MCP by awslabs
by awslabsOpen source MCP Servers for AWS
MCP is an open-source mcp server by awslabs, written mainly in Python, with 9,858 GitHub stars and the Apache-2.0 license. Its code was last updated Oct 31, 2026.
Scan summary: scanned Nov 5, 2026 at commit ee66526. Seen able to read environment and secrets. Scan policy
ScannedScanned. The automated checks below ran on the commit shown. Read each line for what was and was not covered.
Full scan at
ee66526 · Nov 5, 2026 ScannedStatic, secrets and dependency checks completed with no critical findings.
Warning. This check found something worth reading in the findings below. It is not proof of a problem.Static code scanwarnWarning. This check found something worth reading in the findings below. It is not proof of a problem.
Flagged. This check found an issue. See the findings below.Secrets scanfailFlagged. This check found an issue. See the findings below.
Flagged. This check found an issue. See the findings below.Dependency audit4644 known vulnerabilitiesfailFlagged. This check found an issue. See the findings below.
Warning. This check found something worth reading in the findings below. It is not proof of a problem.ManifestnonewarnWarning. This check found something worth reading in the findings below. It is not proof of a problem.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Buildn/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Boot & handshaken/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Network egressn/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Reproducible (×3)n/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Findings (181)
- highHigh. Something risky that needs a close look before you install.credential-access issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.credential-access issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.credential-access issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.credential-access issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.credential-access issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.credential-access issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.credential-access issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.credential-access issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.credential-access issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.credential-access issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.credential-access issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.credential-access issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.urllib3@2.6.3: 270 known vulnerabilitiesPYSEC-2026-141, PYSEC-2026-142, PYSEC-2026-4175, PYSEC-2026-4176, PYSEC-2026-4177 +265 more
.github/workflows/detect-secrets-requirements.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.virtualenv@20.36.1: 893 known vulnerabilitiesPYSEC-2026-4011, PYSEC-2026-4012, PYSEC-2026-4013, PYSEC-2026-4014, GHSA-394h-qwmc-48pf +888 more
.github/workflows/pre-commit-requirements.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.protobuf@4.25.8: 1 known vulnerabilityPYSEC-2026-1805
.github/workflows/semgrep-requirements.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.body-parser@1.20.6: 1 known vulnerabilityGHSA-27r3-jxmh-p828
docusaurus/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@1.1.18: 3 known vulnerabilitiesGHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7
docusaurus/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.compression@1.8.1: 1 known vulnerabilityGHSA-vc2v-76pw-4v95
