Openmeld MCP Server

by amplifthq• 1.4k•• Scanned•Claim this listing•Request removal
Productivity & Workflowagent client protocolagent orchestrationagent skillsai agentsclaude code

The open-source collaboration system for people and AI agents. Share context, coordinate tasks, and work in parallel with your team, cloud agents, Codex, Claude Code, Grok, Grok Bot, OpenCode, Antigravity, and Cursor.

Openmeld is an open-source mcp server by amplifthq, written mainly in TypeScript, with 1,404 GitHub stars and the MIT license. Its code was last updated Nov 1, 2026.

Scan summary: scanned Nov 5, 2026 at commit a9f16f7. Seen able to read environment and secrets. Scan policy

aboutREADMEsecurityreviews
Scanned
Full scan at a9f16f7 · Nov 5, 2026
Scanned
Static code scanwarn
Secrets scanfail
Dependency audit86 known vulnerabilitieswarn
Manifestnonewarn
Buildfail
Boot & handshaken/a
Network egressn/a
Reproducible (×3)n/a

Findings (96)

  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • medium
    @modelcontextprotocol/client@2.0.0: 2 known vulnerabilities
    GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h
    pnpm-lock.yaml
  • medium
    @modelcontextprotocol/sdk@1.30.0: 6 known vulnerabilities
    GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more
    pnpm-lock.yaml
  • medium
    @modelcontextprotocol/server@2.0.0: 4 known vulnerabilities
    GHSA-46jr-4wx8-v453, GHSA-f897-62hf-6gxq, GHSA-jm63-cq47-j5jp, GHSA-rvq5-wwqv-78pq
    pnpm-lock.yaml
  • medium
    body-parser@2.2.2: 2 known vulnerabilities
    GHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6
    pnpm-lock.yaml
  • medium
    browserslist@4.28.1: 2 known vulnerabilities
    GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
    pnpm-lock.yaml
  • medium
    engine.io@6.6.5: 3 known vulnerabilities
    GHSA-2gc4-cqfq-p2gv, GHSA-gr94-w7qr-f4j3, GHSA-r635-g3xr-vw7x
    pnpm-lock.yaml
  • medium
    express-rate-limit@8.2.1: 1 known vulnerability
    GHSA-46wh-pxpv-q5gq
    pnpm-lock.yaml
  • medium
    fast-xml-parser@5.9.3: 1 known vulnerability
    GHSA-8r6m-32jq-jx6q
    pnpm-lock.yaml
  • medium
    flatted@3.3.3: 2 known vulnerabilities
    GHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh
    pnpm-lock.yaml
  • medium
    follow-redirects@1.16.1: 1 known vulnerability
    GHSA-mrwp-f3q8-3g9p
    pnpm-lock.yaml
  • medium
    ip-address@10.0.1: 6 known vulnerabilities
    GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-mwp4-54f8-5fhr, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5 +1 more
    pnpm-lock.yaml
  • medium
    js-yaml@4.1.1: 4 known vulnerabilities
    GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68
    pnpm-lock.yaml
  • medium
    minimatch@10.1.2: 4 known vulnerabilities
    GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-g3hv-75wg-m249
    pnpm-lock.yaml
  • medium
    minimatch@3.1.2: 3 known vulnerabilities
    GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj
    pnpm-lock.yaml
  • medium
    minimatch@9.0.5: 4 known vulnerabilities
    GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-g3hv-75wg-m249
    pnpm-lock.yaml
  • medium
    path-to-regexp@8.3.0: 2 known vulnerabilities
    GHSA-27v5-c462-wpq7, GHSA-j3q9-mxjg-w52f
    pnpm-lock.yaml
  • medium
    picomatch@2.3.1: 2 known vulnerabilities
    GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
    pnpm-lock.yaml
  • medium
    rollup@4.57.1: 1 known vulnerability
    GHSA-mw96-cpmx-2vgc
    pnpm-lock.yaml
  • medium
    socket.io-parser@4.2.5: 2 known vulnerabilities
    GHSA-2m8v-j782-fhvr, GHSA-677m-j7p3-52f9
    pnpm-lock.yaml
  • medium
    uuid@11.1.0: 1 known vulnerability
    GHSA-w5hq-g745-h8pq
    pnpm-lock.yaml
  • medium
    Install or build failed in a clean environment
    unt point /) Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set). (node:218) ExperimentalWarning: SQLite is an experimental feature and might change at any time (Use `node --trace-warnings ...` to show where the warning was created)  ELIFECYCLE  Command failed with exit code 1.
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    clients/web/src/components/agent-interface/agent-interface-page.test.tsx:94
