MCP Scanner
ScanLeaderboardDocsSign in
Home/modelcontextprotocol/typescript-sdk/Results
0F

typescript-sdk

modelcontextprotocol/typescript-sdk

284 files · 999 findings

Share GitHub SARIF JSON
17 critical153 high185 medium644 low
Tool Poisoningclean
Command Injectionclean
Path Traversal3 issues
SSRF83 issues
Credential Theft17 issues
Excessive Permissions1 issue
Missing Auth131 issues
Supply Chain25

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/claude.yml:30
uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

Credential Theft17

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

examples/client-quickstart/src/index.ts:21
return this._anthropic ??= new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Logging Deficiency669

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client-quickstart/src/index.ts:49
console.log('Connected to server with tools:', this.tools.map(({ name }) => name));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

SSRF83

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/client/src/clientGuide.examples.ts:38
const transport = new StreamableHTTPClientTransport(new URL('http://localhost:3000/mcp'));
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Missing Auth131

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/dualModeAuth.ts:16
* USER-CONFIGURED — OAuth credentials supplied directly
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Path Traversal3

Windows-style path traversal patterns

high

Backslash-based directory traversal patterns targeting Windows file systems.

examples/client/src/elicitationUrlExample.ts:258
console.log('✅ All queued elicitations processed. Resuming command loop...\n');
How to fix

Normalize path separators and apply traversal checks for both forward and backslashes.

Insecure Communication21

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

examples/client/src/elicitationUrlExample.ts:445
const server = createServer((req, res) => {
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Data Exfiltration34

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

examples/server/src/elicitationFormExample.ts:406
res.status(400).send('Missing session ID');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Shadow MCP Server13

Multiple MCP server instantiations in single file

medium

Detected multiple McpServer or Server instantiations in a single file. Multiple server instances in one project may indicate a shadow MCP server that intercepts or duplicates tool traffic without authorization.

examples/server/src/serverGuide.examples.ts:27
const server = new McpServer(
How to fix

Consolidate MCP server instances into a single, well-documented server. Remove any duplicate or shadow server instantiations.

Excessive Permissions1

sudo command usage

high

Using sudo in scripts escalates privileges and may allow unintended system-wide modifications.

packages/client/src/client/stdio.ts:62
: /* list inspired by the default env inheritance of sudo */
How to fix

Remove sudo usage. Run processes with the minimum required privileges.

Runtime Tool Poisoning2

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

packages/server/src/server/mcp.ts:726
if (updates.description !== undefined) registeredPrompt.description = updates.description;
How to fix
Supply Chain
25 issues
Rug Pullclean
Data Exfiltration34 issues
Insecure Communication21 issues
Excessive Data Exposureclean
Logging Deficiency669 issues
Runtime Tool Poisoning2 issues
Shadow MCP Server13 issues

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/claude.yml:36
uses: anthropics/claude-code-action@v1
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/conformance.yml:21
- uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/conformance.yml:26
- uses: actions/setup-node@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/conformance.yml:39
- uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/conformance.yml:44
- uses: actions/setup-node@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/deploy-docs.yml:28
- uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/deploy-docs.yml:34
- uses: actions/setup-node@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/deploy-docs.yml:44
uses: actions/configure-pages@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/deploy-docs.yml:47
uses: actions/upload-pages-artifact@v4
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/deploy-docs.yml:53
uses: actions/deploy-pages@v5
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/main.yml:17
- uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/main.yml:24
- uses: actions/setup-node@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/main.yml:42
- uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/main.yml:49
- uses: actions/setup-node@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/main.yml:70
- uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/main.yml:75
- uses: actions/setup-node@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/publish.yml:19
- uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/publish.yml:27
uses: actions/setup-node@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/release.yml:20
- uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/release.yml:28
uses: actions/setup-node@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/release.yml:53
- uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/release.yml:61
uses: actions/setup-node@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/update-spec-types.yml:18
uses: actions/checkout@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

GitHub Actions with unpinned actions

high

Using GitHub Actions with branch references instead of SHA pins enables supply chain attacks.

.github/workflows/update-spec-types.yml:27
uses: actions/setup-node@v6
How to fix

Pin GitHub Actions to full commit SHAs: uses: actions/checkout@abc123...

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

examples/client-quickstart/src/index.ts:167
const apiKey = process.env.ANTHROPIC_API_KEY;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

examples/client/src/dualModeAuth.ts:89
const session: HostSessionStore = { getMcpToken: () => process.env.MCP_TOKEN };
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

examples/client/src/dualModeAuth.ts:93
const clientId = process.env.OAUTH_CLIENT_ID;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

examples/client/src/dualModeAuth.ts:94
const clientSecret = process.env.OAUTH_CLIENT_SECRET;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

examples/client/src/simpleClientCredentials.ts:34
const privateKeyPem = process.env.MCP_CLIENT_PRIVATE_KEY_PEM;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

examples/client/src/simpleClientCredentials.ts:46
const clientSecret = process.env.MCP_CLIENT_SECRET;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

examples/client/src/simpleTokenProvider.ts:24
const token = process.env.MCP_TOKEN;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

examples/server/src/elicitationUrlExample.ts:219
const AUTH_PORT = process.env.MCP_AUTH_PORT ? Number.parseInt(process.env.MCP_AUTH_PORT, 10) : 3001;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

examples/server/src/elicitationUrlExample.ts:219
const AUTH_PORT = process.env.MCP_AUTH_PORT ? Number.parseInt(process.env.MCP_AUTH_PORT, 10) : 3001;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

examples/server/src/simpleStreamableHttp.ts:606
const AUTH_PORT = process.env.MCP_AUTH_PORT ? Number.parseInt(process.env.MCP_AUTH_PORT, 10) : 3001;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

examples/server/src/simpleStreamableHttp.ts:606
const AUTH_PORT = process.env.MCP_AUTH_PORT ? Number.parseInt(process.env.MCP_AUTH_PORT, 10) : 3001;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Base64 encoding of sensitive data

high

Encoding environment variables or credential file contents to Base64 is a common exfiltration obfuscation technique.

packages/client/src/client/auth.ts:488
const credentials = btoa(`${clientId}:${clientSecret}`);
How to fix

Remove Base64 encoding of credentials. If encoding is needed, use a proper encryption library.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

packages/client/src/client/auth.ts:61
* const authProvider: AuthProvider = { token: async () => process.env.API_KEY };
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

test/conformance/src/authTestServer.ts:34
const AUTH_SERVER_URL = process.env.MCP_CONFORMANCE_AUTH_SERVER_URL;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Hardcoded API key or token literal

critical

String literals matching known API key prefixes (sk-, ghp_, AKIA, xoxb-, etc.) or long base64-like strings may expose secrets in source code.

test/conformance/src/everythingServer.ts:62
const TEST_IMAGE_BASE64 = 'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFBQIAX8jx0gAAAABJRU5ErkJggg==';
How to fix

Remove hardcoded secrets from source code. Use environment variables or a secrets manager.

Hardcoded API key or token literal

critical

String literals matching known API key prefixes (sk-, ghp_, AKIA, xoxb-, etc.) or long base64-like strings may expose secrets in source code.

test/conformance/src/everythingServer.ts:65
const TEST_AUDIO_BASE64 = 'UklGRiYAAABXQVZFZm10IBAAAAABAAEAQB8AAAB9AAACABAAZGF0YQIAAAA=';
How to fix

Remove hardcoded secrets from source code. Use environment variables or a secrets manager.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client-quickstart/src/index.ts:51
console.log('Failed to connect to MCP server: ', e);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client-quickstart/src/index.ts:134
console.log('\nMCP Client Started!');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client-quickstart/src/index.ts:135
console.log('Type your queries or "quit" to exit.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client-quickstart/src/index.ts:143
console.log('\n' + response);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client-quickstart/src/index.ts:159
console.log('Usage: node build/index.js <path_to_server_script>');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client-quickstart/src/index.ts:169
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:102
console.log(systemPrompt);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:191
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:200
console.log(result.content);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:214
console.log(result.structuredContent); // e.g. { bmi: 22.86 }
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:226
console.log(`Progress: ${progress}/${total ?? '?'}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:232
console.log(result.content);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:246
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:253
console.log(item);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:266
console.log('Config updated:', contents);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:285
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:292
arguments: { code: 'console.log("hello")' }
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:294
console.log(messages);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:311
console.log(completion.values); // e.g. ['typescript']
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:325
console.log(`[${level}]`, data);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:331
console.log('Resources changed:', resources.length);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:356
console.log('Tools updated:', tools);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:360
onChanged: (error, prompts) => console.log('Prompts updated:', prompts)
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:394
console.log('Sampling request:', lastMessage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:413
console.log('Server asks:', request.params.message);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:417
console.log('Schema:', request.params.requestedSchema);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:459
console.log('Success:', result.content);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:483
console.log('Connection closed');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:496
console.log(result.content);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/clientGuide.examples.ts:543
console.log(result);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