docusaurus/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.follow-redirects@1.16.0: 3 known vulnerabilitiesGHSA-8r9p-f939-6h3c, GHSA-mrwp-f3q8-3g9p, GHSA-q3jh-wrc6-jgq8
docusaurus/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.image-size@2.0.2: 2 known vulnerabilitiesGHSA-5p2g-fcmc-qvqq, GHSA-w3rx-r6r6-pgpr
docusaurus/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.joi@17.13.3: 6 known vulnerabilitiesGHSA-4528-x5fx-h6hg, GHSA-6h2x-m376-mqjq, GHSA-6w3j-5fw6-r9vr, GHSA-gg4h-3hg2-grpc, GHSA-q7cg-457f-vx79 +1 more
docusaurus/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@4.3.1: 1 known vulnerabilityGHSA-2883-xcg3-v3hh
docusaurus/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.launch-editor@2.14.1: 3 known vulnerabilitiesGHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw
docusaurus/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.nanoid@3.3.17: 1 known vulnerabilityGHSA-2v37-7h3g-55p8
docusaurus/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.path-to-regexp@0.1.12: 1 known vulnerabilityGHSA-37ch-88jc-xwx2
docusaurus/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.picomatch@2.3.1: 2 known vulnerabilitiesGHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
docusaurus/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.serialize-javascript@6.0.2: 3 known vulnerabilitiesGHSA-5c6j-r48x-rmvq, GHSA-m5mm-p8h7-m29v, GHSA-qj8w-gfj5-8c6v
docusaurus/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.source-map-js@1.2.1: 1 known vulnerabilityGHSA-68fv-2mgg-jv7q
docusaurus/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.svgo@3.3.4: 2 known vulnerabilitiesGHSA-4vpr-x523-8j87, GHSA-w27v-7q3p-w38r
docusaurus/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.uuid@8.3.2: 1 known vulnerabilityGHSA-w5hq-g745-h8pq
docusaurus/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.webpack-dev-middleware@7.4.5: 1 known vulnerabilityGHSA-g84c-rxfj-3j2c
docusaurus/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.aiohttp@3.14.3: 16 known vulnerabilitiesGHSA-2g87-pp6c-29x5, GHSA-494j-54xm-rwp3, GHSA-5wr8-gcqf-gqf3, GHSA-6cjc-53gc-5rqm, GHSA-9xw5-w5jj-pvcg +11 more
samples/mcp-integration-with-kb/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.dnspython@2.7.0: 5 known vulnerabilitiesGHSA-45c3-73f7-pv4m, GHSA-45c3-73f7-pv4m, GHSA-45c3-73f7-pv4m, GHSA-45c3-73f7-pv4m, GHSA-45c3-73f7-pv4m
samples/mcp-integration-with-kb/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.langchain@0.3.27: 2 known vulnerabilitiesPYSEC-2026-2192, PYSEC-2026-2555
samples/mcp-integration-with-kb/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.langchain-core@0.3.81: 4 known vulnerabilitiesPYSEC-2026-2193, PYSEC-2026-2562, PYSEC-2026-2563, PYSEC-2026-2564
samples/mcp-integration-with-kb/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.langsmith@0.5.1: 8 known vulnerabilitiesPYSEC-2026-2582, PYSEC-2026-2583, PYSEC-2026-2584, GHSA-f4xh-w4cj-qxq8, PYSEC-2026-2582 +3 more
samples/mcp-integration-with-kb/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.mcp@1.29.0: 60 known vulnerabilitiesGHSA-5h93-6whr-6q8j, GHSA-84m7-p3x7-pcfv, GHSA-rwrf-2pqf-9j8j, GHSA-w4fh-qvv9-3v23, GHSA-5h93-6whr-6q8j +55 more
samples/mcp-integration-with-kb/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.orjson@3.11.5: 3 known vulnerabilitiesGHSA-hx9q-6w63-j58v, GHSA-hx9q-6w63-j58v, GHSA-hx9q-6w63-j58v
samples/mcp-integration-with-kb/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.pyarrow@19.0.1: 2 known vulnerabilitiesPYSEC-2026-113, PYSEC-2026-113
