Note Gen MCP Server

by codexu• 13k•• Scanned•Claim this listing•Request removal
Content & Writingagentai notesknowledge baseknowledge managementllm

Capture first. Organize later. A local-first Markdown app that turns scattered records into clear notes with AI.

Note Gen is an open-source mcp server by codexu, written mainly in TypeScript, with 12,963 GitHub stars and the GPL-3.0 license. Its code was last updated Nov 1, 2026.

Scan summary: scanned Nov 5, 2026 at commit ef932ee. Seen able to read environment and secrets, connect to the internet. Scan policy

Scanned
Full scan at ef932ee · Nov 5, 2026
Scanned
Static code scanwarn
Secrets scanfail
Dependency audit305 known vulnerabilitiesfail
Manifestnonewarn
Buildfail
Boot & handshaken/a
Network egresswarn
Reproducible (×3)n/a

Findings (101)

  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • medium
    @modelcontextprotocol/sdk@1.29.0: 6 known vulnerabilities
    GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more
    pnpm-lock.yaml
  • medium
    @tiptap/core@3.19.0: 2 known vulnerabilities
    GHSA-cp6q-959q-f8rh, GHSA-j95f-988m-3j2f
    pnpm-lock.yaml
  • medium
    body-parser@2.3.0: 1 known vulnerability
    GHSA-27r3-jxmh-p828
    pnpm-lock.yaml
  • medium
    brace-expansion@1.1.12: 7 known vulnerabilities
    GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +2 more
    pnpm-lock.yaml
  • medium
    brace-expansion@2.0.2: 7 known vulnerabilities
    GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +2 more
    pnpm-lock.yaml
  • medium
    brace-expansion@5.0.7: 5 known vulnerabilities
    GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-rgw5-rvv9-x895
    pnpm-lock.yaml
  • medium
    browserslist@4.28.6: 2 known vulnerabilities
    GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
    pnpm-lock.yaml
  • medium
    decode-uri-component@0.2.2: 2 known vulnerabilities
    GHSA-qr28-fpjm-wq7f, GHSA-vcc3-ghjq-m6fr
    pnpm-lock.yaml
  • medium
    dompurify@3.3.1: 21 known vulnerabilities
    GHSA-39q2-94rc-95cp, GHSA-55q2-fjhq-7xh7, GHSA-6688-9rhm-gjv2, GHSA-76mc-f452-cxcm, GHSA-c2j3-45gr-mqc4 +16 more
    pnpm-lock.yaml
  • medium
    fast-uri@3.1.3: 12 known vulnerabilities
    GHSA-333x-w4r6-6crp, GHSA-5jgf-p345-68v8, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf +7 more
    pnpm-lock.yaml
  • medium
    flatted@3.3.3: 2 known vulnerabilities
    GHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh
    pnpm-lock.yaml
  • medium
    form-data@4.0.4: 1 known vulnerability
    GHSA-hmw2-7cc7-3qxx
    pnpm-lock.yaml
  • medium
    ip-address@10.2.0: 8 known vulnerabilities
    GHSA-22jq-vg5j-6vgg, GHSA-2vr4-cq9g-pvrc, GHSA-4xrf-jv44-h6hh, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv +3 more
    pnpm-lock.yaml
  • medium
    js-cookie@2.2.1: 1 known vulnerability
    GHSA-qjx8-664m-686j
    pnpm-lock.yaml
  • medium
    js-yaml@4.1.0: 5 known vulnerabilities
    GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m
    pnpm-lock.yaml
  • medium
    linkify-it@5.0.0: 2 known vulnerabilities
    GHSA-22p9-wv53-3rq4, GHSA-v245-v573-v5vm
    pnpm-lock.yaml
  • medium
    lodash@4.17.21: 2 known vulnerabilities
    GHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg
    pnpm-lock.yaml
  • medium
    lodash-es@4.17.21: 2 known vulnerabilities
    GHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg
    pnpm-lock.yaml
  • medium
    markdown-it@14.1.0: 6 known vulnerabilities
    GHSA-253c-mchw-3w2r, GHSA-38c4-r59v-3vqw, GHSA-6v5v-wf23-fmfq, GHSA-gfr2-rv44-r23c, GHSA-r7fv-28h4-cvq7 +1 more
    pnpm-lock.yaml
  • medium
    minimatch@3.1.2: 3 known vulnerabilities
    GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj
    pnpm-lock.yaml
  • medium
    minimatch@9.0.5: 4 known vulnerabilities
    GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-g3hv-75wg-m249
    pnpm-lock.yaml
  • medium
    nanoid@3.3.11: 3 known vulnerabilities
    GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w
    pnpm-lock.yaml
  • medium
    nanoid@3.3.16: 1 known vulnerability
    GHSA-2v37-7h3g-55p8
    pnpm-lock.yaml
  • medium
    picomatch@2.3.1: 2 known vulnerabilities
    GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
    pnpm-lock.yaml
  • medium
    picomatch@4.0.3: 2 known vulnerabilities
    GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
    pnpm-lock.yaml
  • medium
    postcss@8.4.31: 4 known vulnerabilities
    GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849
    pnpm-lock.yaml
  • medium
    postcss@8.5.6: 4 known vulnerabilities
    GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849
    pnpm-lock.yaml
  • medium
    prosemirror-view@1.41.5: 1 known vulnerability
    GHSA-c8x8-7fp4-3x9w
    pnpm-lock.yaml
  • medium
    sharp@0.34.3: 3 known vulnerabilities
    GHSA-f88m-g3jw-g9cj, GHSA-rgj7-g3m4-5g8c, GHSA-wq5f-xc86-pv6w
    pnpm-lock.yaml
  • medium
    source-map-js@1.2.1: 1 known vulnerability
    GHSA-68fv-2mgg-jv7q
    pnpm-lock.yaml
  • medium
    systeminformation@5.31.17: 3 known vulnerabilities
    GHSA-3f7j-7jwc-fxfj, GHSA-4vjg-vx72-qq4g, GHSA-7648-jmwf-vw7j
    pnpm-lock.yaml
  • medium
    undici@7.28.0: 23 known vulnerabilities
    GHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-3xpg-4rpp-hhhm +18 more
    pnpm-lock.yaml
  • medium
    uuid@11.1.0: 1 known vulnerability
    GHSA-w5hq-g745-h8pq
    pnpm-lock.yaml
  • medium
    valibot@0.40.0: 2 known vulnerabilities
    GHSA-5qjj-4xww-7phc, GHSA-vqpr-j7v3-hqw9
    pnpm-lock.yaml
  • medium
    zod@3.25.76: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    pnpm-lock.yaml
  • medium
    zod@4.3.6: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    pnpm-lock.yaml
  • medium
    calamine@0.36.1: 1 known vulnerability
    RUSTSEC-2026-0436
    src-tauri/Cargo.lock
  • medium
    openssl@0.10.73: 8 known vulnerabilities
    GHSA-8c75-8mhr-p7r9, GHSA-ghm9-cr32-g9qj, GHSA-hppc-g8h3-xhp3, GHSA-phqj-4mhp-q6mq, GHSA-pqf5-4pqq-29f5 +3 more
    src-tauri/Cargo.lock
  • medium
    quick-xml@0.30.0: 2 known vulnerabilities
    RUSTSEC-2026-0194, RUSTSEC-2026-0195
    src-tauri/Cargo.lock
  • medium
    quick-xml@0.37.5: 2 known vulnerabilities
    RUSTSEC-2026-0194, RUSTSEC-2026-0195
    src-tauri/Cargo.lock
  • medium
    quick-xml@0.38.0: 2 known vulnerabilities
    RUSTSEC-2026-0194, RUSTSEC-2026-0195
    src-tauri/Cargo.lock
  • medium
    quinn-proto@0.11.12: 6 known vulnerabilities
    RUSTSEC-2026-0037, RUSTSEC-2026-0185, RUSTSEC-2026-0338, RUSTSEC-2026-0339, RUSTSEC-2026-0340 +1 more
    src-tauri/Cargo.lock
  • medium
    rustls-webpki@0.103.4: 5 known vulnerabilities
