Nacos MCP Server
by alibabaan easy-to-use dynamic service discovery, configuration and service management platform for building AI cloud native applications.
Nacos is an open-source mcp server by alibaba, written mainly in Java, with 33,489 GitHub stars and the Apache-2.0 license. Its code was last updated Oct 29, 2026.
Scan summary: scanned Nov 5, 2026 at commit 815779b. No capabilities flagged by our checks. Scan policy
ScannedScanned. The automated checks below ran on the commit shown. Read each line for what was and was not covered.
Full scan at
815779b · Nov 5, 2026 ScannedStatic, secrets and dependency checks completed with no critical findings.
Passed. This check ran and found nothing it flags.Static code scanpassPassed. This check ran and found nothing it flags.
Flagged. This check found an issue. See the findings below.Secrets scanfailFlagged. This check found an issue. See the findings below.
Flagged. This check found an issue. See the findings below.Dependency audit698 known vulnerabilitiesfailFlagged. This check found an issue. See the findings below.
Warning. This check found something worth reading in the findings below. It is not proof of a problem.ManifestnonewarnWarning. This check found something worth reading in the findings below. It is not proof of a problem.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Buildn/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Boot & handshaken/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Network egressn/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Reproducible (×3)n/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Findings (61)
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.com.fasterxml.jackson.core:jackson-core@2.21.2: 72 known vulnerabilitiesGHSA-7hhh-6rmp-j9qf, GHSA-p6pp-m3f8-5c89, GHSA-r7wm-3cxj-wff9, GHSA-7hhh-6rmp-j9qf, GHSA-p6pp-m3f8-5c89 +67 more
api/pom.xml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.com.fasterxml.jackson.core:jackson-databind@2.21.2: 384 known vulnerabilitiesGHSA-3pjw-73gf-8qr5, GHSA-5gvw-p9qm-jgwh, GHSA-5hh8-q8hv-fr38, GHSA-5jmj-h7xm-6q6v, GHSA-9fxm-vc8v-hj55 +379 more
api/pom.xml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.com.google.guava:guava@33.5.0-android: 23 known vulnerabilitiesGHSA-xxph-c9ww-hj94, GHSA-xxph-c9ww-hj94, GHSA-xxph-c9ww-hj94, GHSA-xxph-c9ww-hj94, GHSA-xxph-c9ww-hj94 +18 more
api/pom.xml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.org.apache.httpcomponents.core5:httpcore5@5.3.6: 23 known vulnerabilitiesGHSA-hf6x-8p5f-cgmf, GHSA-hf6x-8p5f-cgmf, GHSA-hf6x-8p5f-cgmf, GHSA-hf6x-8p5f-cgmf, GHSA-hf6x-8p5f-cgmf +18 more
client-basic/pom.xml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.org.apache.httpcomponents.core5:httpcore5-h2@5.3.6: 23 known vulnerabilitiesGHSA-v3jc-474w-2wm6, GHSA-v3jc-474w-2wm6, GHSA-v3jc-474w-2wm6, GHSA-v3jc-474w-2wm6, GHSA-v3jc-474w-2wm6 +18 more
client-basic/pom.xml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.io.micrometer:micrometer-core@1.16.5: 2 known vulnerabilitiesGHSA-g3pr-3p32-fp23, GHSA-w737-wx49-qj23
client/pom.xml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.tools.jackson.core:jackson-core@3.1.2: 3 known vulnerabilitiesGHSA-7hhh-6rmp-j9qf, GHSA-p6pp-m3f8-5c89, GHSA-r7wm-3cxj-wff9
common/pom.xml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.tools.jackson.core:jackson-databind@3.1.2: 15 known vulnerabilitiesGHSA-3pjw-73gf-8qr5, GHSA-5gvw-p9qm-jgwh, GHSA-5hh8-q8hv-fr38, GHSA-5jmj-h7xm-6q6v, GHSA-9fxm-vc8v-hj55 +10 more
common/pom.xml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.follow-redirects@1.16.1: 1 known vulnerabilityGHSA-mrwp-f3q8-3g9p
console-ui-next/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@babel/plugin-transform-modules-systemjs@7.23.0: 1 known vulnerabilityGHSA-fv7c-fp4j-7gwp