samples/mcp-integration-with-kb/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.python-multipart@0.0.22: 240 known vulnerabilitiesPYSEC-2026-3036, PYSEC-2026-3037, PYSEC-2026-3038, PYSEC-2026-3039, PYSEC-2026-3040 +235 more
samples/mcp-integration-with-kb/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.starlette@0.50.0: 200 known vulnerabilitiesPYSEC-2026-161, PYSEC-2026-2280, PYSEC-2026-2281, PYSEC-2026-248, PYSEC-2026-249 +195 more
samples/mcp-integration-with-kb/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.tornado@6.5.4: 28 known vulnerabilitiesPYSEC-2026-140, PYSEC-2026-2287, PYSEC-2026-3387, PYSEC-2026-3388, PYSEC-2026-3389 +23 more
samples/mcp-integration-with-kb/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.langchain-core@1.2.5: 4 known vulnerabilitiesPYSEC-2026-2193, PYSEC-2026-2562, PYSEC-2026-2563, PYSEC-2026-2564
samples/mcp-integration-with-nova-canvas/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.httpx2@2.10.0: 123 known vulnerabilitiesPYSEC-2026-3846, PYSEC-2026-3848, PYSEC-2026-3849, PYSEC-2026-3846, PYSEC-2026-3848 +118 more
src/amazon-bedrock-agentcore-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.mcp@2.0.0: 164 known vulnerabilitiesGHSA-5h93-6whr-6q8j, GHSA-84m7-p3x7-pcfv, GHSA-rwrf-2pqf-9j8j, GHSA-w4fh-qvv9-3v23, GHSA-5h93-6whr-6q8j +159 more
src/amazon-bedrock-agentcore-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.httpcore2@2.6.0: 31 known vulnerabilitiesPYSEC-2026-3844, PYSEC-2026-3844, PYSEC-2026-3844, PYSEC-2026-3844, PYSEC-2026-3844 +26 more
src/amazon-kendra-index-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.httpx2@2.6.0: 155 known vulnerabilitiesPYSEC-2026-3845, PYSEC-2026-3846, PYSEC-2026-3847, PYSEC-2026-3848, PYSEC-2026-3849 +150 more
src/amazon-kendra-index-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.dnspython@2.8.0: 11 known vulnerabilitiesGHSA-45c3-73f7-pv4m, GHSA-45c3-73f7-pv4m, GHSA-45c3-73f7-pv4m, GHSA-45c3-73f7-pv4m, GHSA-45c3-73f7-pv4m +6 more
src/amazon-keyspaces-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.joserfc@1.7.2: 20 known vulnerabilitiesGHSA-9pg5-8c7x-5hfx, GHSA-jpxq-7h8p-2q76, GHSA-9pg5-8c7x-5hfx, GHSA-jpxq-7h8p-2q76, GHSA-9pg5-8c7x-5hfx +15 more
src/amazon-keyspaces-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.lxml@5.4.0: 1 known vulnerabilityPYSEC-2026-87
src/amazon-sns-sqs-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.protego@0.4.0: 2 known vulnerabilitiesPYSEC-2026-3906, PYSEC-2026-3906
src/amazon-sns-sqs-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.soupsieve@2.7: 12 known vulnerabilitiesPYSEC-2026-3071, PYSEC-2026-3072, PYSEC-2026-4170, PYSEC-2026-4171, PYSEC-2026-3071 +7 more
src/amazon-sns-sqs-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.filelock@3.29.0: 45 known vulnerabilitiesGHSA-567q-5qvw-pf92, GHSA-69hj-f68j-2879, GHSA-8mx5-7m5m-r77g, GHSA-9vhv-jxww-xfm5, GHSA-cwqr-hh33-gh44 +40 more
src/amazon-translate-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.joserfc@1.6.5: 4 known vulnerabilitiesPYSEC-2026-2528, PYSEC-2026-2530, GHSA-9pg5-8c7x-5hfx, GHSA-jpxq-7h8p-2q76
src/amazon-translate-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.python-multipart@0.0.28: 8 known vulnerabilitiesPYSEC-2026-3036, PYSEC-2026-3037, PYSEC-2026-3040, PYSEC-2026-3041, PYSEC-2026-3036 +3 more
src/amazon-translate-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.urllib3@2.7.0: 15 known vulnerabilitiesPYSEC-2026-4175, PYSEC-2026-4176, PYSEC-2026-4177, PYSEC-2026-4175, PYSEC-2026-4176 +10 more
