Tutti MCP Server

by tutti-os• 3.9k•• Scanned•Claim this listing•Request removal
Coding Agentsagent collaborationagent orchestrationagent workspaceagentic aiagentic workflow

Where people and agents build in tune.

Tutti is an open-source mcp server by tutti-os, written mainly in TypeScript, with 3,882 GitHub stars and the Apache-2.0 license. Its code was last updated Oct 8, 2026.

Scan summary: scanned Nov 5, 2026 at commit 207beee. Seen able to run dynamic code, connect to the internet. Scan policy

Scanned
Full scan at 207beee · Nov 5, 2026
Scanned
Static code scanwarn
Secrets scanfail
Dependency audit456 known vulnerabilitiesfail
Manifestnonewarn
Buildfail
Boot & handshaken/a
Network egressn/a
Reproducible (×3)n/a

Findings (97)

  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    code-execution issue
    Details are available to the maintainer after claiming this listing.
  • high
    code-execution issue
    Details are available to the maintainer after claiming this listing.
  • high
    code-execution issue
    Details are available to the maintainer after claiming this listing.
  • high
    dropper issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • medium
    github.com/klauspost/compress@1.17.7: 2 known vulnerabilities
    GO-2026-5841, GO-2026-5841
    packages/analytics/reporter-go/go.mod
  • medium
    @modelcontextprotocol/sdk@1.29.0: 6 known vulnerabilities
    GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more
    pnpm-lock.yaml
  • medium
    @tiptap/core@3.23.6: 2 known vulnerabilities
    GHSA-cp6q-959q-f8rh, GHSA-j95f-988m-3j2f
    pnpm-lock.yaml
  • medium
    @xmldom/xmldom@0.8.13: 10 known vulnerabilities
    GHSA-27p8-2357-5qqv, GHSA-4w3w-2rp5-g8jm, GHSA-6gmq-8vp8-gcm6, GHSA-6h8r-xr42-gp59, GHSA-8344-3jmq-59r6 +5 more
    pnpm-lock.yaml
  • medium
    @xmldom/xmldom@0.9.10: 13 known vulnerabilities
    GHSA-27p8-2357-5qqv, GHSA-3px3-54cx-rmw9, GHSA-4w3w-2rp5-g8jm, GHSA-6gmq-8vp8-gcm6, GHSA-6h8r-xr42-gp59 +8 more
    pnpm-lock.yaml
  • medium
    app-builder-lib@26.8.1: 1 known vulnerability
    GHSA-7g7r-gx96-252g
    pnpm-lock.yaml
  • medium
    body-parser@1.20.6: 1 known vulnerability
    GHSA-27r3-jxmh-p828
    pnpm-lock.yaml
  • medium
    body-parser@2.3.0: 1 known vulnerability
    GHSA-27r3-jxmh-p828
    pnpm-lock.yaml
  • medium
    brace-expansion@1.1.14: 6 known vulnerabilities
    GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +1 more
    pnpm-lock.yaml
  • medium
    brace-expansion@2.1.0: 6 known vulnerabilities
    GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +1 more
    pnpm-lock.yaml
  • medium
    brace-expansion@5.0.6: 6 known vulnerabilities
    GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +1 more
    pnpm-lock.yaml
  • medium
    browserslist@4.28.2: 2 known vulnerabilities
    GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
    pnpm-lock.yaml
  • medium
    builder-util-runtime@9.5.1: 1 known vulnerability
    GHSA-p2f4-r6v6-j797
    pnpm-lock.yaml
  • medium
    compression@1.8.1: 1 known vulnerability
