MCP Scanner
ScanLeaderboardDocsSign in
Home/upstash/context7/Results
0F

context7

upstash/context7

103 files · 189 findings

Share GitHub SARIF JSON
6 critical48 high62 medium73 low
Tool Poisoning2 issues
Command Injection2 issues
Path Traversal7 issues
SSRF11 issues
Credential Theft11 issues
Excessive Permissions5 issues
Missing Auth52 issues
Data Exfiltration1

Clipboard or screenshot access for exfiltration

high

Accessing clipboard contents or taking screenshots may be used to capture and exfiltrate sensitive data.

.github/ISSUE_TEMPLATE/feature_request.yml:51
description: Add any other context, screenshots, or examples about the feature request
How to fix

Remove clipboard/screenshot access unless explicitly required by the tool's stated purpose.

Supply Chain21

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/canary-release.yml:19
uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

Command Injection2

child_process import with unsanitized usage

high

Direct usage of child_process module methods with variable arguments may allow command injection.

.github/workflows/changeset-check.yml:21
const { execSync } = require('child_process');
How to fix

Use execFile with explicit argument arrays instead of child_process with string commands.

Logging Deficiency74

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

.github/workflows/changeset-check.yml:25
console.log('Skipping changeset check for PR with skip-changeset label');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Missing Auth52

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

docs/docs.json:41
"howto/oauth"
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

Path Traversal7

Windows-style path traversal patterns

high

Backslash-based directory traversal patterns targeting Windows file systems.

docs/openapi.json:154
"example": "### Middleware Authentication Example\n\nSource: https://github.com/vercel/next.js/blob/canary/docs/middleware.mdx\n\nShows how to implement authentication checks in Next.js middleware\n\n```typescript\nimport { NextResponse } from 'next/server'\n...\n```"
How to fix
SSRF11

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

packages/cli/src/commands/auth.ts:58
const redirectUri = `http://localhost:${port}/callback`;
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Excessive Permissions5

sudo command usage

high

Using sudo in scripts escalates privileges and may allow unintended system-wide modifications.

packages/cli/src/commands/generate.ts:543
console.log(pc.dim(`  sudo chown -R $(whoami) "${parentDir}"`));
How to fix

Remove sudo usage. Run processes with the minimum required privileges.

Tool Poisoning2

HTML comment injection in tool description

critical

HTML comments in tool descriptions may contain hidden instructions intended to influence LLM reasoning.

packages/cli/src/setup/agents.ts:137
sectionMarker: "<!-- context7 -->",
How to fix

Remove HTML comments from description strings. Use source code comments instead.

Credential Theft11

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

packages/cli/src/utils/api.ts:272
const apiKey = process.env.CONTEXT7_API_KEY;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Insecure Communication3

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

packages/cli/src/utils/auth.ts:150
const server = http.createServer((req, res) => {
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Supply Chain
21 issues
Rug Pullclean
Data Exfiltration1 issue
Insecure Communication3 issues
Excessive Data Exposureclean
Logging Deficiency74 issues
Runtime Tool Poisoningclean
Shadow MCP Serverclean

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/canary-release.yml:24
uses: actions/setup-node@v4
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/canary-release.yml:29
uses: pnpm/action-setup@v4
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/changeset-check.yml:13
uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/changeset-check.yml:18
uses: actions/github-script@v7
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/ecr-deploy.yml:17
uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/ecr-deploy.yml:20
uses: aws-actions/configure-aws-credentials@v5
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/ecr-deploy.yml:28
uses: aws-actions/amazon-ecr-login@v2
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/ecr-deploy.yml:31
uses: docker/setup-qemu-action@v3
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/ecr-deploy.yml:34
uses: docker/setup-buildx-action@v3
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/ecr-deploy.yml:38
uses: docker/build-push-action@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/mcp-registry.yml:20
uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/mcp-registry.yml:23
uses: actions/setup-node@v4
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/release.yml:19
uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/release.yml:22
uses: actions/setup-node@v4
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/release.yml:27
uses: pnpm/action-setup@v4
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/release.yml:43
uses: changesets/action@v1
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/test.yml:17
- uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/test.yml:20
uses: actions/setup-node@v4
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/test.yml:25
uses: pnpm/action-setup@v4
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/test.yml:36
uses: actions/cache@v5
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

child_process import with unsanitized usage

high

Direct usage of child_process module methods with variable arguments may allow command injection.