src/amazon-translate-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.virtualenv@21.3.2: 19 known vulnerabilitiesPYSEC-2026-4011, PYSEC-2026-4012, PYSEC-2026-4013, PYSEC-2026-4014, GHSA-394h-qwmc-48pf +14 more
src/amazon-translate-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.pyasn1@0.6.4: 12 known vulnerabilitiesGHSA-2qm8-x737-gmw5, GHSA-9m75-vc3g-4x39, GHSA-fm9c-5rcf-2q5p, GHSA-mm57-4v3p-rchx, GHSA-2qm8-x737-gmw5 +7 more
src/aws-api-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.python-multipart@0.0.27: 20 known vulnerabilitiesPYSEC-2026-3036, PYSEC-2026-3037, PYSEC-2026-3040, PYSEC-2026-3041, PYSEC-2026-3036 +15 more
src/aws-api-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.soupsieve@2.6: 4 known vulnerabilitiesPYSEC-2026-3071, PYSEC-2026-3072, PYSEC-2026-4170, PYSEC-2026-4171
src/aws-documentation-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.python-multipart@0.0.26: 5 known vulnerabilitiesPYSEC-2026-3036, PYSEC-2026-3037, PYSEC-2026-3039, PYSEC-2026-3040, PYSEC-2026-3041
src/aws-for-sap-management-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.starlette@1.0.0: 15 known vulnerabilitiesPYSEC-2026-161, PYSEC-2026-2280, PYSEC-2026-2281, PYSEC-2026-248, PYSEC-2026-249 +10 more
src/aws-for-sap-management-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.virtualenv@21.2.4: 57 known vulnerabilitiesPYSEC-2026-4011, PYSEC-2026-4012, PYSEC-2026-4013, PYSEC-2026-4014, GHSA-394h-qwmc-48pf +52 more
src/aws-for-sap-management-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.lxml@6.0.1: 2 known vulnerabilitiesPYSEC-2026-87, PYSEC-2026-87
src/aws-healthomics-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.mistune@3.0.2: 17 known vulnerabilitiesPYSEC-2026-168, PYSEC-2026-2206, PYSEC-2026-2207, PYSEC-2026-2208, PYSEC-2026-2209 +12 more
src/aws-healthomics-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.msgpack@1.1.1: 2 known vulnerabilitiesPYSEC-2026-3625, GHSA-j586-36cw-2gc2
src/aws-healthomics-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.joserfc@1.6.4: 4 known vulnerabilitiesPYSEC-2026-2528, PYSEC-2026-2530, GHSA-9pg5-8c7x-5hfx, GHSA-jpxq-7h8p-2q76
src/aws-support-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.virtualenv@21.3.0: 19 known vulnerabilitiesPYSEC-2026-4011, PYSEC-2026-4012, PYSEC-2026-4013, PYSEC-2026-4014, GHSA-394h-qwmc-48pf +14 more
src/aws-support-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.filelock@3.25.2: 18 known vulnerabilitiesGHSA-567q-5qvw-pf92, GHSA-69hj-f68j-2879, GHSA-8mx5-7m5m-r77g, GHSA-9vhv-jxww-xfm5, GHSA-cwqr-hh33-gh44 +13 more
src/aws-transform-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.virtualenv@21.2.0: 38 known vulnerabilitiesPYSEC-2026-4011, PYSEC-2026-4012, PYSEC-2026-4013, PYSEC-2026-4014, GHSA-394h-qwmc-48pf +33 more
src/aws-transform-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.black@26.5.1: 2 known vulnerabilitiesGHSA-cg8m-r9f2-5wm2, GHSA-cg8m-r9f2-5wm2
src/billing-cost-management-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.python-multipart@0.0.9: 8 known vulnerabilitiesPYSEC-2026-1851, PYSEC-2026-1852, PYSEC-2026-3036, PYSEC-2026-3037, PYSEC-2026-3038 +3 more
src/cloudwatch-applicationsignals-mcp-server/evals/requirements.txt - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.httpcore2@2.9.1: 2 known vulnerabilitiesPYSEC-2026-3844, PYSEC-2026-3844