    GHSA-vc2v-76pw-4v95
    pnpm-lock.yaml
  • medium
    decode-uri-component@0.2.2: 2 known vulnerabilities
    GHSA-qr28-fpjm-wq7f, GHSA-vcc3-ghjq-m6fr
    pnpm-lock.yaml
  • medium
    dompurify@3.2.7: 21 known vulnerabilities
    GHSA-39q2-94rc-95cp, GHSA-55q2-fjhq-7xh7, GHSA-6688-9rhm-gjv2, GHSA-76mc-f452-cxcm, GHSA-c2j3-45gr-mqc4 +16 more
    pnpm-lock.yaml
  • medium
    electron@43.2.0: 12 known vulnerabilities
    GHSA-2p8c-gr87-2676, GHSA-3qxv-5xgr-q7w9, GHSA-98mx-cjp9-gchm, GHSA-997q-gvvc-jwmx, GHSA-9qh4-3jw8-366w +7 more
    pnpm-lock.yaml
  • medium
    fast-uri@3.1.2: 11 known vulnerabilities
    GHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf +6 more
    pnpm-lock.yaml
  • medium
    form-data@4.0.5: 1 known vulnerability
    GHSA-hmw2-7cc7-3qxx
    pnpm-lock.yaml
  • medium
    image-size@1.2.1: 2 known vulnerabilities
    GHSA-5p2g-fcmc-qvqq, GHSA-w3rx-r6r6-pgpr
    pnpm-lock.yaml
  • medium
    ip-address@10.2.0: 8 known vulnerabilities
    GHSA-22jq-vg5j-6vgg, GHSA-2vr4-cq9g-pvrc, GHSA-4xrf-jv44-h6hh, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv +3 more
    pnpm-lock.yaml
  • medium
    joi@17.13.4: 5 known vulnerabilities
    GHSA-4528-x5fx-h6hg, GHSA-6h2x-m376-mqjq, GHSA-6w3j-5fw6-r9vr, GHSA-gg4h-3hg2-grpc, GHSA-wr44-6hxh-3jwq
    pnpm-lock.yaml
  • medium
    js-yaml@3.14.2: 4 known vulnerabilities
    GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68
    pnpm-lock.yaml
  • medium
    js-yaml@4.1.1: 4 known vulnerabilities
    GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68
    pnpm-lock.yaml
  • medium
    launch-editor@2.14.1: 3 known vulnerabilities
    GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-r825-w8mm-5pxw
    pnpm-lock.yaml
  • medium
    nanoid@3.3.12: 2 known vulnerabilities
    GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8
    pnpm-lock.yaml
  • medium
    postcss@8.5.15: 2 known vulnerabilities
    GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849
    pnpm-lock.yaml
  • medium
    prosemirror-view@1.41.8: 1 known vulnerability
    GHSA-c8x8-7fp4-3x9w
    pnpm-lock.yaml
  • medium
    source-map-js@1.2.1: 1 known vulnerability
    GHSA-68fv-2mgg-jv7q
    pnpm-lock.yaml
  • medium
    systeminformation@5.31.9: 3 known vulnerabilities
    GHSA-3f7j-7jwc-fxfj, GHSA-4vjg-vx72-qq4g, GHSA-7648-jmwf-vw7j
    pnpm-lock.yaml
  • medium
    tmp@0.2.5: 1 known vulnerability
    GHSA-ph9p-34f9-6g65
    pnpm-lock.yaml
  • medium
    undici@6.25.0: 15 known vulnerabilities
    GHSA-2m5v-pch6-74hx, GHSA-35p6-xmwp-9g52, GHSA-3wwx-pv8p-q78v, GHSA-4qv8-2p9j-2685, GHSA-8xcm-r25x-g524 +10 more
    pnpm-lock.yaml
  • medium
    undici@7.28.0: 23 known vulnerabilities
    GHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-3xpg-4rpp-hhhm +18 more
    pnpm-lock.yaml
  • medium
    vite@6.4.2: 7 known vulnerabilities
    GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-fx2h-pf6j-xcff, GHSA-r825-w8mm-5pxw +2 more
    pnpm-lock.yaml
  • medium
    zod@3.25.76: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    pnpm-lock.yaml
  • medium