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    clients/web/src/lib/cli-entry-command.test.ts:20
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    clients/web/src/lib/setup-bootstrap-script.test.ts:139
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    scripts/e2e/cli-binary-prod-setup-smoke.mjs:387
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    scripts/e2e/cli-binary-prod-setup-smoke.mjs:393
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    scripts/e2e/cli-binary-prod-setup-smoke.mjs:458
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    scripts/e2e/staging-computer-update-smoke-contract.mjs:12
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    scripts/e2e/staging-computer-update-smoke.test.mjs:26
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    scripts/release/macos-cli-signing.test.mjs:171
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    scripts/release/macos-cli-signing.test.mjs:172
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    scripts/release/macos-cli-signing.test.mjs:183
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    scripts/release/macos-cli-signing.test.mjs:184
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    scripts/release/macos-cli-signing.test.mjs:191
  • low
    In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.
    scripts/release/macos-cli-signing.test.mjs:192
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    services/core/src/__tests__/link-preview-fetch.test.ts:65
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    clients/openmeld-cli/tests/local-service-dispatch-controller-key.test.ts:237
  • low
    Possible example credential in docs/tests: generic-api-key
    clients/openmeld-cli/tests/auth-session.integration.test.ts:1761
  • low
    Possible example credential in docs/tests: generic-api-key
    clients/openmeld-cli/tests/service-trace.integration.test.ts:935
  • low
    Possible example credential in docs/tests: generic-api-key
    7 matches in this file
    clients/web/src/components/inbox/inbox-page.test.tsx:528
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/api-client/tests/projects-api.test.ts:441
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/schemas/tests/daemon/runtime-transport.test.ts:111
  • low
    Possible example credential in docs/tests: generic-api-key
    scripts/release/website-domain-migration.test.mjs:18
  • low
    Possible example credential in docs/tests: generic-api-key
    services/auth/tests/installed-renewal-boundary.test.ts:24
  • low
    Possible example credential in docs/tests: generic-api-key
    services/core/src/__tests__/dispatch-reply-foundation.test.ts:13
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    services/core/src/__tests__/runtime-coordinator-head-accepted-handoff-alarm.test.ts:48
  • low
    Possible example credential in docs/tests: generic-api-key
    services/core/src/__tests__/runtime-coordinator-pre-execution-handoff-alarm.test.ts:20
  • low
    Possible example credential in docs/tests: generic-api-key
    services/core/src/__tests__/runtime-coordinator-head-waiting-deadline-alarm.test.ts:63
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    services/core/src/__tests__/wake-trace-waterfall.test.ts:2350
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    services/core/src/__tests__/runtime-coordinator-authority.test.ts:52
  • low
    Possible example credential in docs/tests: generic-api-key
    services/core/src/__tests__/runtime-coordinator-head-failure-publication-retry-alarm.test.ts:52
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    services/core/src/__tests__/wake-timing.test.ts:504
  • low
    Possible example credential in docs/tests: generic-api-key
    services/core/src/__tests__/runtime-transport-dispatch-service.test.ts:159
  • low
    Possible example credential in docs/tests: generic-api-key
    services/core/src/__tests__/runtime-transport-client.test.ts:73
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    services/core/src/__tests__/space-signal-service.test.ts:576
  • low
    Possible example credential in docs/tests: generic-api-key
    services/core/tests-node/execution-recovery-publication.test.ts:252
