Onecli MCP Server

by onecli• 3.6k•• Scanned•Claim this listing•Request removal
Developer Toolsai agentsclimcpnodejspostgres

Open-source sandboxed agent harness for teams. Giving every employee a secured personal agent.

Onecli is an open-source mcp server by onecli, written mainly in TypeScript, with 3,612 GitHub stars and the Apache-2.0 license. Its code was last updated Oct 31, 2026.

Scan summary: scanned Nov 5, 2026 at commit afb4a19. Seen able to read environment and secrets, connect to the internet. Scan policy

aboutREADMEsecurityreviews
Scanned
Full scan at afb4a19 · Nov 5, 2026
Scanned
Static code scanwarn
Secrets scanfail
Dependency audit230 known vulnerabilitiesfail
Manifestnonewarn
Buildfail
Boot & handshaken/a
Network egresswarn
Reproducible (×3)n/a

Findings (161)

  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    exfiltration issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • medium
    Turns off TLS certificate checking, allowing traffic interception.
    apps/gateway-e2e/src/pg-wire.ts:190
  • medium
    aws-smithy-json@0.62.5: 1 known vulnerability
    GHSA-8ffr-xgwf-xj56
    apps/gateway/Cargo.lock
  • medium
    cache@0.0.0: 2 known vulnerabilities
    RUSTSEC-2020-0128, RUSTSEC-2021-0006
    apps/gateway/Cargo.lock
  • medium
    quinn-proto@0.11.14: 5 known vulnerabilities
    RUSTSEC-2026-0185, RUSTSEC-2026-0338, RUSTSEC-2026-0339, RUSTSEC-2026-0340, RUSTSEC-2026-0342
    apps/gateway/Cargo.lock
  • medium
    rustls-webpki@0.101.7: 4 known vulnerabilities
    RUSTSEC-2026-0098, RUSTSEC-2026-0099, RUSTSEC-2026-0104, RUSTSEC-2026-0382
    apps/gateway/Cargo.lock
  • medium
    @modelcontextprotocol/sdk@1.30.0: 6 known vulnerabilities
    GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more
    pnpm-lock.yaml
  • medium
    body-parser@2.3.0: 1 known vulnerability
    GHSA-27r3-jxmh-p828
    pnpm-lock.yaml
  • medium
    brace-expansion@1.1.12: 7 known vulnerabilities
    GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +2 more
    pnpm-lock.yaml
  • medium
    brace-expansion@5.0.3: 8 known vulnerabilities
    GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-jxxr-4gwj-5jf2, GHSA-mh99-v99m-4gvg +3 more
    pnpm-lock.yaml
  • medium
    browserslist@4.28.1: 2 known vulnerabilities
    GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
    pnpm-lock.yaml
  • medium
    deepmerge-ts@7.1.5: 1 known vulnerability
    GHSA-ggr8-5vv4-36mx
    pnpm-lock.yaml
  • medium
    defu@6.1.4: 1 known vulnerability
    GHSA-737v-mqg7-c878
    pnpm-lock.yaml
  • medium
    dompurify@3.3.3: 17 known vulnerabilities
    GHSA-39q2-94rc-95cp, GHSA-55q2-fjhq-7xh7, GHSA-6688-9rhm-gjv2, GHSA-76mc-f452-cxcm, GHSA-c2j3-45gr-mqc4 +12 more
    pnpm-lock.yaml
  • medium
    effect@3.18.4: 1 known vulnerability
    GHSA-38f7-945m-qr2g
    pnpm-lock.yaml
  • medium
    fast-uri@3.1.5: 10 known vulnerabilities
    GHSA-333x-w4r6-6crp, GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-hrr3-gc8f-f4qj +5 more
    pnpm-lock.yaml
  • medium
    fast-xml-builder@1.0.0: 1 known vulnerability
    GHSA-5wm8-gmm8-39j9
    pnpm-lock.yaml
  • medium
    fast-xml-builder@1.1.4: 1 known vulnerability
    GHSA-5wm8-gmm8-39j9
    pnpm-lock.yaml
  • medium
    fast-xml-builder@1.1.5: 2 known vulnerabilities
    GHSA-45c6-75p6-83cc, GHSA-5wm8-gmm8-39j9
    pnpm-lock.yaml
  • medium
    fast-xml-parser@5.4.1: 3 known vulnerabilities
    GHSA-8gc5-j5rx-235r, GHSA-gh4j-gqv2-49f6, GHSA-jp2q-39xq-3w4g
    pnpm-lock.yaml
  • medium
    fflate@0.4.8: 1 known vulnerability
    GHSA-px8p-9vwx-vf98
    pnpm-lock.yaml
  • medium
    flatted@3.3.3: 2 known vulnerabilities
    GHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh
    pnpm-lock.yaml
  • medium
    hono@4.12.18: 21 known vulnerabilities
    GHSA-2gcr-mfcq-wcc3, GHSA-3hrh-pfw6-9m5x, GHSA-54fx-42gc-7vw4, GHSA-5r4p-p66f-jhc7, GHSA-79qm-7rj5-m7r9 +16 more
    pnpm-lock.yaml
