcpx/mcpx-e2e-tests/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.protobufjs@7.6.1: 2 known vulnerabilitiesGHSA-f38q-mgvj-vph7, GHSA-j3f2-48v5-ccww
mcpx/mcpx-e2e-tests/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@opentelemetry/core@2.7.1: 1 known vulnerabilityGHSA-8988-4f7v-96qf
mcpx/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@vitest/mocker@4.1.11: 2 known vulnerabilitiesGHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp
mcpx/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.baseline-browser-mapping@2.9.5: 1 known vulnerabilityGHSA-w5vr-8v7q-w6rv
mcpx/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.diff@7.0.0: 1 known vulnerabilityGHSA-73rr-hh4g-fpgx
mcpx/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.glob@13.0.6: 1 known vulnerabilityGHSA-3g3m-2fjr-6pw4
mcpx/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.minimatch@10.2.5: 2 known vulnerabilitiesGHSA-g3hv-75wg-m249, GHSA-g3hv-75wg-m249
mcpx/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.postcss-selector-parser@7.1.1: 2 known vulnerabilitiesGHSA-rj75-hqrm-r3gf, GHSA-w9m9-85wc-3x92
mcpx/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.qs@6.15.2: 3 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-x5fp-wj9c-mxmx
mcpx/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@babel/core@7.29.0: 1 known vulnerabilityGHSA-4x5r-pxfx-6jf8
mcpx/packages/webapp-protocol/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.baseline-browser-mapping@2.10.21: 1 known vulnerabilityGHSA-w5vr-8v7q-w6rv
mcpx/packages/webapp-protocol/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.qs@6.15.1: 4 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-q8mj-m7cp-5q26, GHSA-x5fp-wj9c-mxmx
mcpx/packages/webapp-protocol/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.multidict@6.7.1: 1 known vulnerabilityPYSEC-2026-4244
proxy/integration-tests/Pipfile.lock - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/crypto@0.52.0: 12 known vulnerabilitiesGO-2026-5932, GO-2026-6303, GO-2026-6354, GO-2026-6355, GO-2026-5932 +7 more
proxy/src/libs/shared-model/go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/net@0.54.0: 42 known vulnerabilitiesGO-2026-5025, GO-2026-5026, GO-2026-5027, GO-2026-5028, GO-2026-5029 +37 more
proxy/src/libs/shared-model/go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/text@0.37.0: 6 known vulnerabilitiesGO-2026-5970, GO-2026-6629, GO-2026-5970, GO-2026-6629, GO-2026-5970 +1 more
proxy/src/libs/shared-model/go.mod - lowLow. Minor, or common in normal tools. Shown for information.github.com/gorilla/websocket@1.5.1: 3 known vulnerabilitiesGO-2026-6278, GO-2026-6278, GO-2026-6278
proxy/src/libs/toolkit-core/go.mod - lowLow. Minor, or common in normal tools. Shown for information.github.com/redis/go-redis/v9@9.3.0: 3 known vulnerabilitiesGO-2025-3540, GO-2025-3540, GO-2025-3540
proxy/src/libs/toolkit-core/go.mod - lowLow. Minor, or common in normal tools. Shown for information.go.opentelemetry.io/otel@1.43.0: 3 known vulnerabilitiesGO-2026-5158, GO-2026-5158, GO-2026-5158
proxy/src/libs/toolkit-core/go.mod - lowLow. Minor, or common in normal tools. Shown for information.go.opentelemetry.io/otel/exporters/otlp/otlptrace@1.43.0: 3 known vulnerabilitiesGO-2026-6505, GO-2026-6505, GO-2026-6505
proxy/src/libs/toolkit-core/go.mod - lowLow. Minor, or common in normal tools. Shown for information.go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@1.43.0: 3 known vulnerabilitiesGO-2026-6505, GO-2026-6505, GO-2026-6505
proxy/src/libs/toolkit-core/go.mod - lowLow. Minor, or common in normal tools. Shown for information.go.opentelemetry.io/otel/sdk@1.43.0: 3 known vulnerabilitiesGO-2026-6505, GO-2026-6505, GO-2026-6505
proxy/src/libs/toolkit-core/go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/net@0.52.0: 30 known vulnerabilitiesGO-2026-4918, GO-2026-5025, GO-2026-5026, GO-2026-5027, GO-2026-5028 +25 more
proxy/src/libs/toolkit-core/go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/sys@0.42.0: 2 known vulnerabilitiesGO-2026-5024, GO-2026-5024
proxy/src/libs/toolkit-core/go.mod - lowLow. Minor, or common in normal tools. Shown for information.golang.org/x/text@0.35.0: 4 known vulnerabilitiesGO-2026-5970, GO-2026-6629, GO-2026-5970, GO-2026-6629
proxy/src/libs/toolkit-core/go.mod - lowLow. Minor, or common in normal tools. Shown for information.No manifest declaring network access and environment variables (agent.json)
Automated result for the commit shown. See our scan policy. View the scan log
Maintainers can claim the listing to rescan, or dispute a result.
Lunar alternatives
View more →Similar mcp servers in Cloud Infrastructure, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.
| Name | Stars | Licence | Last updated | Scan |
|---|---|---|---|---|
| Lunar (this page) TheLunarCompany | 506 | MIT | Nov 1, 2026 | Scanned, no flagged issues |
| TREK liketrek | 15k | AGPL-3.0 | Nov 1, 2026 | Scanned, no flagged issues |
| MCP awslabs | 9.9k | Apache-2.0 | Oct 31, 2026 | Scanned, no flagged issues |
| MCP Context Forge IBM | 4.7k | Apache-2.0 | Oct 30, 2026 | Scanned, no flagged issues |
| Mcpo open-webui | 4.4k | MIT | May 17, 2026 | Scanned, no flagged issues |
| Lean Ctx yvgude | 3.9k | Apache-2.0 | Oct 31, 2026 | Scanned, no flagged issues |