packages/cli/src/commands/generate.ts:7
import { spawn } from "child_process";
How to fix

Use execFile with explicit argument arrays instead of child_process with string commands.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

.github/workflows/changeset-check.yml:46
console.log('Changeset found!');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/auth.ts:69
console.log("");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/auth.ts:70
console.log(pc.bold("Opening browser to log in..."));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/auth.ts:71
console.log("");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/auth.ts:75
console.log(pc.dim("If the browser didn't open, visit this URL:"));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/auth.ts:77
console.log(pc.dim("Open this URL in your browser:"));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/auth.ts:79
console.log(pc.cyan(authUrl));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/auth.ts:80
console.log("");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/auth.ts:121
console.log(pc.yellow("You are already logged in."));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/auth.ts:122
console.log(pc.dim("Run 'ctx7 logout' first if you want to log in with a different account."));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/auth.ts:131
console.log("");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/auth.ts:132
console.log(pc.dim("You can now use authenticated Context7 features."));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/auth.ts:138
console.log(pc.green("Logged out successfully."));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/auth.ts:140
console.log(pc.yellow("You are not logged in."));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/auth.ts:149
console.log(pc.yellow("Not logged in."));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/auth.ts:150
console.log(pc.dim("Run 'ctx7 login' to authenticate."));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/auth.ts:154
console.log(pc.green("Logged in"));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/auth.ts:159
console.log(`${pc.dim("Name:".padEnd(13))}${whoami.name}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/auth.ts:162
console.log(`${pc.dim("Email:".padEnd(13))}${whoami.email}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/auth.ts:165
console.log(`${pc.dim("Teamspace:".padEnd(13))}${whoami.teamspace.name}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/auth.ts:168
console.log(pc.dim("(Session may be expired - run 'ctx7 login' to refresh)"));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/docs.ts:89
console.log(JSON.stringify(results, null, 2));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/docs.ts:147
console.log(result);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/docs.ts:179
console.log(JSON.stringify(ctx, null, 2));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:86
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:89
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:94
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:97
console.log(`  Visit ${pc.green("https://context7.com/dashboard")} to upgrade.`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:105
console.log(pc.bold("What should your agent become an expert at?\n"));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:106
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:111
console.log(pc.yellow("Examples:"));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:114
console.log(pc.red('  ✕ "Deploy a Next.js app to Vercel"'));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:115
console.log(pc.green('  ✓ "Best practices and constraints for deploying Next.js apps to Vercel"'));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:117
console.log(pc.red('  ✕ "Use Tailwind for responsive design"'));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:118
console.log(pc.green('  ✓ "Responsive layout decision-making with Tailwind CSS"'));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:120
console.log(pc.red('  ✕ "Build OAuth with NextAuth"'));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:121
console.log(pc.green('  ✓ "OAuth authentication patterns and pitfalls with NextAuth.js"'));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:142
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:147
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:152
console.log(pc.dim("You can adjust which sources the skill is based on.\n"));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:283
console.log(`${pc.green("✓")} ${pc.dim(`[${questionNum}/${totalQuestions}]`)} ${q.question}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:284
console.log(`  ${pc.cyan(truncatedAnswer)}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:414
console.log(pc.dim("━".repeat(70)));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:415
console.log(pc.bold(`Generated Skill: `) + pc.green(pc.bold(skillName)));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:416
console.log(pc.dim("━".repeat(70)));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:418
console.log(previewContent);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:421
console.log(pc.dim(`... ${remainingLines} more lines`));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:424
console.log(pc.dim("━".repeat(70)));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:540
console.log(pc.yellow("Fix permissions with:"));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:543
console.log(pc.dim(`  sudo chown -R $(whoami) "${parentDir}"`));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:553
console.log(pc.green("Skill saved successfully"));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/commands/generate.ts:555
console.log(pc.dim(`  ${targetDir}/`) + pc.green(skillName));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/index.ts:65
console.log("");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/index.ts:67
console.log(brand.primary(banner));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/index.ts:68
console.log(brand.dim("  The open agent skills ecosystem"));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/index.ts:69
console.log("");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/index.ts:71
console.log("  Quick start:");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/index.ts:72
console.log(`    ${brand.primary("npx ctx7 skills search pdf")}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/index.ts:73
console.log(`    ${brand.primary("npx ctx7 skills install /anthropics/skills")}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/index.ts:74
console.log("");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/index.ts:76
console.log(`  Run ${brand.primary("npx ctx7 --help")} for all commands and options`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/index.ts:77
console.log(`  Visit ${brand.primary("https://context7.com")} to browse skills`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/index.ts:78
console.log("");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/utils/logger.ts:4
info: (message: string) => console.log(pc.cyan(message)),
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/utils/logger.ts:5
success: (message: string) => console.log(pc.green(`✔ ${message}`)),
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/utils/logger.ts:6
warn: (message: string) => console.log(pc.yellow(`⚠ ${message}`)),
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/utils/logger.ts:7
error: (message: string) => console.log(pc.red(`✖ ${message}`)),
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/utils/logger.ts:8
dim: (message: string) => console.log(pc.dim(message)),
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/utils/logger.ts:9
item: (message: string) => console.log(pc.green(`  ${message}`)),
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/utils/logger.ts:10
itemAdd: (message: string) => console.log(`  ${pc.green("+")} ${message}`),
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/utils/logger.ts:11
plain: (message: string) => console.log(message),
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/cli/src/utils/logger.ts:12
blank: () => console.log(""),
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