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    services/core/tests-node/lark-platform-post-content.test.ts:17
  • low
    Possible example credential in docs/tests: generic-api-key
    11 matches in this file
    services/core/tests/runtime-transport-runtime-coordinator-contract.test.ts:493
  • low
    Possible example credential in docs/tests: generic-api-key
    6 matches in this file
    services/core/tests-node/remote-agent-message-channel-event-service.test.ts:67
  • low
    Possible example credential in docs/tests: generic-api-key
    services/core/tests-node/lark-platform-openapi-client.test.ts:637
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    services/core/tests-node/remote-agent-stream-delta-service.test.ts:1017
  • low
    Possible example credential in docs/tests: generic-api-key
    5 matches in this file
    services/core/tests/space-api.test.ts:4792
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    services/core/tests-node/remote-agent-native-delivery-service.test.ts:2284
  • low
    Possible example credential in docs/tests: generic-api-key
    tooling/postgresql/d1-rehearsal.test.mjs:310
  • low
    @babel/core@7.29.0: 1 known vulnerability
    GHSA-4x5r-pxfx-6jf8
    pnpm-lock.yaml
  • low
    @hono/node-server@2.0.8: 2 known vulnerabilities
    GHSA-9mqv-5hh9-4cgg, GHSA-rmxm-3fg6-px4f
    pnpm-lock.yaml
  • low
    @humanfs/node@0.16.7: 1 known vulnerability
    GHSA-p498-v437-472g
    pnpm-lock.yaml
  • low
    @vitest/mocker@4.1.11: 2 known vulnerabilities
    GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp
    pnpm-lock.yaml
  • low
    ajv@6.12.6: 1 known vulnerability
    GHSA-2g4f-4pwh-qvx6
    pnpm-lock.yaml
  • low
    baseline-browser-mapping@2.10.0: 1 known vulnerability
    GHSA-w5vr-8v7q-w6rv
    pnpm-lock.yaml
  • low
    deepmerge@4.3.1: 1 known vulnerability
    GHSA-gcqx-w48m-w2h4
    pnpm-lock.yaml
  • low
    esbuild@0.18.20: 1 known vulnerability
    GHSA-67mh-4wv8-2f99
    pnpm-lock.yaml
  • low
    esbuild@0.27.7: 1 known vulnerability
    GHSA-g7r4-m6w7-qqqr
    pnpm-lock.yaml
  • low
    glob@13.0.2: 1 known vulnerability
    GHSA-3g3m-2fjr-6pw4
    pnpm-lock.yaml
  • low
    glob@13.0.6: 1 known vulnerability
    GHSA-3g3m-2fjr-6pw4
    pnpm-lock.yaml
  • low
    katex@0.16.45: 1 known vulnerability
    GHSA-238p-pmpm-9mq7
    pnpm-lock.yaml
  • low
    katex@0.16.47: 1 known vulnerability
    GHSA-238p-pmpm-9mq7
    pnpm-lock.yaml
  • low
    mermaid@11.14.0: 9 known vulnerabilities
    GHSA-2v8p-3f2j-5mp7, GHSA-3rrr-jr9j-h3q3, GHSA-6m6c-36f7-fhxh, GHSA-6x64-9x62-f2gx, GHSA-87f9-hvmw-gh4p +4 more
    pnpm-lock.yaml
  • low
    minimatch@10.2.5: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    pnpm-lock.yaml
  • low
    postcss-selector-parser@6.0.10: 1 known vulnerability
    GHSA-rj75-hqrm-r3gf
    pnpm-lock.yaml
  • low
    qs@6.15.0: 4 known vulnerabilities
    GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-q8mj-m7cp-5q26, GHSA-x5fp-wj9c-mxmx
    pnpm-lock.yaml
  • low
    seroval@1.6.9: 2 known vulnerabilities
    GHSA-9wx9-5pv9-3349, GHSA-f86p-h4j2-7qgj
    pnpm-lock.yaml
  • low
    yaml@1.10.2: 1 known vulnerability
    GHSA-48c2-rrv3-qjmp
    pnpm-lock.yaml
  • low
    package.json has a prepare script
    husky
    package.json
  • low
    No manifest declaring network access and environment variables (agent.json)

Network activity

During install
github.comregistry.npmjs.orgrelease-assets.githubusercontent.com
While running
Not run — the code wasn't started in this scan

Automated result for the commit shown. See our scan policy. View the scan log

Maintainers can claim the listing to rescan, or dispute a result.

Openmeld alternatives

View more →

Similar mcp servers in Productivity & Workflow, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

NameStarsLicenceLast updatedScan
Openmeld (this page)
amplifthq
1.4kMITNov 1, 2026Scanned, no flagged issues
N8n MCP
czlonkowski
23kMITOct 27, 2026Scanned, no flagged issues
Trigger Dev
triggerdotdev
17kApache-2.0Oct 31, 2026Scanned, no flagged issues
Skill Seekers
yusufkaraaslan
15kMITSep 30, 2026Scanned, no flagged issues
Windows MCP
CursorTouch
11kMITNov 1, 2026Scanned, no flagged issues
Mobile MCP
mobile-next
10kApache-2.0Oct 30, 2026Scanned, no flagged issues