Mcphub MCP Server

Findings (125)

• highHigh. Something risky that needs a close look before you install.
  backdoor issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  backdoor issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  backdoor issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  backdoor issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  backdoor issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  backdoor issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  backdoor issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  backdoor issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  backdoor issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  backdoor issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dropper issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dropper issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  backdoor issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/client@2.1.0: 2 known vulnerabilities

  GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/sdk@1.29.0: 6 known vulnerabilities

  GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@1.20.6: 1 known vulnerability

  GHSA-27r3-jxmh-p828

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@2.3.0: 1 known vulnerability

  GHSA-27r3-jxmh-p828

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  follow-redirects@1.16.0: 3 known vulnerabilities

  GHSA-8r9p-f939-6h3c, GHSA-mrwp-f3q8-3g9p, GHSA-q3jh-wrc6-jgq8

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  nanoid@3.3.17: 1 known vulnerability

  GHSA-2v37-7h3g-55p8

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  source-map-js@1.2.1: 1 known vulnerability

  GHSA-68fv-2mgg-jv7q

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.25.76: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  pnpm-lock.yaml
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  MCP server didn't complete the protocol handshake

  timed out waiting for the server
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-cookie.test.ts:23
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-external-ref.test.ts:59
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-external-ref.test.ts:94
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-external-ref.test.ts:100
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-external-ref.test.ts:106
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-external-ref.test.ts:135
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-oauth2.test.ts:64
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-oauth2.test.ts:111
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-oauth2.test.ts:155
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-oauth2.test.ts:215
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-oauth2.test.ts:248
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-oauth2.test.ts:264
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-oauth2.test.ts:291
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-oauth2.test.ts:341
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-oauth2.test.ts:438
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-spec-auth.test.ts:17
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-spec-auth.test.ts:240
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-spec-auth.test.ts:332
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-ssrf.test.ts:61
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-ssrf.test.ts:73
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-ssrf.test.ts:80
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/clients/__tests__/openapi-ssrf.test.ts:97
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/middlewares/toolCallGuard.test.ts:29
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/middlewares/toolCallGuard.test.ts:30
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/middlewares/toolCallGuard.test.ts:31
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/middlewares/toolCallGuard.test.ts:86
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/middlewares/toolCallGuard.test.ts:98
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/middlewares/toolCallGuard.test.ts:101
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/middlewares/toolCallGuard.test.ts:104
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/middlewares/toolCallGuard.test.ts:138
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/middlewares/toolCallGuard.test.ts:356
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/middlewares/toolCallGuard.test.ts:364
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/middlewares/toolCallGuard.test.ts:374
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/middlewares/toolCallGuard.test.ts:382
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/middlewares/toolCallGuard.test.ts:417
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/middlewares/toolCallGuard.test.ts:434
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/services/__tests__/toolCallGuard.integration.test.ts:62
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/services/__tests__/toolCallGuard.integration.test.ts:77
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/services/__tests__/toolCallGuard.integration.test.ts:87
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/services/__tests__/toolCallGuard.integration.test.ts:101
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf-allowed-cidrs.test.ts:102
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf-allowed-cidrs.test.ts:103
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf-fake-ip.test.ts:40
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf-fake-ip.test.ts:81
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:98
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:148
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:148
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:152
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:178
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:181
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:239
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:247
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:250
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:255
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:260
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:270
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:280
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:289
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:292
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:302
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:309
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:320
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:322
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:328
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:337
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/utils/__tests__/ssrf.test.ts:339
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: curl-auth-header

  2 matches in this file

  docs/api-reference/smart-routing.mdx:46
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: curl-auth-header

  2 matches in this file

  docs/api-reference/system.mdx:95
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: curl-auth-header

  docs/api-reference/tools.mdx:65
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: curl-auth-header

  3 matches in this file

  docs/api-reference/prompts.mdx:73
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: curl-auth-header

  3 matches in this file

  docs/zh/api-reference/prompts.mdx:73
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: curl-auth-header

  2 matches in this file

  docs/zh/api-reference/smart-routing.mdx:40
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: curl-auth-header

  2 matches in this file

  docs/zh/api-reference/system.mdx:95
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: curl-auth-header

  docs/zh/api-reference/tools.mdx:63
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: curl-auth-header

  docs/zh/features/server-management.mdx:52
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: curl-auth-header

  10 matches in this file

  docs/features/group-management.mdx:48
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: curl-auth-header

  docs/zh/configuration/mcp-settings.mdx:576
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: curl-auth-header

  docs/features/server-management.mdx:66
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: curl-auth-header

  8 matches in this file

  docs/zh/essentials/code.mdx:531
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: curl-auth-header

  10 matches in this file

  docs/zh/features/group-management.mdx:48
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  2 matches in this file

  docs/api-reference/auth.mdx:59
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  2 matches in this file

  docs/zh/api-reference/auth.mdx:59
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: curl-auth-header

  docs/configuration/mcp-settings.mdx:637
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: curl-auth-header

  7 matches in this file

  docs/zh/features/smart-routing.mdx:366
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: curl-auth-header

  7 matches in this file

  docs/features/smart-routing.mdx:852
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  tests/fixtures/better-auth-oidc.mts:18
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  tests/docker/replicas/compose.yml:12
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  tests/services/mcpService-per-session-client.test.ts:301
• lowLow. Minor, or common in normal tools. Shown for information.
  @hono/node-server@1.19.17: 1 known vulnerability

  GHSA-rmxm-3fg6-px4f

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  deepmerge@4.3.1: 1 known vulnerability

  GHSA-gcqx-w48m-w2h4

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  fast-uri@3.1.8: 4 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  glob@10.5.0: 1 known vulnerability

  GHSA-3g3m-2fjr-6pw4

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  ip-address@10.7.3: 1 known vulnerability

  GHSA-rxp7-6hxx-x8q5

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@10.2.6: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@9.0.7: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.16.0: 1 known vulnerability

  GHSA-6pq8-jhm2-2vcw

  pnpm-lock.yaml
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)
• lowLow. Minor, or common in normal tools. Shown for information.
  Contacted these domains while starting up (no manifest to compare against)

  registry.npmjs.org

Network activity