src/cloudwatch-applicationsignals-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.httpx2@2.9.1: 10 known vulnerabilitiesPYSEC-2026-3845, PYSEC-2026-3846, PYSEC-2026-3847, PYSEC-2026-3848, PYSEC-2026-3849 +5 more
src/cloudwatch-applicationsignals-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.filelock@3.29.3: 9 known vulnerabilitiesGHSA-567q-5qvw-pf92, GHSA-69hj-f68j-2879, GHSA-8mx5-7m5m-r77g, GHSA-9vhv-jxww-xfm5, GHSA-cwqr-hh33-gh44 +4 more
src/db2-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.virtualenv@21.14.1: 15 known vulnerabilitiesGHSA-394h-qwmc-48pf, GHSA-43mp-35q3-x3fq, GHSA-494p-63j8-28p3, GHSA-558c-9hv2-4prj, GHSA-5vjq-rrrf-7h2q +10 more
src/db2-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.soupsieve@2.8: 8 known vulnerabilitiesPYSEC-2026-3071, PYSEC-2026-3072, PYSEC-2026-4170, PYSEC-2026-4171, PYSEC-2026-3071 +3 more
src/document-loader-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.pymongo@4.12.1: 5 known vulnerabilitiesPYSEC-2026-4294, PYSEC-2026-4295, PYSEC-2026-4296, PYSEC-2026-4297, GHSA-98qm-wvgf-w4cf
src/documentdb-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.awslabs-aws-api-mcp-server@1.3.24: 1 known vulnerabilityPYSEC-2026-3549
src/dynamodb-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.lxml@6.0.2: 2 known vulnerabilitiesPYSEC-2026-87, PYSEC-2026-87
src/dynamodb-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.mcp@1.26.0: 7 known vulnerabilitiesPYSEC-2026-3481, PYSEC-2026-3482, PYSEC-2026-3483, GHSA-5h93-6whr-6q8j, GHSA-84m7-p3x7-pcfv +2 more
src/dynamodb-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.oauthlib@3.3.1: 4 known vulnerabilitiesPYSEC-2026-4113, PYSEC-2026-4114, GHSA-3jp2-3mrg-2vxc, GHSA-7984-qgvg-3j9c
src/eks-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.black@26.3.1: 1 known vulnerabilityGHSA-cg8m-r9f2-5wm2
src/mcp-lambda-handler/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.starlette@1.2.0: 4 known vulnerabilitiesPYSEC-2026-248, PYSEC-2026-249, PYSEC-2026-248, PYSEC-2026-249
src/mssql-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.python-multipart@0.0.29: 8 known vulnerabilitiesPYSEC-2026-3036, PYSEC-2026-3037, PYSEC-2026-3040, PYSEC-2026-3041, PYSEC-2026-3036 +3 more
src/mysql-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.joserfc@1.6.8: 2 known vulnerabilitiesGHSA-9pg5-8c7x-5hfx, GHSA-jpxq-7h8p-2q76
src/openapi-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.filelock@3.28.0: 9 known vulnerabilitiesGHSA-567q-5qvw-pf92, GHSA-69hj-f68j-2879, GHSA-8mx5-7m5m-r77g, GHSA-9vhv-jxww-xfm5, GHSA-cwqr-hh33-gh44 +4 more
src/oracle-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.fsspec@2025.5.1: 1 known vulnerabilityPYSEC-2026-4217
src/s3-tables-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.pyarrow@22.0.0: 1 known vulnerabilityPYSEC-2026-113
src/s3-tables-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.starlette@1.2.1: 2 known vulnerabilitiesPYSEC-2026-248, PYSEC-2026-249
src/security-agent-mcp-server/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.virtualenv@21.3.1: 19 known vulnerabilitiesPYSEC-2026-4011, PYSEC-2026-4012, PYSEC-2026-4013, PYSEC-2026-4014, GHSA-394h-qwmc-48pf +14 more
src/security-agent-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key6 matches in this file
src/aws-iot-sitewise-mcp-server/tests/tools/test_sitewise_computation_models.py:398 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key2 matches in this file
src/aws-iot-sitewise-mcp-server/tests/models/test_computation_data_models.py:1073 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key4 matches in this file