packages/sdk/src/client.ts:31
console.warn(`API key should start with '${API_KEY_PREFIX}'`);
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/commands/auth.ts:13
getValidAccessToken,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/commands/auth.ts:99
return tokens.access_token;
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/commands/auth.ts:119
const existingToken = await getValidAccessToken();
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/commands/auth.ts:146
const accessToken = await getValidAccessToken();
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/commands/auth.ts:146
const accessToken = await getValidAccessToken();
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/commands/auth.ts:148
if (!accessToken) {
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/commands/auth.ts:157
const whoami = await fetchWhoami(accessToken);
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/commands/auth.ts:179
async function fetchWhoami(accessToken: string): Promise<WhoamiResponse> {
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/commands/auth.ts:182
Authorization: `Bearer ${accessToken}`,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/commands/auth.ts:182
Authorization: `Bearer ${accessToken}`,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/commands/docs.ts:20
function getAccessToken(): string | undefined {
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/commands/docs.ts:23
return tokens.access_token;
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/commands/docs.ts:59
const accessToken = getAccessToken();
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/commands/docs.ts:59
const accessToken = getAccessToken();
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/commands/docs.ts:63
data = await resolveLibrary(library, query, accessToken);
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/commands/docs.ts:132
const accessToken = getAccessToken();
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/commands/docs.ts:132
const accessToken = getAccessToken();
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/commands/docs.ts:137
result = await getLibraryContext(libraryId, query, { type: outputType }, accessToken);
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:47
accessToken?: string
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:50
if (accessToken) {
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:51
headers["Authorization"] = `Bearer ${accessToken}`;
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:51
headers["Authorization"] = `Bearer ${accessToken}`;
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:106
accessToken?: string
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:110
if (accessToken) {
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:111
headers["Authorization"] = `Bearer ${accessToken}`;
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:111
headers["Authorization"] = `Bearer ${accessToken}`;
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:117
export async function getSkillQuota(accessToken: string): Promise<SkillQuotaResponse> {
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:119
headers: { Authorization: `Bearer ${accessToken}` },
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:119
headers: { Authorization: `Bearer ${accessToken}` },
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:140
accessToken?: string
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:143
if (accessToken) {
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:144
headers["Authorization"] = `Bearer ${accessToken}`;
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:144
headers["Authorization"] = `Bearer ${accessToken}`;
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:167
accessToken?: string
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:170
if (accessToken) {
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:171
headers["Authorization"] = `Bearer ${accessToken}`;
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:171
headers["Authorization"] = `Bearer ${accessToken}`;
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:265
function getAuthHeaders(accessToken?: string): Record<string, string> {
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:274
headers["Authorization"] = `Bearer ${apiKey}`;
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:275
} else if (accessToken) {
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:276
headers["Authorization"] = `Bearer ${accessToken}`;
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:276
headers["Authorization"] = `Bearer ${accessToken}`;
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:284
accessToken?: string
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:292
headers: getAuthHeaders(accessToken),
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:318
accessToken?: string
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/cli/src/utils/api.ts:325
headers: getAuthHeaders(accessToken),
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