    RUSTSEC-2026-0049, RUSTSEC-2026-0098, RUSTSEC-2026-0099, RUSTSEC-2026-0104, RUSTSEC-2026-0382
    src-tauri/Cargo.lock
  • medium
    tar@0.4.44: 3 known vulnerabilities
    RUSTSEC-2026-0067, RUSTSEC-2026-0068, GHSA-3pv8-6f4r-ffg2
    src-tauri/Cargo.lock
  • medium
    Install or build failed in a clean environment
    ss 1.4.0 + typescript 5.8.3 Error: ERR_PNPM_IGNORED_BUILDS × installing dependencies ╰─▶ Ignored build scripts: @parcel/watcher@2.5.6, esbuild@0.28.2, sharp@0.34.3, unrs-resolver@1.11.1 help: Run "pnpm approve-builds" to pick which dependencies should be allowed to run scripts.
  • medium
    Install contacted hosts other than package registries
    34.5.16.104.in-addr.arpa
  • low
    @hono/node-server@1.19.14: 2 known vulnerabilities
    GHSA-frvp-7c67-39w9, GHSA-rmxm-3fg6-px4f
    pnpm-lock.yaml
  • low
    ajv@6.12.6: 1 known vulnerability
    GHSA-2g4f-4pwh-qvx6
    pnpm-lock.yaml
  • low
    baseline-browser-mapping@2.10.43: 1 known vulnerability
    GHSA-w5vr-8v7q-w6rv
    pnpm-lock.yaml
  • low
    deepmerge@4.3.1: 1 known vulnerability
    GHSA-gcqx-w48m-w2h4
    pnpm-lock.yaml
  • low
    hono@4.12.30: 9 known vulnerabilities
    GHSA-54fx-42gc-7vw4, GHSA-5r4p-p66f-jhc7, GHSA-79qm-7rj5-m7r9, GHSA-8j4g-w8fx-2239, GHSA-crvj-82cr-hjcx +4 more
    pnpm-lock.yaml
  • low
    katex@0.16.28: 1 known vulnerability
    GHSA-238p-pmpm-9mq7
    pnpm-lock.yaml
  • low
    mermaid@11.12.2: 9 known vulnerabilities
    GHSA-2v8p-3f2j-5mp7, GHSA-3rrr-jr9j-h3q3, GHSA-6m6c-36f7-fhxh, GHSA-6x64-9x62-f2gx, GHSA-87f9-hvmw-gh4p +4 more
    pnpm-lock.yaml
  • low
    minimatch@10.2.5: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    pnpm-lock.yaml
  • low
    next-intl@3.26.5: 2 known vulnerabilities
    GHSA-4c35-wcg5-mm9h, GHSA-8f24-v5vv-gm5j
    pnpm-lock.yaml
  • low
    postcss@8.5.19: 1 known vulnerability
    GHSA-fxqj-rqcc-2cmp
    pnpm-lock.yaml
  • low
    postcss-selector-parser@7.1.4: 1 known vulnerability
    GHSA-rj75-hqrm-r3gf
    pnpm-lock.yaml
  • low
    qs@6.15.3: 3 known vulnerabilities
    GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-x5fp-wj9c-mxmx
    pnpm-lock.yaml
  • low
    yaml@2.8.0: 1 known vulnerability
    GHSA-48c2-rrv3-qjmp
    pnpm-lock.yaml
  • low
    anyhow@1.0.98: 1 known vulnerability
    RUSTSEC-2026-0190
    src-tauri/Cargo.lock
  • low
    bytes@1.10.1: 1 known vulnerability
    RUSTSEC-2026-0007
    src-tauri/Cargo.lock
  • low
    crossbeam-epoch@0.9.18: 1 known vulnerability
    RUSTSEC-2026-0204
    src-tauri/Cargo.lock
  • low
    event-listener@5.4.0: 1 known vulnerability
    RUSTSEC-2026-0221
    src-tauri/Cargo.lock
  • low
    fxhash@0.2.1: 1 known vulnerability
    RUSTSEC-2025-0057
    src-tauri/Cargo.lock
  • low
    glib@0.18.5: 1 known vulnerability
    RUSTSEC-2024-0429
    src-tauri/Cargo.lock
  • low
    h2@0.4.11: 1 known vulnerability
    RUSTSEC-2026-0258
    src-tauri/Cargo.lock
  • low
    memmap2@0.9.7: 1 known vulnerability
    RUSTSEC-2026-0186
    src-tauri/Cargo.lock
  • low
    pin-utils@0.1.0: 1 known vulnerability
    RUSTSEC-2026-0441
    src-tauri/Cargo.lock
  • low
    proc-macro-error@1.0.4: 1 known vulnerability
    RUSTSEC-2024-0370
    src-tauri/Cargo.lock
  • low
    rand@0.7.3: 1 known vulnerability
    RUSTSEC-2026-0097
    src-tauri/Cargo.lock