src/aws-iot-sitewise-mcp-server/tests/tools/test_sitewise_executions.py:169 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: jwt2 matches in this file
src/aws-serverless-mcp-server/tests/test_data_scrubber.py:90 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
src/aws-support-mcp-server/tests/test_aws_support_mcp_server.py:861 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key18 matches in this file
src/ecs-mcp-server/tests/unit/troubleshooting_tools/test_fetch_task_logs.py:105 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
src/healthlake-mcp-server/tests/test_pagination_hardening.py:60 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
src/ecs-mcp-server/tests/unit/test_aws_utils.py:761 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: jwt2 matches in this file
src/openapi-mcp-server/tests/utils/test_error_handler_extended.py:35 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
src/openapi-mcp-server/tests/utils/test_http_client_import_error.py:29 - lowLow. Minor, or common in normal tools. Shown for information.pygments@2.19.2: 21 known vulnerabilitiesPYSEC-2026-2987, PYSEC-2026-2987, PYSEC-2026-2987, PYSEC-2026-2987, PYSEC-2026-2987 +16 more
.github/workflows/bandit-requirements.txt - lowLow. Minor, or common in normal tools. Shown for information.setuptools@80.9.0: 4 known vulnerabilitiesPYSEC-2026-3447, GHSA-xmj3-9gf7-h52w, PYSEC-2026-3447, GHSA-xmj3-9gf7-h52w
.github/workflows/bandit-requirements.txt - lowLow. Minor, or common in normal tools. Shown for information.idna@3.10: 13 known vulnerabilitiesPYSEC-2026-215, PYSEC-2026-215, PYSEC-2026-215, PYSEC-2026-215, PYSEC-2026-215 +8 more
.github/workflows/detect-secrets-requirements.txt - lowLow. Minor, or common in normal tools. Shown for information.requests@2.32.4: 9 known vulnerabilitiesPYSEC-2026-2275, PYSEC-2026-2275, PYSEC-2026-2275, PYSEC-2026-2275, PYSEC-2026-2275 +4 more
.github/workflows/detect-secrets-requirements.txt - lowLow. Minor, or common in normal tools. Shown for information.filelock@3.20.3: 94 known vulnerabilitiesGHSA-69hj-f68j-2879, GHSA-8mx5-7m5m-r77g, GHSA-69hj-f68j-2879, GHSA-8mx5-7m5m-r77g, GHSA-69hj-f68j-2879 +89 more
.github/workflows/pre-commit-requirements.txt - lowLow. Minor, or common in normal tools. Shown for information.opentelemetry-api@1.25.0: 1 known vulnerabilityGHSA-xcq7-p3pf-p88h
.github/workflows/semgrep-requirements.txt - lowLow. Minor, or common in normal tools. Shown for information.ajv@8.17.1: 1 known vulnerabilityGHSA-2g4f-4pwh-qvx6
docusaurus/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.colord@2.9.3: 1 known vulnerabilityGHSA-2wm5-q62r-hmrv
docusaurus/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.deepmerge@4.3.1: 1 known vulnerabilityGHSA-gcqx-w48m-w2h4
docusaurus/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.fast-uri@3.1.7: 5 known vulnerabilitiesGHSA-333x-w4r6-6crp, GHSA-hrr3-gc8f-f4qj, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h
docusaurus/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.http-proxy-middleware@2.0.9: 1 known vulnerabilityGHSA-64mm-vxmg-q3vj
docusaurus/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.postcss-selector-parser@6.1.4: 1 known vulnerabilityGHSA-rj75-hqrm-r3gf
docusaurus/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.postcss-selector-parser@7.1.4: 1 known vulnerabilityGHSA-rj75-hqrm-r3gf
docusaurus/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.qs@6.15.3: 3 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-x5fp-wj9c-mxmx