packages/mcp/src/index.ts:425
app.get("/ping", (_req: express.Request, res: express.Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/mcp/src/lib/encryption.ts:55
headers["Authorization"] = `Bearer ${context.apiKey}`;
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/sdk/src/client.ts:37
Authorization: `Bearer ${apiKey}`,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/sdk/src/utils/test-utils.ts:13
Authorization: `Bearer ${apiKey}`,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

plugins/cursor/context7/mcp.json:3
"url": "https://mcp.context7.com/mcp/oauth"
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Normalize path separators and apply traversal checks for both forward and backslashes.

fs operations without path sanitization

medium

File system operations using variables without prior path validation or sanitization may allow traversal attacks.

packages/cli/src/utils/auth.ts:38
fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
How to fix

Add path sanitization before all fs operations. Validate paths against an allowlist of permitted directories.

fs operations without path sanitization

medium

File system operations using variables without prior path validation or sanitization may allow traversal attacks.

packages/cli/src/utils/auth.ts:49
fs.writeFileSync(CREDENTIALS_FILE, JSON.stringify(data, null, 2), { mode: 0o600 });
How to fix

Add path sanitization before all fs operations. Validate paths against an allowlist of permitted directories.

fs operations without path sanitization

medium

File system operations using variables without prior path validation or sanitization may allow traversal attacks.

packages/cli/src/utils/auth.ts:57
const data = JSON.parse(fs.readFileSync(CREDENTIALS_FILE, "utf-8"));
How to fix

Add path sanitization before all fs operations. Validate paths against an allowlist of permitted directories.

fs operations without path sanitization

medium

File system operations using variables without prior path validation or sanitization may allow traversal attacks.

packages/cli/src/utils/auth.ts:66
fs.unlinkSync(CREDENTIALS_FILE);
How to fix

Add path sanitization before all fs operations. Validate paths against an allowlist of permitted directories.

Directory traversal sequence targeting sensitive files

critical

Paths containing '../' sequences targeting sensitive system files (etc/passwd, .ssh, .env) can escape intended directories.

packages/sdk/vitest.config.ts:5
dotenv.config({ path: path.resolve(__dirname, "../../.env") });
How to fix

Validate and sanitize file paths. Use path.resolve() with a base directory and verify the result stays within the allowed root.

Directory traversal sequence targeting sensitive files

critical

Paths containing '../' sequences targeting sensitive system files (etc/passwd, .ssh, .env) can escape intended directories.

packages/tools-ai-sdk/vitest.config.ts:5
config({ path: path.resolve(__dirname, "../../.env") });
How to fix

Validate and sanitize file paths. Use path.resolve() with a base directory and verify the result stays within the allowed root.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

packages/cli/src/utils/auth.ts:151
const url = new URL(req.url || "/", `http://localhost`);
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

URL construction from user input

medium

Building URLs by concatenating or interpolating user input without an allowlist check enables SSRF via host manipulation.

packages/cli/src/utils/auth.ts:305
const url = new URL(`${baseUrl}/api/oauth/authorize`);
How to fix

Do not construct URLs from unvalidated user input. Use a URL allowlist or domain restriction.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

packages/cli/src/utils/github.ts:163
const response = await fetch(treeUrl, { headers });
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

packages/cli/src/utils/github.ts:204
const response = await fetch(rawUrl, { headers });
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

packages/cli/src/utils/github.ts:267
const fileResponse = await fetch(rawUrl, { headers: ghHeaders });
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

packages/mcp/src/lib/api.ts:101
const response = await fetch(url, { headers });
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

packages/mcp/src/lib/api.ts:133
const response = await fetch(url, { headers });
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

URL construction from user input

medium

Building URLs by concatenating or interpolating user input without an allowlist check enables SSRF via host manipulation.

packages/mcp/src/lib/api.ts:95
const url = new URL(`${CONTEXT7_API_BASE_URL}/v2/libs/search`);
How to fix

Do not construct URLs from unvalidated user input. Use a URL allowlist or domain restriction.

