MCP Documentation Server

Findings (29)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/sdk@1.29.0: 6 known vulnerabilities

  GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  axios@1.17.0: 22 known vulnerabilities

  GHSA-3pq3-5fj3-cg6v, GHSA-42h9-826w-cgv3, GHSA-44g4-m2mj-wpvx, GHSA-4hqw-qxg8-jxx2, GHSA-542g-h47m-68v8 +17 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@2.2.2: 2 known vulnerabilities

  GHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  brace-expansion@5.0.6: 6 known vulnerabilities

  GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +1 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  fast-uri@3.1.2: 11 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf +6 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  follow-redirects@1.16.0: 3 known vulnerabilities

  GHSA-8r9p-f939-6h3c, GHSA-mrwp-f3q8-3g9p, GHSA-q3jh-wrc6-jgq8

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  form-data@4.0.5: 1 known vulnerability

  GHSA-hmw2-7cc7-3qxx

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  hono@4.12.23: 17 known vulnerabilities

  GHSA-54fx-42gc-7vw4, GHSA-5r4p-p66f-jhc7, GHSA-79qm-7rj5-m7r9, GHSA-88fw-hqm2-52qc, GHSA-8j4g-w8fx-2239 +12 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ip-address@10.2.0: 8 known vulnerabilities

  GHSA-22jq-vg5j-6vgg, GHSA-2vr4-cq9g-pvrc, GHSA-4xrf-jv44-h6hh, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv +3 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  js-yaml@4.2.0: 3 known vulnerabilities

  GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  multer@2.1.1: 6 known vulnerabilities

  GHSA-3p4h-7m6x-2hcm, GHSA-535w-7cp7-47q4, GHSA-72gw-mp4g-v24j, GHSA-q7qp-rjg7-q26m, GHSA-qvfw-j98x-7q72 +1 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  pacote@21.5.0: 1 known vulnerability

  GHSA-w4pp-8pjf-rmxw

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  sharp@0.32.6: 3 known vulnerabilities

  GHSA-f88m-g3jw-g9cj, GHSA-rgj7-g3m4-5g8c, GHSA-wq5f-xc86-pv6w

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  undici@6.26.0: 15 known vulnerabilities

  GHSA-2m5v-pch6-74hx, GHSA-35p6-xmwp-9g52, GHSA-3wwx-pv8p-q78v, GHSA-4qv8-2p9j-2685, GHSA-8xcm-r25x-g524 +10 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  undici@8.3.0: 30 known vulnerabilities

  GHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-35p6-xmwp-9g52, GHSA-38rv-x7px-6hhq +25 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.25.76: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@4.4.3: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  @hono/node-server@2.0.4: 3 known vulnerabilities

  GHSA-9mqv-5hh9-4cgg, GHSA-frvp-7c67-39w9, GHSA-rmxm-3fg6-px4f

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  esbuild@0.28.0: 1 known vulnerability

  GHSA-g7r4-m6w7-qqqr

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  glob@13.0.6: 1 known vulnerability

  GHSA-3g3m-2fjr-6pw4

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@10.2.5: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  postcss-selector-parser@7.1.1: 2 known vulnerabilities

  GHSA-rj75-hqrm-r3gf, GHSA-w9m9-85wc-3x92

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  protobufjs@8.5.0: 3 known vulnerabilities

  GHSA-f38q-mgvj-vph7, GHSA-j3f2-48v5-ccww, GHSA-jfj6-75fj-8934

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.15.2: 3 known vulnerabilities

  GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-x5fp-wj9c-mxmx

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  package.json has a prepare script

  npm run build

  package.json
• lowLow. Minor, or common in normal tools. Shown for information.
  Reads environment variables not listed in the manifest

  MCP_STREAMING_ENABLED, MCP_STREAM_FILE_SIZE_LIMIT, MCP_STREAM_CHUNK_SIZE, MCP_CACHE_ENABLED, MCP_CACHE_SIZE, GEMINI_API_KEY, MCP_EMBEDDING_MODEL, START_WEB_UI, WEB_PORT, MCP_BASE_DIR, WEB_HOST

Network activity

Tools exposed (11)

• add_document

  Add a new document to the knowledge base

• delete_document

  Delete a document from the collection

• search_documents

  Search for chunks within a specific document using semantic similarity. Always tell the user if result is truncated because of length. for example if you recive a message like this in the response: 'Tool response was too long and was truncated'

• get_document

  Use this tool only when user explicitly requests it. Retrieve a specific document by ID. Always tell the user if result is truncated because of length. for example if you recive a message like this in the response: 'Tool response was too long and was truncated'

• list_documents

  List all documents in the knowledge base

• search_all_documents

  Search for relevant chunks across ALL documents in the knowledge base using semantic similarity (hybrid: full-text + vector). Useful for cross-document search when you don't know which document contains the answer.

• get_context_window

  Returns a window of parent content sections around a central parent_index. Use parent_index values from search results. Always tell the user if result is truncated because of length.

• get_ui_url

  Get the URL of the web UI. use this tool when user ask you to access the web interface, when the user ask you to upload a file or when the user ask you the uploads folder path. All these function are available in the web UI.

• get_uploads_path

  Get the absolute path to the uploads folder where you can manually place .txt and .md files

• process_uploads

  Process all .txt and .md files in the uploads folder and create embeddings for them

• list_uploads_files

  List all files in the uploads folder with their details