  • low
    rand@0.8.5: 1 known vulnerability
    RUSTSEC-2026-0097
    src-tauri/Cargo.lock
  • low
    rand@0.9.1: 1 known vulnerability
    RUSTSEC-2026-0097
    src-tauri/Cargo.lock
  • low
    rsa@0.9.8: 2 known vulnerabilities
    RUSTSEC-2023-0071, GHSA-9c48-w39g-hm26
    src-tauri/Cargo.lock
  • low
    rustls@0.23.29: 4 known vulnerabilities
    RUSTSEC-2026-0285, RUSTSEC-2026-0346, RUSTSEC-2026-0348, RUSTSEC-2026-0349
    src-tauri/Cargo.lock
  • low
    serde_with@3.14.0: 1 known vulnerability
    GHSA-7gcf-g7xr-8hxj
    src-tauri/Cargo.lock
  • low
    slab@0.4.10: 1 known vulnerability
    RUSTSEC-2025-0047
    src-tauri/Cargo.lock
  • low
    time@0.3.41: 1 known vulnerability
    RUSTSEC-2026-0009
    src-tauri/Cargo.lock
  • low
    tokio@1.46.1: 1 known vulnerability
    RUSTSEC-2026-0386
    src-tauri/Cargo.lock
  • low
    ttf-parser@0.25.1: 1 known vulnerability
    RUSTSEC-2026-0192
    src-tauri/Cargo.lock
  • low
    unic-char-property@0.9.0: 1 known vulnerability
    RUSTSEC-2025-0081
    src-tauri/Cargo.lock
  • low
    unic-char-range@0.9.0: 1 known vulnerability
    RUSTSEC-2025-0075
    src-tauri/Cargo.lock
  • low
    unic-common@0.9.0: 1 known vulnerability
    RUSTSEC-2025-0080
    src-tauri/Cargo.lock
  • low
    unic-ucd-ident@0.9.0: 1 known vulnerability
    RUSTSEC-2025-0100
    src-tauri/Cargo.lock
  • low
    unic-ucd-version@0.9.0: 1 known vulnerability
    RUSTSEC-2025-0098
    src-tauri/Cargo.lock
  • low
    unsafe-libyaml@0.2.11: 1 known vulnerability
    RUSTSEC-2024-0449
    src-tauri/Cargo.lock
  • low
    webpki-roots@1.0.1: 1 known vulnerability
    RUSTSEC-2026-0381
    src-tauri/Cargo.lock
  • low
    xcb@1.5.0: 1 known vulnerability
    RUSTSEC-2025-0051
    src-tauri/Cargo.lock
  • low
    zbus_names@3.0.0: 1 known vulnerability
    RUSTSEC-2026-0371
    src-tauri/Cargo.lock
  • low
    zbus_names@4.2.0: 1 known vulnerability
    RUSTSEC-2026-0371
    src-tauri/Cargo.lock
  • low
    zvariant@4.2.0: 1 known vulnerability
    RUSTSEC-2026-0370
    src-tauri/Cargo.lock
  • low
    zvariant@5.6.0: 1 known vulnerability
    RUSTSEC-2026-0370
    src-tauri/Cargo.lock
  • low
    zvariant_derive@4.2.0: 1 known vulnerability
    RUSTSEC-2026-0372
    src-tauri/Cargo.lock
  • low
    zvariant_derive@5.6.0: 1 known vulnerability
    RUSTSEC-2026-0372
    src-tauri/Cargo.lock
  • low
    No manifest declaring network access and environment variables (agent.json)

Network activity

During install
34.5.16.104.in-addr.arparegistry.npmjs.org
While running
Not run — the code wasn't started in this scan

Automated result for the commit shown. See our scan policy. View the scan log

Maintainers can claim the listing to rescan, or dispute a result.

Note Gen alternatives

View more →

Similar mcp servers in Content & Writing, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

NameStarsLicenceLast updatedScan
Note Gen (this page)
codexu
13kGPL-3.0Nov 1, 2026Scanned, no flagged issues
Context7
upstash
64kMITNov 1, 2026Scanned, no flagged issues
Md2wechat Skill
geekjourneyx
3.8kNone foundOct 14, 2026Not scanned yet
Cortex
cortex-docs
3.3kMITOct 6, 2026Scanned, no flagged issues
Markdownify MCP
zcaceres
3kMITOct 26, 2026Scanned, no flagged issues
LLM Wiki Compiler
atomicstrata
2.2kMITOct 30, 2026Scanned, no flagged issues