    zod@4.4.3: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    pnpm-lock.yaml
  • medium
    Install or build failed in a clean environment
    at async headlessInstall (/tmp/home/.cache/node/corepack/v1/pnpm/10.11.0/dist/pnpm.cjs:147034:11) at async tryFrozenInstall (/tmp/home/.cache/node/corepack/v1/pnpm/10.11.0/dist/pnpm.cjs:185941:44) at async _install (/tmp/home/.cache/node/corepack/v1/pnpm/10.11.0/dist/pnpm.cjs:185757:37)
  • low
    In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).
    packages/agent/gui/shared/agentEnv/agentEnvViewModel.spec.ts:327
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/browser/workbench-node/src/electron-main/automationDebugger.test.ts:64
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/browser/workbench-node/src/electron-main/automationNetworkPolicy.test.ts:35
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/browser/workbench-node/src/electron-main/automationNetworkPolicy.test.ts:37
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    packages/browser/workbench-node/src/electron-main/automationRegistry.test.ts:210
  • low
    Possible example credential in docs/tests: generic-api-key
    docs/architecture/analytics-tracking.md:243
  • low
    Possible example credential in docs/tests: generic-api-key
    4 matches in this file
    packages/agent/activity-core/src/engine/planDecision.reducer.test.ts:17
  • low
    Possible example credential in docs/tests: generic-api-key
    services/tuttid/types/defaults_test.go:250
  • low
    golang.org/x/net@0.50.0: 96 known vulnerabilities
    GO-2026-4559, GO-2026-4918, GO-2026-5025, GO-2026-5026, GO-2026-5027 +91 more
    packages/agent/daemon/go.mod
  • low
    golang.org/x/sys@0.41.0: 12 known vulnerabilities
    GO-2026-5024, GO-2026-5024, GO-2026-5024, GO-2026-5024, GO-2026-5024 +7 more
    packages/agent/daemon/go.mod
  • low
    golang.org/x/text@0.34.0: 8 known vulnerabilities
    GO-2026-5970, GO-2026-6629, GO-2026-5970, GO-2026-6629, GO-2026-5970 +3 more
    packages/agent/daemon/go.mod
  • low
    golang.org/x/mod@0.33.0: 10 known vulnerabilities
    GO-2026-6179, GO-2026-6180, GO-2026-6179, GO-2026-6180, GO-2026-6179 +5 more
    packages/agent/host/go.mod
  • low
    github.com/go-kratos/kratos/v2@2.9.2: 3 known vulnerabilities
    GO-2026-5471, GO-2026-5471, GO-2026-5471
    packages/clients/market-go/go.mod
  • low
    github.com/pion/dtls/v3@3.1.3: 2 known vulnerabilities
    GO-2026-6165, GO-2026-6165
    packages/device-link/go.mod
  • low
    github.com/pion/stun/v3@3.1.4: 2 known vulnerabilities
    GO-2026-6163, GO-2026-6163
    packages/device-link/go.mod
  • low
    github.com/quic-go/quic-go@0.59.0: 2 known vulnerabilities
    GO-2026-5676, GO-2026-5676
    packages/device-link/go.mod
  • low
    @babel/core@7.29.0: 1 known vulnerability
    GHSA-4x5r-pxfx-6jf8
    pnpm-lock.yaml
  • low
    @hey-api/openapi-ts@0.97.2: 1 known vulnerability
    GHSA-hhx9-57xq-r5rw
    pnpm-lock.yaml
  • low
    @hono/node-server@1.19.14: 2 known vulnerabilities
    GHSA-frvp-7c67-39w9, GHSA-rmxm-3fg6-px4f