examples/client/src/dualModeAuth.ts:96
console.error('OAUTH_CLIENT_ID and OAUTH_CLIENT_SECRET required for oauth mode');
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/dualModeAuth.ts:74
console.log('Tools:', tools.tools.map(t => t.name).join(', ') || '(none)');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

examples/client/src/dualModeAuth.ts:74
console.log('Tools:', tools.tools.map(t => t.name).join(', ') || '(none)');
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

examples/client/src/elicitationUrlExample.ts:36
console.log('Getting OAuth token...');
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

examples/client/src/elicitationUrlExample.ts:127
console.log('  third-party-auth           - Test tool that requires third-party OAuth credentials');
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:36
console.log('Getting OAuth token...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:46
console.log(`🌐 Opening browser for OAuth redirect: ${redirectUrl.toString()}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:87
console.log('MCP Interactive Client');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:88
console.log('=====================');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:119
console.log('\nAvailable commands:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:120
console.log('  connect [url]              - Connect to MCP server (default: http://localhost:3000/mcp)');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:121
console.log('  disconnect                 - Disconnect from server');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:122
console.log('  terminate-session          - Terminate the current session');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:123
console.log('  reconnect                  - Reconnect to the server');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:124
console.log('  list-tools                 - List available tools');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:125
console.log('  call-tool <name> [args]    - Call a tool with optional JSON arguments');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:126
console.log('  payment-confirm            - Test URL elicitation via error response with payment-confirm tool');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:127
console.log('  third-party-auth           - Test tool that requires third-party OAuth credentials');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:128
console.log('  help                       - Show this help');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:129
console.log('  quit                       - Exit the program');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:176
console.log('Usage: call-tool <name> [args]');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:184
console.log('Invalid JSON arguments. Using empty args.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:215
console.log(`Unknown command: ${command}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:248
console.log(`📤 Processing queued elicitation (${elicitationQueue.length} remaining)`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:258
console.log('✅ All queued elicitations processed. Resuming command loop...\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:289
console.log(`Please manually open: ${url}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:305
console.log('📋 Processing elicitation immediately (during command execution)');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:310
console.log(`📥 Queueing elicitation request (queue size will be: ${elicitationQueue.length + 1})`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:337
console.log('\n🔔 Elicitation Request Received:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:338
console.log(`Mode: ${mode}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:364
console.log(`🆔 Elicitation ID: ${elicitationId}`); // Print for illustration
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:377
console.log('\n⚠️  \u001B[33mSECURITY WARNING\u001B[0m ⚠️');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:378
console.log('\u001B[33mThe server is requesting you to open an external URL.\u001B[0m');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:379
console.log('\u001B[33mOnly proceed if you trust this server and understand why it needs this.\u001B[0m\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:380
console.log(`🌐 Target domain: \u001B[36m${domain}\u001B[0m`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:381
console.log(`🔗 Full URL: \u001B[36m${url}\u001B[0m`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:382
console.log(`\nℹ️ Server's reason:\n\n\u001B[36m${message}\u001B[0m\n`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:393
console.log('❌ URL navigation declined.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:396
console.log('🚫 Invalid response. Cancelling elicitation.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:405
console.log(`\u001B[31m❌ Elicitation ${elicitationId} timed out waiting for completion.\u001B[0m`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:426
console.log(`\n🚀 Opening browser to: ${url}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:429
console.log('\n⏳ Waiting for you to complete the interaction in your browser...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:430
console.log('   The server will send a notification once you complete the action.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:453
console.log(`📥 Received callback: ${req.url}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:459
console.log(`✅ Authorization code received: ${code?.slice(0, 10)}...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:475
console.log(`❌ Authorization error: ${error}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:487
console.log(`❌ No authorization code or error in callback`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:495
console.log(`OAuth callback server started on http://localhost:${OAUTH_CALLBACK_PORT}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:505
console.log('🚢 Creating transport with OAuth provider...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:511
console.log('🚢 Transport created');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:514
console.log('🔌 Attempting connection (this will trigger OAuth redirect if needed)...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:517
console.log('Transport created with session ID:', sessionId);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:518
console.log('✅ Connected successfully');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:521
console.log('🔐 OAuth required - waiting for authorization...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:525
console.log('🔐 Authorization code received:', authCode);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:526
console.log('🔌 Reconnecting with authenticated transport...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:538
console.log('Already connected. Disconnect first.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:546
console.log(`🔗 Attempting to connect to ${serverUrl}...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:549
console.log('👤 Creating MCP client...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:565
console.log('👤 Client created');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:577
console.log(`\u001B[32m✅ Elicitation ${elicitationId} completed!\u001B[0m`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:586
console.log('🔐 Starting OAuth flow...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:588
console.log('Connected to MCP server');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:604
console.log('Not connected.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:610
console.log('Disconnected from MCP server');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:620
console.log('Not connected.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:625
console.log('Terminating session with ID:', transport.sessionId);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:627
console.log('Session terminated successfully');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:631
console.log('Server responded with 405 Method Not Allowed (session termination not supported)');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:632
console.log('Session ID is still active:', transport.sessionId);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:634
console.log('Session ID has been cleared');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:639
console.log('Transport closed after session termination');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:657
console.log('Not connected to server.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:668
console.log('Available tools:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:670
console.log('  No tools available');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:673
console.log(`  - id: ${tool.name}, name: ${getDisplayName(tool)}, description: ${tool.description}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:677
console.log(`Tools not supported by this server (${error})`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:683
console.log('Not connected to server.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:688
console.log(`Calling tool '${name}' with args:`, args);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:691
console.log('Tool result:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:697
console.log(`  ${item.text}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:704
console.log(`  📁 Resource Link: ${resourceLink.name}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:705
console.log(`     URI: ${resourceLink.uri}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:707
console.log(`     Type: ${resourceLink.mimeType}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:710
console.log(`     Description: ${resourceLink.description}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:716
console.log(`  [Embedded Resource: ${item.resource.uri}]`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:721
console.log(`  [Image: ${item.mimeType}]`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:726
console.log(`  [Audio: ${item.mimeType}]`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:731
console.log(`  [Unknown content type]:`, item);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:738
console.log(`\nFound ${resourceLinks.length} resource link(s). Use 'read-resource <uri>' to read their content.`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:742
console.log('\n🔔 Elicitation Required Error Received:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:743
console.log(`Message: ${error.message}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:749
console.log(`Error calling tool ${name}: ${error}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:759
console.log('Terminating session before exit...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:761
console.log('Session terminated successfully');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:776
console.log('\nGoodbye!');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:782
console.log('Calling payment-confirm tool...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:787
console.log('Calling third-party-auth tool...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:796
console.log('\nESC key pressed. Disconnecting from server...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:801
console.log('Disconnected. Press Enter to continue.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:803
console.log('Not connected to server.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/elicitationUrlExample.ts:813
console.log('\nReceived SIGINT. Cleaning up...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/multipleClientsParallel.ts:25
console.log(`[${config.id}] Creating client: ${config.name}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/multipleClientsParallel.ts:41
console.log(`[${config.id}] Notification: ${notification.params.data}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/multipleClientsParallel.ts:47
console.log(`[${config.id}] Connected to MCP server`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/multipleClientsParallel.ts:50
console.log(`[${config.id}] Calling tool: ${config.toolName}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/multipleClientsParallel.ts:59
console.log(`[${config.id}] Tool call completed`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/multipleClientsParallel.ts:66
console.log(`[${config.id}] Disconnected from MCP server`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/multipleClientsParallel.ts:76
console.log('MCP Multiple Clients Example');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/multipleClientsParallel.ts:77
console.log('============================');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/multipleClientsParallel.ts:78
console.log(`Server URL: ${serverUrl}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/multipleClientsParallel.ts:79
console.log('');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/multipleClientsParallel.ts:114
console.log(`Starting ${clientConfigs.length} clients in parallel...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/multipleClientsParallel.ts:115
console.log('');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/multipleClientsParallel.ts:121
console.log('\n=== Final Results ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/multipleClientsParallel.ts:123
console.log(`\n[${id}] Tool result:`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/multipleClientsParallel.ts:127
console.log(`  ${item.text}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/multipleClientsParallel.ts:129
console.log(`  ${item.type} content:`, item);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/multipleClientsParallel.ts:133
console.log(`  Unexpected result format:`, result);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/multipleClientsParallel.ts:137
console.log('\n=== All clients completed successfully ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/parallelToolCallsClient.ts:17
console.log('MCP Parallel Tool Calls Client');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/parallelToolCallsClient.ts:18
console.log('==============================');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/parallelToolCallsClient.ts:19
console.log(`Connecting to server at: ${serverUrl}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/parallelToolCallsClient.ts:38
console.log('Successfully connected to MCP server');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/parallelToolCallsClient.ts:42
console.log(`Notification: ${notification.params.data}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/parallelToolCallsClient.ts:45
console.log('List tools');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/parallelToolCallsClient.ts:47
console.log('Tools:', toolsRequest);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/parallelToolCallsClient.ts:50
console.log('\n=== Starting Multiple Notification Streams in Parallel ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/parallelToolCallsClient.ts:55
console.log(`\n=== Tool result for ${caller} ===`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/parallelToolCallsClient.ts:58
console.log(`  ${item.text}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/parallelToolCallsClient.ts:60
console.log(`  ${item.type} content:`, item);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/parallelToolCallsClient.ts:66
console.log('\n=== Waiting for all notifications ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/parallelToolCallsClient.ts:70
console.log('\n=== Disconnecting ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/parallelToolCallsClient.ts:72
console.log('Disconnected from MCP server');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/parallelToolCallsClient.ts:91
console.log('Available tools:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/parallelToolCallsClient.ts:93
console.log('  No tools available');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/parallelToolCallsClient.ts:96
console.log(`  - ${tool.name}: ${tool.description}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/parallelToolCallsClient.ts:100
console.log(`Tools not supported by this server: ${error}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/parallelToolCallsClient.ts:138
console.log(`Starting ${toolCalls.length} notification tools in parallel...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/parallelToolCallsClient.ts:142
console.log(`Starting tool call for ${caller}...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