docusaurus/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.langchain-text-splitters@0.3.11: 1 known vulnerabilityPYSEC-2026-77
samples/mcp-integration-with-kb/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.multidict@6.7.0: 1 known vulnerabilityPYSEC-2026-4244
samples/mcp-integration-with-kb/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.pydantic-settings@2.12.0: 4 known vulnerabilitiesGHSA-4xgf-cpjx-pc3j, GHSA-4xgf-cpjx-pc3j, GHSA-4xgf-cpjx-pc3j, GHSA-4xgf-cpjx-pc3j
samples/mcp-integration-with-kb/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.pygments@2.19.1: 33 known vulnerabilitiesPYSEC-2026-2987, PYSEC-2026-2987, PYSEC-2026-2987, PYSEC-2026-2987, PYSEC-2026-2987 +28 more
samples/mcp-integration-with-kb/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.python-dotenv@1.1.0: 32 known vulnerabilitiesPYSEC-2026-2270, PYSEC-2026-2270, PYSEC-2026-2270, PYSEC-2026-2270, PYSEC-2026-2270 +27 more
samples/mcp-integration-with-kb/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.requests@2.32.5: 20 known vulnerabilitiesPYSEC-2026-2275, PYSEC-2026-2275, PYSEC-2026-2275, PYSEC-2026-2275, PYSEC-2026-2275 +15 more
samples/mcp-integration-with-kb/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.streamlit@1.52.2: 2 known vulnerabilitiesPYSEC-2026-212, PYSEC-2026-2285
samples/mcp-integration-with-nova-canvas/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.opentelemetry-api@1.44.0: 43 known vulnerabilitiesGHSA-xcq7-p3pf-p88h, GHSA-xcq7-p3pf-p88h, GHSA-xcq7-p3pf-p88h, GHSA-xcq7-p3pf-p88h, GHSA-xcq7-p3pf-p88h +38 more
src/amazon-bedrock-agentcore-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.pytest@8.4.2: 4 known vulnerabilitiesPYSEC-2026-1845, PYSEC-2026-1845, PYSEC-2026-1845, PYSEC-2026-1845
src/amazon-bedrock-agentcore-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.python-dotenv@1.1.1: 14 known vulnerabilitiesPYSEC-2026-2270, PYSEC-2026-2270, PYSEC-2026-2270, PYSEC-2026-2270, PYSEC-2026-2270 +9 more
src/amazon-bedrock-agentcore-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.pytest@8.3.5: 20 known vulnerabilitiesPYSEC-2026-1845, PYSEC-2026-1845, PYSEC-2026-1845, PYSEC-2026-1845, PYSEC-2026-1845 +15 more
src/amazon-kendra-index-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.fastmcp@3.4.3: 13 known vulnerabilitiesGHSA-7xgj-8392-5q4r, GHSA-7xgj-8392-5q4r, GHSA-7xgj-8392-5q4r, GHSA-7xgj-8392-5q4r, GHSA-7xgj-8392-5q4r +8 more
src/amazon-keyspaces-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.fastmcp-slim@3.4.3: 13 known vulnerabilitiesGHSA-7xgj-8392-5q4r, GHSA-7xgj-8392-5q4r, GHSA-7xgj-8392-5q4r, GHSA-7xgj-8392-5q4r, GHSA-7xgj-8392-5q4r +8 more
src/amazon-keyspaces-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.opentelemetry-api@1.39.1: 10 known vulnerabilitiesGHSA-xcq7-p3pf-p88h, GHSA-xcq7-p3pf-p88h, GHSA-xcq7-p3pf-p88h, GHSA-xcq7-p3pf-p88h, GHSA-xcq7-p3pf-p88h +5 more
src/amazon-keyspaces-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.pytest@8.4.1: 15 known vulnerabilitiesPYSEC-2026-1845, PYSEC-2026-1845, PYSEC-2026-1845, PYSEC-2026-1845, PYSEC-2026-1845 +10 more
src/amazon-qbusiness-anonymous-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.pytest@8.4.0: 5 known vulnerabilitiesPYSEC-2026-1845, PYSEC-2026-1845, PYSEC-2026-1845, PYSEC-2026-1845, PYSEC-2026-1845
src/amazon-qindex-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.idna@3.14: 1 known vulnerabilityPYSEC-2026-215
src/amazon-translate-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.opentelemetry-api@1.41.1: 2 known vulnerabilitiesGHSA-xcq7-p3pf-p88h, GHSA-xcq7-p3pf-p88h