    pnpm-lock.yaml
  • low
    @vitest/mocker@3.2.6: 2 known vulnerabilities
    GHSA-82fw-gwwq-j7x9, GHSA-qxg6-89mg-rqv8
    pnpm-lock.yaml
  • low
    @vitest/mocker@4.1.7: 2 known vulnerabilities
    GHSA-82fw-gwwq-j7x9, GHSA-qxg6-89mg-rqv8
    pnpm-lock.yaml
  • low
    baseline-browser-mapping@2.10.31: 1 known vulnerability
    GHSA-w5vr-8v7q-w6rv
    pnpm-lock.yaml
  • low
    deepmerge@4.3.1: 1 known vulnerability
    GHSA-gcqx-w48m-w2h4
    pnpm-lock.yaml
  • low
    esbuild@0.27.7: 1 known vulnerability
    GHSA-g7r4-m6w7-qqqr
    pnpm-lock.yaml
  • low
    esbuild@0.28.0: 1 known vulnerability
    GHSA-g7r4-m6w7-qqqr
    pnpm-lock.yaml
  • low
    fast-xml-parser@4.5.7: 1 known vulnerability
    GHSA-gh4j-gqv2-49f6
    pnpm-lock.yaml
  • low
    hono@4.12.26: 12 known vulnerabilities
    GHSA-54fx-42gc-7vw4, GHSA-5r4p-p66f-jhc7, GHSA-79qm-7rj5-m7r9, GHSA-8j4g-w8fx-2239, GHSA-crvj-82cr-hjcx +7 more
    pnpm-lock.yaml
  • low
    katex@0.16.47: 1 known vulnerability
    GHSA-238p-pmpm-9mq7
    pnpm-lock.yaml
  • low
    mermaid@11.16.0: 5 known vulnerabilities
    GHSA-2v8p-3f2j-5mp7, GHSA-3rrr-jr9j-h3q3, GHSA-6x64-9x62-f2gx, GHSA-c4c3-pg64-4m4v, GHSA-rhh3-jpg6-66xh
    pnpm-lock.yaml
  • low
    minimatch@10.2.5: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    pnpm-lock.yaml
  • low
    minimatch@9.0.9: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    pnpm-lock.yaml
  • low
    postcss-selector-parser@6.1.4: 1 known vulnerability
    GHSA-rj75-hqrm-r3gf
    pnpm-lock.yaml
  • low
    postcss-selector-parser@7.1.4: 1 known vulnerability
    GHSA-rj75-hqrm-r3gf
    pnpm-lock.yaml
  • low
    qs@6.15.2: 3 known vulnerabilities
    GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-x5fp-wj9c-mxmx
    pnpm-lock.yaml
  • low
    vitest@3.2.6: 1 known vulnerability
    GHSA-82fw-gwwq-j7x9
    pnpm-lock.yaml
  • low
    vitest@4.1.7: 1 known vulnerability
    GHSA-82fw-gwwq-j7x9
    pnpm-lock.yaml
  • low
    github.com/oapi-codegen/oapi-codegen/v2@2.7.0: 1 known vulnerability
    GO-2026-6016
    services/tuttid/go.mod
  • low
    package.json has a prepare script
    husky
    package.json
  • low
    No manifest declaring network access and environment variables (agent.json)

Network activity

During install
registry.npmjs.org
While running
Not run — the code wasn't started in this scan

Automated result for the commit shown. See our scan policy. View the scan log

Maintainers can claim the listing to rescan, or dispute a result.

Tutti alternatives

View more →

Similar mcp servers in Coding Agents, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

NameStarsLicenceLast updatedScan
Tutti (this page)
tutti-os
3.9kApache-2.0Oct 8, 2026Scanned, no flagged issues
Context Mode
mksglu
33kNone foundNov 1, 2026Not scanned yet
Serena
oraios
31kNone foundOct 28, 2026Not scanned yet
Fastmcp
PrefectHQ
28kApache-2.0Nov 1, 2026Scanned, no flagged issues
Nuclear
nukeop
19kAGPL-3.0Nov 1, 2026Scanned, no flagged issues
MCP For Beginners
microsoft
18kMITOct 30, 2026Scanned, no flagged issues