examples/client/src/simpleClientCredentials.ts:37
console.log('Using private_key_jwt authentication');
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

examples/client/src/simpleClientCredentials.ts:48
console.error('MCP_CLIENT_SECRET or MCP_CLIENT_PRIVATE_KEY_PEM environment variable is required');
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

examples/client/src/simpleClientCredentials.ts:52
console.log('Using client_secret_basic authentication');
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleClientCredentials.ts:37
console.log('Using private_key_jwt authentication');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleClientCredentials.ts:52
console.log('Using client_secret_basic authentication');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleClientCredentials.ts:69
console.log('Connected successfully.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleClientCredentials.ts:72
console.log('Available tools:', tools.tools.map(t => t.name).join(', ') || '(none)');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

examples/client/src/simpleClientCredentials.ts:72
console.log('Available tools:', tools.tools.map(t => t.name).join(', ') || '(none)');
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:49
console.log(`🌐 Opening browser for authorization: ${url}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:65
console.log(`Please manually open: ${url}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:85
console.log(`📥 Received callback: ${req.url}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:91
console.log(`✅ Authorization code received: ${code?.slice(0, 10)}...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:106
console.log(`❌ Authorization error: ${error}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:118
console.log(`❌ No authorization code or error in callback`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:126
console.log(`OAuth callback server started on http://localhost:${CALLBACK_PORT}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:132
console.log('🚢 Creating transport with OAuth provider...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:137
console.log('🚢 Transport created');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:140
console.log('🔌 Attempting connection (this will trigger OAuth redirect)...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:142
console.log('✅ Connected successfully');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:145
console.log('🔐 OAuth required - waiting for authorization...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:149
console.log('🔐 Authorization code received:', authCode);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:150
console.log('🔌 Reconnecting with authenticated transport...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:163
console.log(`🔗 Attempting to connect to ${this.serverUrl}...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:173
console.log('🔐 Creating OAuth provider...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:178
console.log(`📌 OAuth redirect handler called - opening browser`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:179
console.log(`Opening browser to: ${redirectUrl.toString()}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:184
console.log('🔐 OAuth provider created');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:186
console.log('👤 Creating MCP client...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:194
console.log('👤 Client created');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:196
console.log('🔐 Starting OAuth flow...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:208
console.log('\n🎯 Interactive MCP Client with OAuth');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:209
console.log('Commands:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:210
console.log('  list - List available tools');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:211
console.log('  call <tool_name> [args] - Call a tool');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:212
console.log('  stream <tool_name> [args] - Call a tool with streaming (shows task status)');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:213
console.log('  quit - Exit the client');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:214
console.log();
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:225
console.log('\n👋 Goodbye!');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:235
console.log("❌ Unknown command. Try 'list', 'call <tool_name>', 'stream <tool_name>', or 'quit'");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:239
console.log('\n\n👋 Goodbye!');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:249
console.log('❌ Not connected to server');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:262
console.log('\n📋 Available tools:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:264
console.log(`${index + 1}. ${tool.name}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:266
console.log(`   Description: ${tool.description}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:268
console.log();
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:271
console.log('No tools available');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:283
console.log('❌ Please specify a tool name');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:294
console.log('❌ Invalid arguments format (expected JSON)');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:304
console.log('❌ Not connected to server');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:314
console.log(`\n🔧 Tool '${toolName}' result:`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:318
console.log(content.text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:320
console.log(content);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:324
console.log(result);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:336
console.log('❌ Please specify a tool name');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:347
console.log('❌ Invalid arguments format (expected JSON)');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:357
console.log('❌ Not connected to server');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:363
console.log(`\n🔧 Streaming tool '${toolName}'...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:382
console.log(`✓ Task created: ${message.task.taskId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:387
console.log(`⟳ Status: ${message.task.status}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:389
console.log(`  ${message.task.statusMessage}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:395
console.log('✓ Completed!');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:399
console.log(content.text);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:401
console.log(content);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:408
console.log('✗ Error:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:409
console.log(`  ${message.error.message}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:436
console.log('🚀 Simple MCP OAuth Client');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:437
console.log(`Connecting to: ${serverUrl}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:439
console.log(`Client Metadata URL: ${clientMetadataUrl}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:441
console.log();
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClient.ts:447
console.log('\n\n👋 Goodbye!');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleOAuthClientProvider.ts:21
console.log(`Redirect to: ${url.toString()}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

examples/client/src/simpleStreamableHttp.ts:738
console.log(`Using resumption token: ${notificationsToolLastEventId || 'none'}`);
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