  • medium
    js-cookie@3.0.5: 1 known vulnerability
    GHSA-qjx8-664m-686j
    pnpm-lock.yaml
  • medium
    js-yaml@4.1.1: 4 known vulnerabilities
    GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68
    pnpm-lock.yaml
  • medium
    lodash@4.17.23: 2 known vulnerabilities
    GHSA-f23m-r3pf-42rh, GHSA-r5fr-rjxr-66jc
    pnpm-lock.yaml
  • medium
    nanoid@3.3.11: 3 known vulnerabilities
    GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w
    pnpm-lock.yaml
  • medium
    nanoid@5.1.9: 2 known vulnerabilities
    GHSA-28wg-ghj8-5hjv, GHSA-xwg4-73v4-xw9w
    pnpm-lock.yaml
  • medium
    picomatch@2.3.1: 2 known vulnerabilities
    GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
    pnpm-lock.yaml
  • medium
    picomatch@4.0.3: 2 known vulnerabilities
    GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
    pnpm-lock.yaml
  • medium
    postcss@8.5.6: 4 known vulnerabilities
    GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849
    pnpm-lock.yaml
  • medium
    source-map-js@1.2.1: 1 known vulnerability
    GHSA-68fv-2mgg-jv7q
    pnpm-lock.yaml
  • medium
    undici@8.10.0: 19 known vulnerabilities
    GHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-3xpg-4rpp-hhhm +14 more
    pnpm-lock.yaml
  • medium
    undici@8.5.0: 23 known vulnerabilities
    GHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-3xpg-4rpp-hhhm +18 more
    pnpm-lock.yaml
  • medium
    uuid@11.1.0: 1 known vulnerability
    GHSA-w5hq-g745-h8pq
    pnpm-lock.yaml
  • medium
    vite@7.3.6: 5 known vulnerabilities
    GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22
    pnpm-lock.yaml
  • medium
    zod@4.3.6: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    pnpm-lock.yaml
  • medium
    Install or build failed in a clean environment
    xited (1) @onecli/gateway#build: command (/w/apps/gateway) /tmp/home/bin/pnpm run build exited (1) Tasks: 0 successful, 7 total Cached: 0 cached, 7 total Time: 1.696s Failed: @onecli/gateway#build ERROR run failed: command exited (1)  ELIFECYCLE  Command failed with exit code 1.
  • medium
    Install contacted hosts other than package registries
    binaries.prisma.sh, telemetry.vercel.com
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    apps/sandbox-supervisor/src/browser-driver/site.test.ts:45
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    apps/web/src/lib/dashboard/sidebar-version.onprem.test.tsx:142
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    apps/web/src/lib/dashboard/sidebar-version.onprem.test.tsx:156
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    apps/web/src/lib/install-command.test.ts:24
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    apps/web/src/lib/install-command.test.ts:30
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    apps/web/src/lib/install-command.test.ts:41
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    apps/web/src/lib/install-command.test.ts:55
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    apps/web/src/lib/ssh-connect-command.test.ts:16
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    apps/web/src/lib/ssh-connect-command.test.ts:49
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/lib/better-auth.test.ts:194
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/lib/better-auth.test.ts:198
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/lib/cors-contract.test.ts:135
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/lib/cors-contract.test.ts:136
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/lib/public-origins.test.ts:50
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/lib/public-origins.test.ts:55
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/lib/public-origins.test.ts:56
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/lib/public-origins.test.ts:57
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/lib/public-origins.test.ts:272