src/amazon-translate-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.pydantic-settings@2.14.1: 1 known vulnerabilityGHSA-4xgf-cpjx-pc3j
src/amazon-translate-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.setuptools@83.0.0: 5 known vulnerabilitiesGHSA-xmj3-9gf7-h52w, GHSA-xmj3-9gf7-h52w, GHSA-xmj3-9gf7-h52w, GHSA-xmj3-9gf7-h52w, GHSA-xmj3-9gf7-h52w
src/aws-api-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.werkzeug@3.1.8: 1 known vulnerabilityPYSEC-2026-4312
src/aws-for-sap-management-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.bleach@6.2.0: 2 known vulnerabilitiesGHSA-8rfp-98v4-mmr6, GHSA-gj48-438w-jh9v
src/aws-healthomics-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.idna@3.11: 3 known vulnerabilitiesPYSEC-2026-215, PYSEC-2026-215, PYSEC-2026-215
src/aws-iac-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.pytest@9.0.1: 3 known vulnerabilitiesPYSEC-2026-1845, PYSEC-2026-1845, PYSEC-2026-1845
src/aws-iac-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.python-dotenv@1.2.1: 5 known vulnerabilitiesPYSEC-2026-2270, PYSEC-2026-2270, PYSEC-2026-2270, PYSEC-2026-2270, PYSEC-2026-2270
src/aws-iac-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.werkzeug@3.1.5: 10 known vulnerabilitiesPYSEC-2026-2320, PYSEC-2026-4312, PYSEC-2026-2320, PYSEC-2026-4312, PYSEC-2026-2320 +5 more
src/aws-network-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.fastmcp@4.0.5: 2 known vulnerabilitiesGHSA-7xgj-8392-5q4r, GHSA-vqqp-x5qm-5qp4
src/billing-cost-management-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.fastmcp-slim@4.0.5: 2 known vulnerabilitiesGHSA-7xgj-8392-5q4r, GHSA-vqqp-x5qm-5qp4
src/billing-cost-management-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.asteval@1.0.6: 2 known vulnerabilitiesPYSEC-2026-3807, GHSA-9w56-46f6-3qhx
src/ccapi-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.awscli@1.44.67: 2 known vulnerabilitiesPYSEC-2026-3548, PYSEC-2026-3627
src/dynamodb-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.opentelemetry-api@1.38.0: 1 known vulnerabilityGHSA-xcq7-p3pf-p88h
src/dynamodb-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.pytest@9.0.2: 2 known vulnerabilitiesPYSEC-2026-1845, PYSEC-2026-1845
src/dynamodb-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.opentelemetry-api@1.43.0: 1 known vulnerabilityGHSA-xcq7-p3pf-p88h
src/roda-mcp-server/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.No manifest declaring network access and environment variables (agent.json)
- infoInfo. A note about the project, not a problem.Ignored the repo's scanner suppression config (1 file).gitleaks.toml
Automated result for the commit shown. See our scan policy. View the scan log
Maintainers can claim the listing to rescan, or dispute a result.
MCP alternatives
View more →Similar mcp servers in Cloud Infrastructure, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.
| Name | Stars | Licence | Last updated | Scan |
|---|---|---|---|---|
| MCP (this page) awslabs | 9.9k | Apache-2.0 | Oct 31, 2026 | Scanned, no flagged issues |
| TREK liketrek | 15k | AGPL-3.0 | Nov 1, 2026 | Scanned, no flagged issues |
| MCP Context Forge IBM | 4.7k | Apache-2.0 | Oct 30, 2026 | Scanned, no flagged issues |
| Mcpo open-webui | 4.4k | MIT | May 17, 2026 | Scanned, no flagged issues |
| Lean Ctx yvgude | 3.9k | Apache-2.0 | Oct 31, 2026 | Scanned, no flagged issues |
| Textbee textbee | 3.2k | MIT | Oct 30, 2026 | Scanned, no flagged issues |