examples/client/src/simpleStreamableHttp.ts:742
console.log(`Updated resumption token: ${event}`);
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:40
console.log('MCP Interactive Client');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:41
console.log('=====================');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:52
console.log('\nAvailable commands:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:53
console.log('  connect [url]              - Connect to MCP server (default: http://localhost:3000/mcp)');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:54
console.log('  disconnect                 - Disconnect from server');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:55
console.log('  terminate-session          - Terminate the current session');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:56
console.log('  reconnect                  - Reconnect to the server');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:57
console.log('  list-tools                 - List available tools');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:58
console.log('  call-tool <name> [args]    - Call a tool with optional JSON arguments');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:59
console.log('  call-tool-task <name> [args] - Call a tool with task-based execution (example: call-tool-task delay {"duration":3000})');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:60
console.log('  greet [name]               - Call the greet tool');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:61
console.log('  multi-greet [name]         - Call the multi-greet tool with notifications');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:62
console.log('  collect-info [type]        - Test form elicitation with collect-user-info tool (contact/preferences/feedback)');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:63
console.log('  collect-info-task [type]   - Test bidirectional task support (server+client tasks) with elicitation');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:64
console.log('  start-notifications [interval] [count] - Start periodic notifications');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:65
console.log('  run-notifications-tool-with-resumability [interval] [count] - Run notification tool with resumability');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:66
console.log('  list-prompts               - List available prompts');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:67
console.log('  get-prompt [name] [args]   - Get a prompt with optional JSON arguments');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:68
console.log('  list-resources             - List available resources');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:69
console.log('  read-resource <uri>        - Read a specific resource by URI');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:70
console.log('  help                       - Show this help');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:71
console.log('  quit                       - Exit the program');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:108
console.log('Usage: call-tool <name> [args]');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:116
console.log('Invalid JSON arguments. Using empty args.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:160
console.log('Usage: call-tool-task <name> [args]');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:168
console.log('Invalid JSON arguments. Using empty args.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:183
console.log('Usage: get-prompt <name> [args]');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:191
console.log('Invalid JSON arguments. Using empty args.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:206
console.log('Usage: read-resource <uri>');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:226
console.log(`Unknown command: ${command}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:242
console.log('Already connected. Disconnect first.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:250
console.log(`Connecting to ${serverUrl}...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:287
console.log('\n🔔 Elicitation (form) Request Received:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:288
console.log(`Message: ${request.params.message}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:289
console.log(`Related Task: ${request.params._meta?.[RELATED_TASK_META_KEY]?.taskId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:290
console.log(`Task Creation Requested: ${request.params.task ? 'yes' : 'no'}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:291
console.log('Requested Schema:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:292
console.log(JSON.stringify(request.params.requestedSchema, null, 2));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:303
console.log(`📋 Created client-side task: ${task.taskId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:322
console.log(`\nPlease provide the following information (attempt ${attempts}/${maxAttempts}):`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:435
console.log(`❌ Error: ${error}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:451
console.log('Please try again...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:454
console.log('Maximum attempts reached. Declining request.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:463
console.log('❌ Validation errors:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:466
console.log(`  - ${error.instancePath || 'root'}: ${error.message}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:470
console.log('Please correct the errors and try again...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:473
console.log('Maximum attempts reached. Declining request.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:479
console.log('\n✅ Collected data:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:480
console.log(JSON.stringify(content, null, 2));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:503
console.log('Please re-enter the information...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:515
console.log('Maximum attempts reached. Declining request.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:526
console.log(`\nNotification #${notificationCount}: ${notification.params.level} - ${notification.params.data}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:532
console.log(`\nResource list changed notification received!`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:535
console.log('Client disconnected, cannot fetch resources');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:542
console.log('Available resources count:', resourcesResult.resources.length);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:544
console.log('Failed to list resources after change notification');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:553
console.log('Transport created with session ID:', sessionId);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:554
console.log('Connected to MCP server');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:564
console.log('Not connected.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:570
console.log('Disconnected from MCP server');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:580
console.log('Not connected.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:585
console.log('Terminating session with ID:', transport.sessionId);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:587
console.log('Session terminated successfully');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:591
console.log('Server responded with 405 Method Not Allowed (session termination not supported)');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:592
console.log('Session ID is still active:', transport.sessionId);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:594
console.log('Session ID has been cleared');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:599
console.log('Transport closed after session termination');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:617
console.log('Not connected to server.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:628
console.log('Available tools:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:630
console.log('  No tools available');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:633
console.log(`  - id: ${tool.name}, name: ${getDisplayName(tool)}, description: ${tool.description}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:637
console.log(`Tools not supported by this server (${error})`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:643
console.log('Not connected to server.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:648
console.log(`Calling tool '${name}' with args:`, args);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:651
console.log('Tool result:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:657
console.log(`  ${item.text}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:664
console.log(`  📁 Resource Link: ${resourceLink.name}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:665
console.log(`     URI: ${resourceLink.uri}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:667
console.log(`     Type: ${resourceLink.mimeType}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:670
console.log(`     Description: ${resourceLink.description}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:676
console.log(`  [Embedded Resource: ${item.resource.uri}]`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:681
console.log(`  [Image: ${item.mimeType}]`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:686
console.log(`  [Audio: ${item.mimeType}]`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:691
console.log(`  [Unknown content type]:`, item);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:698
console.log(`\nFound ${resourceLinks.length} resource link(s). Use 'read-resource <uri>' to read their content.`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:701
console.log(`Error calling tool ${name}: ${error}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:710
console.log('Calling multi-greet tool with notifications...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:715
console.log(`Testing form elicitation with collect-user-info tool (${infoType})...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:720
console.log(`\n🔄 Testing bidirectional task support with collect-user-info-task tool (${infoType})...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:721
console.log('This will create a task on the server, which will elicit input and create a task on the client.\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:726
console.log(`Starting notification stream: interval=${interval}ms, count=${count || 'unlimited'}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:732
console.log('Not connected to server.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:737
console.log(`Starting notification stream with resumability: interval=${interval}ms, count=${count || 'unlimited'}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:738
console.log(`Using resumption token: ${notificationsToolLastEventId || 'none'}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:742
console.log(`Updated resumption token: ${event}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:753
console.log('Tool result:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:756
console.log(`  ${item.text}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:758
console.log(`  ${item.type} content:`, item);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:762
console.log(`Error starting notification stream: ${error}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:768
console.log('Not connected to server.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:778
console.log('Available prompts:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:780
console.log('  No prompts available');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:783
console.log(`  - id: ${prompt.name}, name: ${getDisplayName(prompt)}, description: ${prompt.description}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:787
console.log(`Prompts not supported by this server (${error})`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:793
console.log('Not connected to server.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:807
console.log('Prompt template:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:809
console.log(`  [${index + 1}] ${msg.role}: ${msg.content.type === 'text' ? msg.content.text : JSON.stringify(msg.content)}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:812
console.log(`Error getting prompt ${name}: ${error}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:818
console.log('Not connected to server.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:829
console.log('Available resources:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:831
console.log('  No resources available');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:834
console.log(`  - id: ${resource.name}, name: ${getDisplayName(resource)}, description: ${resource.uri}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:838
console.log(`Resources not supported by this server (${error})`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:844
console.log('Not connected to server.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:854
console.log(`Reading resource: ${uri}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:857
console.log('Resource contents:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:859
console.log(`  URI: ${content.uri}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:861
console.log(`  Type: ${content.mimeType}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:865
console.log('  Content:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:866
console.log('  ---');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:867
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:873
console.log('  ---');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:875
console.log(`  [Binary data: ${content.blob.length} bytes]`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:879
console.log(`Error reading resource ${uri}: ${error}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:885
console.log('Not connected to server.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:889
console.log(`Calling tool '${name}' with task-based execution...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:890
console.log('Arguments:', args);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:894
console.log('This will return immediately while processing continues in the background...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:910
console.log('Waiting for task completion...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:916
console.log('Task created successfully with ID:', message.task.taskId);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:921
console.log(`  ${message.task.status}${message.task.statusMessage ? ` - ${message.task.statusMessage}` : ''}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:927
console.log('Task completed!');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:928
console.log('Tool result:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:932
console.log(`  ${item.text}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:943
console.log(`Error with task-based execution: ${error}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:953
console.log('Terminating session before exit...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:955
console.log('Session terminated successfully');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:970
console.log('\nGoodbye!');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:980
console.log('\nESC key pressed. Disconnecting from server...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:985
console.log('Disconnected. Press Enter to continue.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:987
console.log('Not connected to server.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleStreamableHttp.ts:997
console.log('\nReceived SIGINT. Cleaning up...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

examples/client/src/simpleStreamableHttp.ts:738
console.log(`Using resumption token: ${notificationsToolLastEventId || 'none'}`);
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTaskInteractiveClient.ts:39
console.log(`\n[Elicitation] Server asks: ${params.message}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTaskInteractiveClient.ts:45
console.log(`[Elicitation] Responding with: confirm=${confirmed}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTaskInteractiveClient.ts:65
console.log(`\n[Sampling] Server requests LLM completion for: ${prompt}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTaskInteractiveClient.ts:72
console.log('[Sampling] Responding with haiku');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTaskInteractiveClient.ts:81
console.log('Simple Task Interactive Client');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTaskInteractiveClient.ts:82
console.log('==============================');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTaskInteractiveClient.ts:83
console.log(`Connecting to ${url}...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTaskInteractiveClient.ts:112
console.log('Connected!\n');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTaskInteractiveClient.ts:116
console.log(`Available tools: ${toolsResult.tools.map(t => t.name).join(', ')}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTaskInteractiveClient.ts:119
console.log('\n--- Demo 1: Elicitation ---');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTaskInteractiveClient.ts:120
console.log('Calling confirm_delete tool...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTaskInteractiveClient.ts:130
console.log(`Task created: ${message.task.taskId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTaskInteractiveClient.ts:134
console.log(`Task status: ${message.task.status}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTaskInteractiveClient.ts:139
console.log(`Result: ${getTextContent(toolResult)}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTaskInteractiveClient.ts:150
console.log('\n--- Demo 2: Sampling ---');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTaskInteractiveClient.ts:151
console.log('Calling write_haiku tool...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTaskInteractiveClient.ts:161
console.log(`Task created: ${message.task.taskId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTaskInteractiveClient.ts:165
console.log(`Task status: ${message.task.status}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTaskInteractiveClient.ts:170
console.log(`Result:\n${getTextContent(toolResult)}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTaskInteractiveClient.ts:181
console.log('\nDemo complete. Closing connection...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

examples/client/src/simpleTokenProvider.ts:26
console.error('MCP_TOKEN environment variable is required');
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTokenProvider.ts:42
console.log('Connected successfully.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/simpleTokenProvider.ts:45
console.log('Available tools:', tools.tools.map(t => t.name).join(', ') || '(none)');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

examples/client/src/simpleTokenProvider.ts:45
console.log('Available tools:', tools.tools.map(t => t.name).join(', ') || '(none)');
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