console-ui/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.axios@0.21.4: 23 known vulnerabilitiesGHSA-3g43-6gmg-66jw, GHSA-3p68-rc4w-qgx5, GHSA-43fc-jf86-j433, GHSA-5c9x-8gcm-mpgx, GHSA-62hf-57xw-28j9 +18 more
console-ui/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.braces@2.3.2: 1 known vulnerabilityGHSA-grv7-fg5c-xmjg
console-ui/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.decode-uri-component@0.2.2: 2 known vulnerabilitiesGHSA-qr28-fpjm-wq7f, GHSA-vcc3-ghjq-m6fr
console-ui/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.flatted@2.0.2: 2 known vulnerabilitiesGHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh
console-ui/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.html-minifier@3.5.21: 1 known vulnerabilityGHSA-pfq8-rq6v-vf5m
console-ui/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.http-proxy-middleware@0.19.1: 2 known vulnerabilitiesGHSA-64mm-vxmg-q3vj, GHSA-c7qv-q95q-8v27
console-ui/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.ip@1.1.9: 1 known vulnerabilityGHSA-2p57-rm9w-gvfp
console-ui/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.json5@0.5.1: 1 known vulnerabilityGHSA-9c47-m6qq-7p4h
console-ui/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.node-forge@0.10.0: 24 known vulnerabilitiesGHSA-2328-f5f3-gj25, GHSA-2r2c-g63r-vccr, GHSA-4487-j8r4-4g2f, GHSA-4642-5mcj-2rqw, GHSA-525v-9gp9-w22h +19 more
console-ui/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.nth-check@1.0.2: 1 known vulnerabilityGHSA-rp65-9cf3-cjxr
console-ui/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.postcss@7.0.39: 5 known vulnerabilitiesGHSA-6g55-p6wh-862q, GHSA-7fh5-64p2-3v2j, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849
console-ui/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.serialize-javascript@1.9.1: 4 known vulnerabilitiesGHSA-5c6j-r48x-rmvq, GHSA-h9rv-jmmf-4pgx, GHSA-hxcc-f52p-wc94, GHSA-m5mm-p8h7-m29v
console-ui/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.serialize-javascript@4.0.0: 2 known vulnerabilitiesGHSA-5c6j-r48x-rmvq, GHSA-m5mm-p8h7-m29v
console-ui/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.svgo@1.3.2: 3 known vulnerabilitiesGHSA-2p49-hgcm-8545, GHSA-4vpr-x523-8j87, GHSA-w27v-7q3p-w38r
console-ui/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.tmp@0.0.33: 2 known vulnerabilitiesGHSA-52f5-9888-hmc6, GHSA-ph9p-34f9-6g65
console-ui/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.uuid@3.4.0: 1 known vulnerabilityGHSA-w5hq-g745-h8pq
console-ui/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.uuid@8.3.2: 1 known vulnerabilityGHSA-w5hq-g745-h8pq
console-ui/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.webpack-dev-middleware@3.7.3: 2 known vulnerabilitiesGHSA-g84c-rxfj-3j2c, GHSA-wr3j-pwj9-hqq6
console-ui/package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.org.springframework:spring-expression@7.0.7: 3 known vulnerabilitiesGHSA-9f52-rjqv-25qv, GHSA-r5w3-xv2f-j59q, GHSA-wxpp-56q6-5pcg
sys/pom.xml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.io.micrometer:micrometer-core@1.15.11: 2 known vulnerabilitiesGHSA-g3pr-3p32-fp23, GHSA-w737-wx49-qj23
test/java-sdk-test/src/test/compatibility/pom.xml - lowLow. Minor, or common in normal tools. Shown for information.In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
console-ui-next/src/pages/mcpServerDetail/__tests__/mcp-client-config.test.ts:46 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
console-ui-next/src/pages/newAgent/__tests__/agent-console-model.test.ts:372 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: private-key
core/src/test/resources/test-server-key.pem:1 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
specs/en/ai/ard-v091-adaptation-spec.md:469 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
specs/en/testing/java-sdk-integration-test-spec.md:234 - lowLow. Minor, or common in normal tools. Shown for information.org.springframework:spring-core@7.0.7: 2 known vulnerabilitiesGHSA-659m-px2c-25wj, GHSA-659m-px2c-25wj