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/lib/public-origins.test.ts:296
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/lib/public-origins.test.ts:298
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/lib/public-origins.test.ts:303
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/lib/public-origins.test.ts:461
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/lib/public-origins.test.ts:462
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/lib/public-origins.test.ts:539
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/lib/public-origins.test.ts:540
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/lib/public-origins.test.ts:545
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/routes/apps-oauth-redirect-uri.test.ts:225
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/routes/apps-oauth-redirect-uri.test.ts:230
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/routes/channel-routes.test.ts:2065
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/routes/cli-auth.test.ts:93
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/routes/cli-auth.test.ts:94
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/routes/cli-auth.test.ts:99
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/routes/cli-auth.test.ts:114
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/api/src/services/channels/channels.pg.test.ts:5617
  • low
    In tests/examples/docs: Sends data to a paste site, webhook catcher or chat webhook — common exfiltration channels.
    packages/api/src/services/custom-connection-policy.test.ts:96
  • low
    In tests/examples/docs: Sends data to a paste site, webhook catcher or chat webhook — common exfiltration channels.
    packages/api/src/services/custom-connection-policy.test.ts:99
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/channels/src/slack/app-icon.test.ts:24
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    scripts/install-sh.test.mjs:147
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    scripts/install-sh.test.mjs:484
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    scripts/setup/steps.test.mjs:104
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    scripts/setup/steps.test.mjs:109
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    scripts/setup/steps.test.mjs:110
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    scripts/setup/steps.test.mjs:111
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    apps/gateway-e2e/tests/grants.test.ts:7
  • low
    Possible example credential in docs/tests: generic-api-key
    apps/web/src/proxy.form-forward.onprem.test.ts:95
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    packages/api/src/apps/stripe.test.ts:21
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    packages/api/src/apps/navan.test.ts:62
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/api/src/ee/attachments/s3-blob-store.test.ts:194
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    packages/api/src/ee/kms-envelope.fixture.json:3
  • low
    Possible example credential in docs/tests: private-key
    packages/api/src/routes/instance-ssh.test.ts:20
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/api/src/services/channels/providers/slack/signature.test.ts:13
  • low
    Possible example credential in docs/tests: private-key
    3 matches in this file
    scripts/install-sh.test.mjs:507
  • low
    anyhow@1.0.102: 1 known vulnerability
    RUSTSEC-2026-0190
    apps/gateway/Cargo.lock
  • low
    block-buffer@0.12.0: 1 known vulnerability
    GHSA-qwgh-2vcv-g2f7
    apps/gateway/Cargo.lock
  • low
    event-listener@5.4.1: 1 known vulnerability
    RUSTSEC-2026-0221
    apps/gateway/Cargo.lock
  • low
    h2@0.3.27: 1 known vulnerability
    RUSTSEC-2026-0258
    apps/gateway/Cargo.lock
  • low
    h2@0.4.13: 1 known vulnerability
    RUSTSEC-2026-0258
    apps/gateway/Cargo.lock
  • low