examples/client/src/ssePollingClient.ts:85
console.log(`[Event ID] ${token}`);
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/ssePollingClient.ts:20
console.log('SSE Polling Example Client');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/ssePollingClient.ts:21
console.log('==========================');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/ssePollingClient.ts:22
console.log(`Connecting to ${SERVER_URL}...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/ssePollingClient.ts:23
console.log('');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/ssePollingClient.ts:40
console.log('[Transport] SSE stream disconnected - client will auto-reconnect');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/ssePollingClient.ts:43
console.log(`[Transport] Error: ${error.message}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/ssePollingClient.ts:48
console.log('[Transport] Connection closed');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/ssePollingClient.ts:60
console.log(`[Notification] ${data}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/ssePollingClient.ts:65
console.log('[Client] Connected successfully');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/ssePollingClient.ts:66
console.log('');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/ssePollingClient.ts:69
console.log('[Client] Calling long-task tool...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/ssePollingClient.ts:70
console.log('[Client] Server will disconnect mid-task to demonstrate polling');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/ssePollingClient.ts:71
console.log('');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/ssePollingClient.ts:85
console.log(`[Event ID] ${token}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/ssePollingClient.ts:90
console.log('');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/ssePollingClient.ts:91
console.log('[Client] Tool completed!');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/ssePollingClient.ts:92
console.log(`[Result] ${JSON.stringify(result.content, null, 2)}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/ssePollingClient.ts:93
console.log('');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/ssePollingClient.ts:94
console.log(`[Debug] Final event ID: ${lastEventId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/ssePollingClient.ts:99
console.log('[Client] Disconnected');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:21
console.log('MCP Backwards Compatible Client');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:22
console.log('===============================');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:23
console.log(`Connecting to server at: ${serverUrl}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:36
console.log(`Notification: ${notification.params.level} - ${notification.params.data}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:41
console.log('\n=== Listing Available Tools ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:45
console.log('\n=== Starting Notification Stream ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:49
console.log('\n=== Waiting for all notifications ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:53
console.log('\n=== Disconnecting ===');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:55
console.log('Disconnected from MCP server');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:72
console.log('1. Trying Streamable HTTP transport first...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:90
console.log('Successfully connected using modern Streamable HTTP transport.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:98
console.log(`StreamableHttp transport connection failed: ${error}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:99
console.log('2. Falling back to deprecated HTTP+SSE transport...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:110
console.log('Successfully connected using deprecated HTTP+SSE transport.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:134
console.log('Available tools:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:136
console.log('  No tools available');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:139
console.log(`  - ${tool.name}: ${tool.description}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:143
console.log(`Tools not supported by this server: ${error}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:152
console.log('Calling notification tool...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:161
console.log('Tool result:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:164
console.log(`  ${item.text}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:166
console.log(`  ${item.type} content:`, item);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/client/src/streamableHttpWithSseFallbackClient.ts:170
console.log(`Error calling notification tool: ${error}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/customProtocolVersion.ts:63
console.log(`MCP server with custom protocol versions on port ${PORT}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/customProtocolVersion.ts:64
console.log(`Supported versions: ${CUSTOM_VERSIONS.join(', ')}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationFormExample.ts:333
console.log(`Received MCP request for session: ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationFormExample.ts:347
console.log(`Session initialized with ID: ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationFormExample.ts:356
console.log(`Transport closed for session ${sid}, removing from transports map`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationFormExample.ts:414
console.log(`Establishing SSE stream for session ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationFormExample.ts:433
console.log(`Received session termination request for session ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationFormExample.ts:455
console.log(`Form elicitation example server is running on http://localhost:${PORT}/mcp`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationFormExample.ts:456
console.log('Available tools:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationFormExample.ts:457
console.log('  - register_user: Collect user registration information');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationFormExample.ts:458
console.log('  - create_event: Multi-step event creation');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationFormExample.ts:459
console.log('  - update_shipping_address: Collect and validate address');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationFormExample.ts:460
console.log('\nConnect your MCP client to this server using the HTTP transport.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationFormExample.ts:465
console.log('Shutting down server...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationFormExample.ts:470
console.log(`Closing transport for session ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationFormExample.ts:477
console.log('Server shutdown complete');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

examples/server/src/elicitationUrlExample.ts:103
console.log(`Simulating OAuth token received for elicitation ${elicitationId}`);
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

examples/server/src/elicitationUrlExample.ts:365
console.log(`🔑 Received API key \u001B[32m${apiKey}\u001B[0m for session ${sessionId}`);
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationUrlExample.ts:103
console.log(`Simulating OAuth token received for elicitation ${elicitationId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationUrlExample.ts:145
console.log(`Cleaned up expired elicitation: ${id}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationUrlExample.ts:207
console.log(`Sending notifications/elicitation/complete notification for elicitation ${elicitationId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationUrlExample.ts:269
console.log('🔑 URL elicitation demo: Requesting API key from client...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationUrlExample.ts:282
console.log('🔑 URL elicitation demo: Client accepted the API key elicitation (now pending form submission)');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationUrlExample.ts:288
console.log('🔑 URL elicitation demo: Client declined to provide an API key');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationUrlExample.ts:365
console.log(`🔑 Received API key \u001B[32m${apiKey}\u001B[0m for session ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationUrlExample.ts:493
console.log(`💳 Payment confirmed for cart ${cartId || 'unknown'} by user ${userSession.name} (session ${sessionId})`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationUrlExample.ts:520
console.log(`💳 Payment cancelled for cart ${cartId || 'unknown'} by user ${userSession.name} (session ${sessionId})`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationUrlExample.ts:584
console.log(`Session initialized with ID: ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationUrlExample.ts:597
console.log(`Transport closed for session ${sid}, removing from transports map`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationUrlExample.ts:661
console.log(`Client reconnecting with Last-Event-ID: ${lastEventId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationUrlExample.ts:663
console.log(`Establishing new SSE stream for session ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationUrlExample.ts:677
console.log(`🔑 URL elicitation demo: Finished sending API key elicitation request for session ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationUrlExample.ts:701
console.log(`Received session termination request for session ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationUrlExample.ts:723
console.log(`MCP Streamable HTTP Server listening on port ${MCP_PORT}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationUrlExample.ts:724
console.log(`  Protected Resource Metadata: http://localhost:${MCP_PORT}/.well-known/oauth-protected-resource/mcp`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationUrlExample.ts:729
console.log('Shutting down server...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationUrlExample.ts:734
console.log(`Closing transport for session ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/elicitationUrlExample.ts:742
console.log('Server shutdown complete');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/honoWebStandardStreamableHttp.ts:66
console.log(`Starting Hono MCP server on port ${PORT}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/honoWebStandardStreamableHttp.ts:67
console.log(`Health check: http://localhost:${PORT}/health`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/honoWebStandardStreamableHttp.ts:68
console.log(`MCP endpoint: http://localhost:${PORT}/mcp`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/jsonResponseStreamableHttp.ts:86
console.log('Received MCP request:', req.body);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/jsonResponseStreamableHttp.ts:103
console.log(`Session initialized with ID: ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/jsonResponseStreamableHttp.ts:161
console.log(`MCP Streamable HTTP Server listening on port ${PORT}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/jsonResponseStreamableHttp.ts:166
console.log('Shutting down server...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleStatelessStreamableHttp.ts:108
console.log('Request closed');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleStatelessStreamableHttp.ts:128
console.log('Received GET MCP request');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleStatelessStreamableHttp.ts:142
console.log('Received DELETE MCP request');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleStatelessStreamableHttp.ts:163
console.log(`MCP Stateless Streamable HTTP Server listening on port ${PORT}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleStatelessStreamableHttp.ts:168
console.log('Shutting down server...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleStreamableHttp.ts:649
console.log(`Received MCP request for session: ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleStreamableHttp.ts:651
console.log('Request body:', req.body);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleStreamableHttp.ts:655
console.log('Authenticated user:', req.app.locals.auth);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleStreamableHttp.ts:671
console.log(`Session initialized with ID: ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleStreamableHttp.ts:680
console.log(`Transport closed for session ${sid}, removing from transports map`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleStreamableHttp.ts:746
console.log('Authenticated SSE connection from user:', req.app.locals.auth);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleStreamableHttp.ts:752
console.log(`Client reconnecting with Last-Event-ID: ${lastEventId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleStreamableHttp.ts:754
console.log(`Establishing new SSE stream for session ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleStreamableHttp.ts:780
console.log(`Received session termination request for session ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleStreamableHttp.ts:806
console.log(`MCP Streamable HTTP Server listening on port ${MCP_PORT}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleStreamableHttp.ts:808
console.log(`  Protected Resource Metadata: http://localhost:${MCP_PORT}/.well-known/oauth-protected-resource/mcp`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleStreamableHttp.ts:814
console.log('Shutting down server...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleStreamableHttp.ts:819
console.log(`Closing transport for session ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleStreamableHttp.ts:826
console.log('Server shutdown complete');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleTaskInteractive.ts:259
console.log(`[Server] Delivering queued ${message.type} message for task ${taskId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleTaskInteractive.ts:527
console.log(`\n[Server] ${name} called, task created: ${task.taskId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleTaskInteractive.ts:536
console.log(`[Server] confirm_delete: asking about '${filename}'`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleTaskInteractive.ts:538
console.log('[Server] Sending elicitation request to client...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleTaskInteractive.ts:547
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleTaskInteractive.ts:559
console.log(`[Server] Completing task with result: ${text}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleTaskInteractive.ts:565
console.log(`[Server] write_haiku: topic '${topic}'`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleTaskInteractive.ts:567
console.log('[Server] Sending sampling request to client...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleTaskInteractive.ts:583
console.log(`[Server] Received sampling response: ${haiku.slice(0, 50)}...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleTaskInteractive.ts:584
console.log('[Server] Completing task with haiku');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleTaskInteractive.ts:622
console.log(`[Server] tasks/result called for task ${taskId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleTaskInteractive.ts:656
console.log(`Session initialized: ${sid}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleTaskInteractive.ts:664
console.log(`Transport closed for session ${sid}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleTaskInteractive.ts:730
console.log(`Session termination request: ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleTaskInteractive.ts:737
console.log(`Starting server on http://localhost:${PORT}/mcp`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleTaskInteractive.ts:738
console.log('\nAvailable tools:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleTaskInteractive.ts:739
console.log('  - confirm_delete: Demonstrates elicitation (asks user y/n)');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleTaskInteractive.ts:740
console.log('  - write_haiku: Demonstrates sampling (requests LLM completion)');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleTaskInteractive.ts:745
console.log('\nShutting down server...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/simpleTaskInteractive.ts:756
console.log('Server shutdown complete');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/ssePollingExample.ts:47
console.log(`[${ctx.sessionId}] Starting long-task...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/ssePollingExample.ts:61
console.log(`[${ctx.sessionId}] Closing SSE stream to trigger client polling...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/ssePollingExample.ts:73
console.log(`[${ctx.sessionId}] Task complete`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/ssePollingExample.ts:112
console.log(`[${id}] Session initialized`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/ssePollingExample.ts:128
console.log(`SSE Polling Example Server running on http://localhost:${PORT}/mcp`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/ssePollingExample.ts:129
console.log('');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/ssePollingExample.ts:130
console.log('This server demonstrates SEP-1699 SSE polling:');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/ssePollingExample.ts:131
console.log('- retryInterval: 2000ms (client waits 2s before reconnecting)');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/ssePollingExample.ts:132
console.log('- eventStore: InMemoryEventStore (events are persisted for replay)');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/ssePollingExample.ts:133
console.log('');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/ssePollingExample.ts:134
console.log('Try calling the "long-task" tool to see server-initiated disconnect in action.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/standaloneSseWithGetStreamableHttp.ts:51
console.log('Received MCP request:', req.body);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/standaloneSseWithGetStreamableHttp.ts:68
console.log(`Session initialized with ID: ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/standaloneSseWithGetStreamableHttp.ts:134
console.log(`Establishing SSE stream for session ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/standaloneSseWithGetStreamableHttp.ts:147
console.log(`Server listening on port ${PORT}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/standaloneSseWithGetStreamableHttp.ts:152
console.log('Shutting down server...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/standaloneSseWithGetStreamableHttp.ts:158
console.log(`Closing transport for session ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/standaloneSseWithGetStreamableHttp.ts:166
console.log('Server shutdown complete');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/server/src/toolWithSampleServer.ts:50
console.log('MCP server is running...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