URL construction from user input

medium

Building URLs by concatenating or interpolating user input without an allowlist check enables SSRF via host manipulation.

packages/mcp/src/lib/api.ts:127
const url = new URL(`${CONTEXT7_API_BASE_URL}/v2/context`);
How to fix

Do not construct URLs from unvalidated user input. Use a URL allowlist or domain restriction.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

packages/sdk/src/http/index.ts:155
res = await fetch(url, requestOptions as RequestInit);
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

sudo command usage

high

Using sudo in scripts escalates privileges and may allow unintended system-wide modifications.

packages/cli/src/commands/skill.ts:441
log.dim(`  sudo chown -R $(whoami) "${parentDir}"`);
How to fix

Remove sudo usage. Run processes with the minimum required privileges.

sudo command usage

high

Using sudo in scripts escalates privileges and may allow unintended system-wide modifications.

packages/cli/src/commands/skill.ts:619
log.dim(`  sudo chown -R $(whoami) "${parentDir}"`);
How to fix

Remove sudo usage. Run processes with the minimum required privileges.

sudo command usage

high

Using sudo in scripts escalates privileges and may allow unintended system-wide modifications.

packages/cli/src/commands/skill.ts:717
log.error(`Permission denied. Try: sudo rm -rf "${skillPath}"`);
How to fix

Remove sudo usage. Run processes with the minimum required privileges.

sudo command usage

high

Using sudo in scripts escalates privileges and may allow unintended system-wide modifications.

packages/cli/src/commands/skill.ts:960
log.dim(`  sudo chown -R $(whoami) "${parentDir}"`);
How to fix

Remove sudo usage. Run processes with the minimum required privileges.

HTML comment injection in tool description

critical

HTML comments in tool descriptions may contain hidden instructions intended to influence LLM reasoning.

packages/cli/src/setup/agents.ts:168
sectionMarker: "<!-- context7 -->",
How to fix

Remove HTML comments from description strings. Use source code comments instead.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

packages/cli/src/utils/github.ts:84
const envToken = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

packages/cli/src/utils/github.ts:84
const envToken = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

packages/mcp/src/index.ts:499
stdioApiKey = cliOptions.apiKey || process.env.CONTEXT7_API_KEY;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

packages/mcp/src/lib/constants.ts:16
export const AUTH_SERVER_URL = process.env.AUTH_SERVER_URL || CONTEXT7_BASE_URL;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Base64 encoding of sensitive data

high

Encoding environment variables or credential file contents to Base64 is a common exfiltration obfuscation technique.

packages/mcp/src/lib/encryption.ts:21
const cipher = createCipheriv(ALGORITHM, Buffer.from(ENCRYPTION_KEY, "hex"), iv);
How to fix

Remove Base64 encoding of credentials. If encoding is needed, use a proper encryption library.

Hardcoded API key or token literal

critical

String literals matching known API key prefixes (sk-, ghp_, AKIA, xoxb-, etc.) or long base64-like strings may expose secrets in source code.

packages/mcp/src/lib/encryption.ts:4
const DEFAULT_ENCRYPTION_KEY = "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f";
How to fix

Remove hardcoded secrets from source code. Use environment variables or a secrets manager.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

packages/sdk/src/client.ts:22
const apiKey = config.apiKey || process.env.CONTEXT7_API_KEY;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

packages/sdk/src/utils/test-utils.ts:4
const apiKey = process.env.CONTEXT7_API_KEY || process.env.API_KEY;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

packages/sdk/src/utils/test-utils.ts:4
const apiKey = process.env.CONTEXT7_API_KEY || process.env.API_KEY;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Hardcoded API key or token literal

critical

String literals matching known API key prefixes (sk-, ghp_, AKIA, xoxb-, etc.) or long base64-like strings may expose secrets in source code.

server.json:39
"fileSha256": "aea76f179ceb92d22c289147c9d8343fb558d6dec93b144c9794e99239bb8194",
How to fix

Remove hardcoded secrets from source code. Use environment variables or a secrets manager.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

packages/cli/src/utils/auth.ts:197
server.listen(CALLBACK_PORT, "127.0.0.1", () => {
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

packages/mcp/src/index.ts:478
const httpServer = app.listen(port);
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.