    jsonwebtoken@9.3.1: 1 known vulnerability
    GHSA-h395-gr6q-cpjc
    apps/gateway/Cargo.lock
  • low
    pin-utils@0.1.0: 1 known vulnerability
    RUSTSEC-2026-0441
    apps/gateway/Cargo.lock
  • low
    rand@0.8.5: 1 known vulnerability
    RUSTSEC-2026-0097
    apps/gateway/Cargo.lock
  • low
    rand@0.9.2: 1 known vulnerability
    RUSTSEC-2026-0097
    apps/gateway/Cargo.lock
  • low
    rsa@0.9.10: 1 known vulnerability
    RUSTSEC-2023-0071
    apps/gateway/Cargo.lock
  • low
    rustls@0.21.12: 3 known vulnerabilities
    RUSTSEC-2026-0346, RUSTSEC-2026-0349, GHSA-h2v8-394m-p7vv
    apps/gateway/Cargo.lock
  • low
    rustls-pemfile@2.2.0: 1 known vulnerability
    RUSTSEC-2025-0134
    apps/gateway/Cargo.lock
  • low
    tokio@1.50.0: 1 known vulnerability
    RUSTSEC-2026-0386
    apps/gateway/Cargo.lock
  • low
    xxhash-rust@0.8.15: 1 known vulnerability
    GHSA-6g2r-675j-hx59
    apps/gateway/Cargo.lock
  • low
    @babel/core@7.29.0: 1 known vulnerability
    GHSA-4x5r-pxfx-6jf8
    pnpm-lock.yaml
  • low
    @better-auth/drizzle-adapter@1.6.26: 1 known vulnerability
    GHSA-44jh-23m7-hpcf
    pnpm-lock.yaml
  • low
    @better-auth/kysely-adapter@1.6.26: 1 known vulnerability
    GHSA-44jh-23m7-hpcf
    pnpm-lock.yaml
  • low
    @hono/node-server@1.19.17: 1 known vulnerability
    GHSA-rmxm-3fg6-px4f
    pnpm-lock.yaml
  • low
    @humanfs/node@0.16.7: 1 known vulnerability
    GHSA-p498-v437-472g
    pnpm-lock.yaml
  • low
    @opentelemetry/core@2.2.0: 1 known vulnerability
    GHSA-8988-4f7v-96qf
    pnpm-lock.yaml
  • low
    @opentelemetry/core@2.6.1: 1 known vulnerability
    GHSA-8988-4f7v-96qf
    pnpm-lock.yaml
  • low
    @protobufjs/utf8@1.1.0: 1 known vulnerability
    GHSA-q6x5-8v7m-xcrf
    pnpm-lock.yaml
  • low
    @vitest/mocker@3.2.6: 2 known vulnerabilities
    GHSA-82fw-gwwq-j7x9, GHSA-qxg6-89mg-rqv8
    pnpm-lock.yaml
  • low
    baseline-browser-mapping@2.10.0: 1 known vulnerability
    GHSA-w5vr-8v7q-w6rv
    pnpm-lock.yaml
  • low
    fast-copy@4.0.2: 1 known vulnerability
    GHSA-jggr-w7fw-pc2j
    pnpm-lock.yaml
  • low
    fast-xml-parser@5.5.8: 1 known vulnerability
    GHSA-gh4j-gqv2-49f6
    pnpm-lock.yaml
  • low
    ip-address@10.5.0: 5 known vulnerabilities
    GHSA-2vr4-cq9g-pvrc, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5
    pnpm-lock.yaml
  • low
    js-yaml@5.4.0: 1 known vulnerability
    GHSA-r3ph-w7gj-g6xm
    pnpm-lock.yaml
  • low
    minimatch@10.2.4: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    pnpm-lock.yaml
  • low
    qs@6.15.3: 3 known vulnerabilities
    GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-x5fp-wj9c-mxmx
    pnpm-lock.yaml
  • low
    vitest@3.2.6: 1 known vulnerability
    GHSA-82fw-gwwq-j7x9
    pnpm-lock.yaml
  • low
    yaml@2.8.2: 1 known vulnerability
    GHSA-48c2-rrv3-qjmp
    pnpm-lock.yaml
  • low
    package.json has a prepare script
    husky
    package.json
  • low
    No manifest declaring network access and environment variables (agent.json)

Network activity

During install
binaries.prisma.shnodejs.orgregistry.npmjs.orgtelemetry.vercel.com
While running
Not run — the code wasn't started in this scan

Automated result for the commit shown. See our scan policy. View the scan log

Maintainers can claim the listing to rescan, or dispute a result.

Onecli alternatives

View more →

Similar mcp servers in Developer Tools, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

NameStarsLicenceLast updatedScan
Onecli (this page)
onecli
3.6kApache-2.0Oct 31, 2026Scanned, no flagged issues
MCP Use
mcp-use
11kMITOct 30, 2026Scanned, no flagged issues
MobileBuildMCP
getsentry
6.5kMITNov 1, 2026Scanned, no flagged issues
Gemini Notebook MCP CLI
jacob-bd
6.4kMITOct 27, 2026Scanned, no flagged issues
Mcporter
openclaw
5.1kMITOct 27, 2026Scanned, no flagged issues
Flint Chart
microsoft
4.5kMITNov 1, 2026Scanned, no flagged issues