examples/shared/src/auth.ts:156
console.log('[Auth] Demo user credentials (auto-login):');
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

examples/shared/src/auth.ts:157
console.log(`[Auth]   Email:    ${DEMO_USER_CREDENTIALS.email}`);
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

examples/shared/src/auth.ts:158
console.log(`[Auth]   Password: ${DEMO_USER_CREDENTIALS.password}`);
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/auth.ts:154
console.log('[Auth] In-memory database schema initialized');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/auth.ts:155
console.log('[Auth] ========================================');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/auth.ts:156
console.log('[Auth] Demo user credentials (auto-login):');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/auth.ts:157
console.log(`[Auth]   Email:    ${DEMO_USER_CREDENTIALS.email}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/auth.ts:158
console.log(`[Auth]   Password: ${DEMO_USER_CREDENTIALS.password}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/auth.ts:159
console.log('[Auth] ========================================');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/auth.ts:235
console.log(`${timestamp} ${prefix} ${message}`, ...args);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/auth.ts:237
console.log(`${timestamp} ${prefix} ${message}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

examples/shared/src/authServer.ts:251
console.log(`  Token: ${authServerUrl}api/auth/mcp/token`);
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/authServer.ts:68
console.log('[Auth] Demo user created via signUpEmail');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/authServer.ts:74
console.log('[Auth] Demo user already exists');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/authServer.ts:124
console.log(`\n${'='.repeat(60)}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/authServer.ts:125
console.log(`${ts} [AUTH] ${req.method} ${req.originalUrl}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/authServer.ts:126
console.log(`${ts} [AUTH] Query:`, JSON.stringify(req.query));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/authServer.ts:127
console.log(`${ts} [AUTH] Headers.Cookie:`, req.headers.cookie?.slice(0, 100));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/authServer.ts:133
console.log(`${ts} [AUTH] >>> Response Status: ${statusCode}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/authServer.ts:138
console.log(`${ts} [AUTH] >>> Location (redirect): ${headers.location || headers.Location}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/authServer.ts:140
console.log(`${ts} [AUTH] >>> Headers:`, JSON.stringify(headers));
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/authServer.ts:151
console.log(`${ts} [AUTH] >>> Body: ${bodyPreview}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/authServer.ts:208
console.log('[Auth] Sign-in response status:', signInResponse.status);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/authServer.ts:212
console.log('[Auth] Set-Cookie headers:', setCookieHeaders);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/authServer.ts:218
console.log(`[Auth Server] Session created, redirecting to authorize`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/authServer.ts:249
console.log(`OAuth Authorization Server listening on port ${authPort}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/authServer.ts:250
console.log(`  Authorization: ${authServerUrl}api/auth/mcp/authorize`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/authServer.ts:251
console.log(`  Token: ${authServerUrl}api/auth/mcp/token`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

examples/shared/src/authServer.ts:252
console.log(`  Metadata: ${authServerUrl}.well-known/oauth-authorization-server`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

examples/shared/src/authServer.ts:26
* Examples should be used for **demo** only and not for production purposes, however this mode disables some logging and other features.
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

examples/shared/src/authServer.ts:89
const { authServerUrl, mcpServerUrl, demoMode, dangerousLoggingEnabled = false } = options;
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/client/client.examples.ts:32
console.log('Tools updated:', tools);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/client/client.examples.ts:36
onChanged: (error, prompts) => console.log('Prompts updated:', prompts)
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/client/client.examples.ts:96
console.log(result.content);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/client/client.examples.ts:112
console.log(result.structuredContent); // e.g. { bmi: 22.86 }
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/client/client.examples.ts:124
console.log('Sampling request:', lastMessage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/client/client.examples.ts:151
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/client/client.examples.ts:170
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/client/client.examples.ts:189
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/client/client.ts:184
*                     console.log('Tools updated:', tools);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/client/client.ts:188
*                 onChanged: (error, prompts) => console.log('Prompts updated:', prompts)
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/client/client.ts:322
*     console.log('Sampling request:', lastMessage);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/client/client.ts:754
* console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/client/client.ts:784
* console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/client/client.ts:854
* console.log(result.content);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/client/client.ts:866
*     console.log(result.structuredContent); // e.g. { bmi: 22.86 }
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/client/client.ts:984
* console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/client/middleware.examples.ts:48
console.log('Authentication failed');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/client/middleware.ts:184
console.log(message);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/client/middleware.ts:273
*         console.log('Authentication failed');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

packages/client/src/client/middleware.ts:159
const { logger, includeRequestHeaders = false, includeResponseHeaders = false, statusLevel = 0 } = options;
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/experimental/tasks/client.examples.ts:23
console.log('Tool execution started:', message.task.taskId);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/experimental/tasks/client.examples.ts:27
console.log('Tool status:', message.task.status);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/experimental/tasks/client.examples.ts:31
console.log('Tool result:', message.result);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/experimental/tasks/client.examples.ts:52
console.log('Task created:', message.task.taskId);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/experimental/tasks/client.examples.ts:56
console.log('Task status:', message.task.status);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/experimental/tasks/client.examples.ts:60
console.log('Final result:', message.result);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/experimental/tasks/client.ts:74
*             console.log('Tool execution started:', message.task.taskId);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/experimental/tasks/client.ts:78
*             console.log('Tool status:', message.task.status);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/experimental/tasks/client.ts:82
*             console.log('Tool result:', message.result);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/experimental/tasks/client.ts:241
*             console.log('Task created:', message.task.taskId);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/experimental/tasks/client.ts:245
*             console.log('Task status:', message.task.status);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/client/src/experimental/tasks/client.ts:249
*             console.log('Final result:', message.result);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/server/src/experimental/tasks/server.ts:88
*         console.log('Progress:', progress.message);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/server/src/experimental/tasks/server.ts:95
*             console.log('Task created:', message.task.taskId);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/server/src/experimental/tasks/server.ts:98
*             console.log('Task status:', message.task.status);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/server/src/experimental/tasks/server.ts:101
*             console.log('Final result:', message.result);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/server/src/experimental/tasks/server.ts:191
*             console.log('Task created:', message.task.taskId);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/server/src/experimental/tasks/server.ts:194
*             console.log('Task status:', message.task.status);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

packages/server/src/experimental/tasks/server.ts:197
*             console.log('User action:', message.result.action);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Disabled or suppressed security logging

medium

Detected patterns that disable, silence, or suppress logging or audit trails. Disabling security logging can mask malicious activity and hinder incident investigation.

packages/server/src/server/server.ts:203
return currentLevel ? this.LOG_LEVEL_SEVERITY.get(level)! < this.LOG_LEVEL_SEVERITY.get(currentLevel)! : false;
How to fix