api/pom.xml - lowLow. Minor, or common in normal tools. Shown for information.org.apache.httpcomponents.client5:httpclient5@5.5.2: 23 known vulnerabilitiesGHSA-hjcp-jmpx-g3qm, GHSA-hjcp-jmpx-g3qm, GHSA-hjcp-jmpx-g3qm, GHSA-hjcp-jmpx-g3qm, GHSA-hjcp-jmpx-g3qm +18 more
client-basic/pom.xml - lowLow. Minor, or common in normal tools. Shown for information.@vitest/mocker@4.1.11: 2 known vulnerabilitiesGHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp
console-ui-next/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.minimatch@10.2.4: 1 known vulnerabilityGHSA-g3hv-75wg-m249
console-ui-next/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.postcss-selector-parser@6.0.10: 1 known vulnerabilityGHSA-rj75-hqrm-r3gf
console-ui-next/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.qs@6.16.0: 2 known vulnerabilitiesGHSA-6pq8-jhm2-2vcw, GHSA-6pq8-jhm2-2vcw
console-ui-next/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@babel/core@7.23.0: 1 known vulnerabilityGHSA-4x5r-pxfx-6jf8
console-ui/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@babel/core@7.9.0: 1 known vulnerabilityGHSA-4x5r-pxfx-6jf8
console-ui/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@babel/runtime@7.9.0: 1 known vulnerabilityGHSA-968p-4wvh-cqc8
console-ui/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.elliptic@6.6.1: 1 known vulnerabilityGHSA-848j-6mx2-7j84
console-ui/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.micromatch@3.1.10: 1 known vulnerabilityGHSA-952p-6rrq-rcjv
console-ui/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.postcss-selector-parser@3.1.2: 1 known vulnerabilityGHSA-rj75-hqrm-r3gf
console-ui/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.qs@6.14.2: 4 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-q8mj-m7cp-5q26, GHSA-x5fp-wj9c-mxmx
console-ui/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.webpack-dev-server@3.11.3: 6 known vulnerabilitiesGHSA-4v9v-hfq4-rm2v, GHSA-79cf-xcqc-c78w, GHSA-9jgg-88mc-972h, GHSA-f5vj-f2hx-8m93, GHSA-m28w-2pqf-7qgj +1 more
console-ui/package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.ch.qos.logback:logback-core@1.2.13: 6 known vulnerabilitiesGHSA-25qh-j22f-pwp8, GHSA-6v67-2wr5-gvf4, GHSA-jhq6-gfmj-v8fx, GHSA-p47f-322f-whfh, GHSA-pr98-23f8-jwxv +1 more
logger-adapter-impl/logback-adapter-12/pom.xml - lowLow. Minor, or common in normal tools. Shown for information.ch.qos.logback:logback-core@1.5.32: 6 known vulnerabilitiesGHSA-jhq6-gfmj-v8fx, GHSA-p47f-322f-whfh, GHSA-jhq6-gfmj-v8fx, GHSA-p47f-322f-whfh, GHSA-jhq6-gfmj-v8fx +1 more
naming/pom.xml - lowLow. Minor, or common in normal tools. Shown for information.org.springframework.boot:spring-boot-autoconfigure@4.0.6: 1 known vulnerabilityGHSA-ggg2-9786-hwc8
sys/pom.xml - lowLow. Minor, or common in normal tools. Shown for information.No manifest declaring network access and environment variables (agent.json)
Automated result for the commit shown. See our scan policy. View the scan log
Maintainers can claim the listing to rescan, or dispute a result.
Nacos alternatives
View more →Similar mcp servers in Cloud Infrastructure, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.
| Name | Stars | Licence | Last updated | Scan |
|---|---|---|---|---|
| Nacos (this page) alibaba | 33k | Apache-2.0 | Oct 29, 2026 | Scanned, no flagged issues |
| TREK liketrek | 15k | AGPL-3.0 | Nov 1, 2026 | Scanned, no flagged issues |
| MCP awslabs | 9.9k | Apache-2.0 | Oct 31, 2026 | Scanned, no flagged issues |
| MCP Context Forge IBM | 4.7k | Apache-2.0 | Oct 30, 2026 | Scanned, no flagged issues |
| Mcpo open-webui | 4.4k | MIT | May 17, 2026 | Scanned, no flagged issues |
| Lean Ctx yvgude | 3.9k | Apache-2.0 | Oct 31, 2026 | Scanned, no flagged issues |