Ensure security-related logging is always enabled in production. Never suppress audit trails or security event logs.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/cli.ts:43
console.log('Connected to server.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/cli.ts:46
console.log('Initialized.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/cli.ts:51
console.log('Closed.');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/cli.ts:61
console.log('Got new SSE connection');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/cli.ts:77
console.log('SSE connection closed');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/cli.ts:85
console.log('Received message');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/cli.ts:102
console.log(`Server running on http://localhost:${port}/sse`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/cli.ts:123
console.log('Server running on stdio');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/fetch-spec-types.ts:48
console.log(`Using provided SHA: ${providedSHA}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/fetch-spec-types.ts:51
console.log('Fetching latest commit SHA...');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/fetch-spec-types.ts:55
console.log(`Fetching spec.types.ts from commit: ${latestSHA}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/fetch-spec-types.ts:83
console.log('Successfully updated packages/core/src/types/spec.types.ts');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/sync-snippets.ts:531
console.log(
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/sync-snippets.ts:565
console.log(`Modified ${modified.length} file(s):`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/sync-snippets.ts:568
console.log(`   ${r.filePath} (${r.snippetsProcessed} snippet(s))`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/sync-snippets.ts:571
console.log('All snippets are up to date');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

scripts/sync-snippets.ts:587
console.log('\nSnippet sync complete!');
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/authTestServer.ts:253
console.log(`Fetching authorization server metadata from ${AUTH_SERVER_URL}...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/authTestServer.ts:261
console.log(`Using introspection endpoint: ${asMetadata.introspection_endpoint}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/authTestServer.ts:311
console.log(`Session initialized with ID: ${newSessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/authTestServer.ts:323
console.log(`Session ${sid} closed`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/authTestServer.ts:375
console.log(`Establishing SSE stream for session ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/authTestServer.ts:401
console.log(`Received session termination request for session ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/authTestServer.ts:416
console.log(`MCP Auth Test Server running at http://localhost:${PORT}/mcp`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/authTestServer.ts:417
console.log(`  - PRM endpoint: http://localhost:${PORT}/.well-known/oauth-protected-resource`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/authTestServer.ts:418
console.log(`  - Auth server: ${AUTH_SERVER_URL}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/authTestServer.ts:419
console.log(`  - Introspection: ${asMetadata.introspection_endpoint}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Sensitive data in log output

high

Detected console logging statements that reference sensitive fields such as password, secret, token, or API keys. Logging sensitive data can expose credentials in log files, monitoring systems, and log aggregation services.

test/conformance/src/everythingServer.ts:247
console.log('Progress token:', progressToken);
How to fix

Remove sensitive data from log statements. If you must reference sensitive fields, redact or mask them before logging.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/everythingServer.ts:247
console.log('Progress token:', progressToken);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/everythingServer.ts:308
console.log(`[${ctx.sessionId}] Starting test_reconnection tool...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/everythingServer.ts:314
console.log(`[${ctx.sessionId}] Closing SSE stream to trigger client polling...`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/everythingServer.ts:321
console.log(`[${ctx.sessionId}] test_reconnection tool complete`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/everythingServer.ts:913
console.log(`Session initialized with ID: ${newSessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/everythingServer.ts:925
console.log(`Session ${sid} closed`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/everythingServer.ts:979
console.log(`Client reconnecting with Last-Event-ID: ${lastEventId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/everythingServer.ts:981
console.log(`Establishing SSE stream for session ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/everythingServer.ts:1008
console.log(`Received session termination request for session ${sessionId}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/everythingServer.ts:1024
console.log(`MCP Conformance Test Server running on http://localhost:${PORT}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/everythingServer.ts:1025
console.log(`  - MCP endpoint: http://localhost:${PORT}/mcp`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

test/conformance/src/helpers/logger.ts:21
console.log(...args);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/client/src/clientGuide.examples.ts:115
const transport = new StreamableHTTPClientTransport(new URL('http://localhost:3000/mcp'), { authProvider });
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/client/src/clientGuide.examples.ts:130
const transport = new StreamableHTTPClientTransport(new URL('http://localhost:3000/mcp'), { authProvider });
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/client/src/clientGuide.examples.ts:145
const transport = new StreamableHTTPClientTransport(new URL('http://localhost:3000/mcp'), { authProvider });
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/client/src/clientGuide.examples.ts:172
const transport = new StreamableHTTPClientTransport(new URL('http://localhost:3000/mcp'), { authProvider });
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/client/src/clientGuide.examples.ts:518
const transport = new StreamableHTTPClientTransport(new URL('http://localhost:3000/mcp'), {
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

examples/client/src/clientGuide.examples.ts:432
{ uri: 'file:///home/user/projects/my-app', name: 'My App' },
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

examples/client/src/clientGuide.examples.ts:433
{ uri: 'file:///home/user/data', name: 'Data' }
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/client/src/dualModeAuth.ts:82
const serverUrl = new URL(process.env.MCP_SERVER_URL || 'http://localhost:3000/mcp');
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

examples/client/src/elicitationUrlExample.ts:666
const toolsResult = await client.request(toolsRequest);
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/client/src/elicitationUrlExample.ts:34
const OAUTH_CALLBACK_URL = `http://localhost:${OAUTH_CALLBACK_PORT}/callback`;
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/client/src/elicitationUrlExample.ts:60
let serverUrl = 'http://localhost:3000/mcp';
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/client/src/elicitationUrlExample.ts:454
const parsedUrl = new URL(req.url || '', 'http://localhost');
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/client/src/multipleClientsParallel.ts:15
const serverUrl = args[0] || 'http://localhost:3000/mcp';
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

examples/client/src/parallelToolCallsClient.ts:89
const toolsResult = await client.request(toolsRequest);
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/client/src/parallelToolCallsClient.ts:14
const serverUrl = args[0] || 'http://localhost:3000/mcp';
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/client/src/simpleClientCredentials.ts:24
const DEFAULT_SERVER_URL = process.env.MCP_SERVER_URL || 'http://localhost:3000/mcp';
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

examples/client/src/simpleOAuthClient.ts:259
const result = await this.client.request(request);
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/client/src/simpleOAuthClient.ts:14
const DEFAULT_SERVER_URL = 'http://localhost:3000/mcp';
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/client/src/simpleOAuthClient.ts:16
const CALLBACK_URL = `http://localhost:${CALLBACK_PORT}/callback`;
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/client/src/simpleOAuthClient.ts:86
const parsedUrl = new URL(req.url || '', 'http://localhost');
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

examples/client/src/simpleStreamableHttp.ts:626
const toolsResult = await client.request(toolsRequest);
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

examples/client/src/simpleStreamableHttp.ts:777
const promptsResult = await client.request(promptsRequest);
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

examples/client/src/simpleStreamableHttp.ts:806
const promptResult = await client.request(promptRequest);
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

examples/client/src/simpleStreamableHttp.ts:827
const resourcesResult = await client.request(resourcesRequest);
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

examples/client/src/simpleStreamableHttp.ts:855
const result = await client.request(request);
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/client/src/simpleStreamableHttp.ts:35
let serverUrl = 'http://localhost:3000/mcp';
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/client/src/simpleTaskInteractiveClient.ts:188
let url = 'http://localhost:8000/mcp';
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/client/src/simpleTokenProvider.ts:21
const DEFAULT_SERVER_URL = process.env.MCP_SERVER_URL || 'http://localhost:3000/mcp';
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/client/src/ssePollingClient.ts:17
const SERVER_URL = 'http://localhost:3001/mcp';
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

examples/client/src/streamableHttpWithSseFallbackClient.ts:132
const toolsResult = await client.request(toolsRequest);
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/client/src/streamableHttpWithSseFallbackClient.ts:18
const serverUrl = args[0] || 'http://localhost:3000/mcp';
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

examples/server-quickstart/src/index.ts:24
const response = await fetch(url, { headers });
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/server/src/elicitationUrlExample.ts:67
url: `http://localhost:${MCP_PORT}/confirm-payment?session=${sessionId}&elicitation=${elicitationId}&cartId=${encodeURIComponent(cartId)}`,
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/server/src/elicitationUrlExample.ts:235
const mcpServerUrl = new URL(`http://localhost:${MCP_PORT}/mcp`);
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/server/src/elicitationUrlExample.ts:236
const authServerUrl = new URL(`http://localhost:${AUTH_PORT}`);
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/server/src/elicitationUrlExample.ts:276
url: `http://localhost:${MCP_PORT}/api-key-form?session=${sessionId}&elicitation=${elicitationId}`,
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

URL construction from user input

medium

Building URLs by concatenating or interpolating user input without an allowlist check enables SSRF via host manipulation.

examples/server/src/elicitationUrlExample.ts:235
const mcpServerUrl = new URL(`http://localhost:${MCP_PORT}/mcp`);
How to fix

Do not construct URLs from unvalidated user input. Use a URL allowlist or domain restriction.

URL construction from user input

medium

Building URLs by concatenating or interpolating user input without an allowlist check enables SSRF via host manipulation.

examples/server/src/elicitationUrlExample.ts:236
const authServerUrl = new URL(`http://localhost:${AUTH_PORT}`);
How to fix

Do not construct URLs from unvalidated user input. Use a URL allowlist or domain restriction.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

examples/server/src/serverGuide.examples.ts:108
const res = await fetch(url);
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

examples/server/src/serverGuide.examples.ts:273
const res = await fetch(url);
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

examples/server/src/serverGuide.examples.ts:80
uri: 'file:///projects/readme.md',
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

examples/server/src/serverGuide.examples.ts:86
uri: 'file:///projects/config.json',
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/server/src/simpleStreamableHttp.ts:624
const mcpServerUrl = new URL(`http://localhost:${MCP_PORT}/mcp`);
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

examples/server/src/simpleStreamableHttp.ts:625
const authServerUrl = new URL(`http://localhost:${AUTH_PORT}`);
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

URL construction from user input

medium

Building URLs by concatenating or interpolating user input without an allowlist check enables SSRF via host manipulation.

examples/server/src/simpleStreamableHttp.ts:624
const mcpServerUrl = new URL(`http://localhost:${MCP_PORT}/mcp`);
How to fix

Do not construct URLs from unvalidated user input. Use a URL allowlist or domain restriction.

URL construction from user input

medium

Building URLs by concatenating or interpolating user input without an allowlist check enables SSRF via host manipulation.

examples/server/src/simpleStreamableHttp.ts:625
const authServerUrl = new URL(`http://localhost:${AUTH_PORT}`);
How to fix

Do not construct URLs from unvalidated user input. Use a URL allowlist or domain restriction.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

examples/server/src/simpleStreamableHttp.ts:359
'file:///example/file1.txt',
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

examples/server/src/simpleStreamableHttp.ts:369
uri: 'file:///example/file1.txt',
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

examples/server/src/simpleStreamableHttp.ts:379
'file:///example/file2.txt',
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

examples/server/src/simpleStreamableHttp.ts:389
uri: 'file:///example/file2.txt',
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

examples/server/src/simpleStreamableHttp.ts:418
uri: 'file:///example/file1.txt',
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

examples/server/src/simpleStreamableHttp.ts:425
uri: 'file:///example/file2.txt',
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Following redirects without validation

medium

Automatically following HTTP redirects can be exploited to reach internal endpoints.

lefthook.yml:18
follow: true
How to fix

Disable automatic redirects or validate redirect targets against allow-lists.

URL construction from user input

medium

Building URLs by concatenating or interpolating user input without an allowlist check enables SSRF via host manipulation.

packages/client/src/client/auth.ts:1069
const rootUrl = new URL(`/.well-known/${wellKnownType}`, issuer);
How to fix

Do not construct URLs from unvalidated user input. Use a URL allowlist or domain restriction.

URL construction from user input

medium

Building URLs by concatenating or interpolating user input without an allowlist check enables SSRF via host manipulation.

packages/client/src/client/auth.ts:1164
url: new URL(`/.well-known/oauth-authorization-server${pathname}`, url.origin),
How to fix

Do not construct URLs from unvalidated user input. Use a URL allowlist or domain restriction.

URL construction from user input

medium

Building URLs by concatenating or interpolating user input without an allowlist check enables SSRF via host manipulation.

packages/client/src/client/auth.ts:1170
url: new URL(`/.well-known/openid-configuration${pathname}`, url.origin),
How to fix

Do not construct URLs from unvalidated user input. Use a URL allowlist or domain restriction.

URL construction from user input

medium

Building URLs by concatenating or interpolating user input without an allowlist check enables SSRF via host manipulation.

packages/client/src/client/auth.ts:1176
url: new URL(`${pathname}/.well-known/openid-configuration`, url.origin),
How to fix

Do not construct URLs from unvalidated user input. Use a URL allowlist or domain restriction.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

packages/client/src/experimental/tasks/client.ts:195
*   original request (e.g., a `tools/call` task returns a `CallToolResult`).
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

packages/core/src/experimental/tasks/interfaces.ts:177
* @param taskParams - The task creation parameters from the request (ttl, pollInterval)
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

packages/core/src/shared/protocol.ts:184
* The method name of the request (e.g., 'tools/call', 'ping').
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

packages/core/src/shared/protocol.ts:478
this._onrequest(message, extra);
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

packages/core/src/shared/taskManager.ts:277
const result = await host.request(request, resultSchema, options);
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

packages/core/src/shared/taskManager.ts:290
const createResult = await host.request(request, CreateTaskResultSchema, options);
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

packages/core/src/types/schemas.ts:2040
* The URI identifying the root. This *must* start with `file://` for now.
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

packages/core/src/types/schemas.ts:2042
uri: z.string().startsWith('file://'),
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

packages/core/src/types/spec.types.ts:246
* A JSON-RPC error indicating that the request is not a valid request object. This error is returned when the message structure does not conform to the JSON-RPC 2.0 specification requirements for a request (e.g., missing required fields like `jsonrpc` or `method`, or using invalid types for these fields).
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Dangerous URL schema usage

critical

file://, gopher://, dict://, and other non-HTTP schemas can be exploited for SSRF.

packages/core/src/types/spec.types.ts:2739
* The URI identifying the root. This *must* start with `file://` for now.
How to fix

Only allow http:// and https:// URL schemas. Validate URL schemas before making requests.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

packages/server/src/experimental/tasks/server.ts:266
*   original request (e.g., a `tools/call` task returns a `CallToolResult`).
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

packages/server/src/server/mcp.examples.ts:138
const res = await fetch(url);
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

URL construction from user input

medium

Building URLs by concatenating or interpolating user input without an allowlist check enables SSRF via host manipulation.

packages/server/src/server/middleware/hostHeaderValidation.ts:25
hostname = new URL(`http://${hostHeader}`).hostname;
How to fix

Do not construct URLs from unvalidated user input. Use a URL allowlist or domain restriction.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

scripts/fetch-spec-types.ts:17
const response = await fetch(url);
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

scripts/fetch-spec-types.ts:33
const response = await fetch(url);
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

test/conformance/src/authTestServer.ts:121
const response = await fetch(metadataUrl);
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

test/conformance/src/authTestServer.ts:132
const response = await fetch(introspectionEndpoint, {
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

test/conformance/src/authTestServer.ts:43
const getBaseUrl = () => `http://localhost:${PORT}`;
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

test/conformance/src/everythingClient.ts:327
const provider = new ConformanceOAuthProvider('http://localhost:3000/callback', {
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

test/conformance/src/everythingClient.ts:329
redirect_uris: ['http://localhost:3000/callback']
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

test/conformance/src/everythingClient.ts:334
redirect_uris: ['http://localhost:3000/callback']
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Following redirects without validation

medium

Automatically following HTTP redirects can be exploited to reach internal endpoints.

test/conformance/src/helpers/conformanceOAuthProvider.ts:53
redirect: 'manual' // Don't follow redirects automatically
How to fix

Disable automatic redirects or validate redirect targets against allow-lists.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

test/conformance/src/helpers/withOAuthRetry.ts:64
'http://localhost:3000/callback',
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

Request to localhost or loopback address

high

Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.

test/conformance/src/helpers/withOAuthRetry.ts:67
redirect_uris: ['http://localhost:3000/callback']
How to fix

Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.

URL construction from user input

medium

Building URLs by concatenating or interpolating user input without an allowlist check enables SSRF via host manipulation.

test/helpers/src/helpers/http.ts:14
resolve(new URL(`http://${host}:${addr.port}`));
How to fix

Do not construct URLs from unvalidated user input. Use a URL allowlist or domain restriction.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/dualModeAuth.ts:18
*   the full OAuth flow: token refresh on 401, or redirect for interactive
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/dualModeAuth.ts:56
// --- MODE B: User-configured OAuth -----------------------------------------
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/dualModeAuth.ts:59
// Built-in OAuth provider — the transport adapts it to AuthProvider internally.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/dualModeAuth.ts:92
} else if (mode === 'oauth') {
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/dualModeAuth.ts:96
console.error('OAUTH_CLIENT_ID and OAUTH_CLIENT_SECRET required for oauth mode');
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/dualModeAuth.ts:101
console.error(`Unknown mode: ${mode}. Use 'host' or 'oauth'.`);
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleClientCredentials.ts:9
*    MCP_CLIENT_ID - OAuth client ID (required)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleClientCredentials.ts:10
*    MCP_CLIENT_SECRET - OAuth client secret (required)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleClientCredentials.ts:13
*    MCP_CLIENT_ID - OAuth client ID (required)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleOAuthClient.ts:19
* Interactive MCP client with OAuth authentication
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleOAuthClient.ts:20
* Demonstrates the complete OAuth flow with browser-based authorization
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleOAuthClient.ts:69
* Example OAuth callback handler - in production, use a more robust approach
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleOAuthClient.ts:73
* Starts a temporary HTTP server to receive the OAuth callback
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleOAuthClient.ts:116
reject(new Error(`OAuth authorization failed: ${error}`));
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleOAuthClient.ts:126
console.log(`OAuth callback server started on http://localhost:${CALLBACK_PORT}`);
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleOAuthClient.ts:132
console.log('🚢 Creating transport with OAuth provider...');
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleOAuthClient.ts:140
console.log('🔌 Attempting connection (this will trigger OAuth redirect)...');
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleOAuthClient.ts:145
console.log('🔐 OAuth required - waiting for authorization...');
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleOAuthClient.ts:160
* Establishes connection to the MCP server with OAuth authentication
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleOAuthClient.ts:166
client_name: 'Simple OAuth MCP Client',
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleOAuthClient.ts:173
console.log('🔐 Creating OAuth provider...');
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleOAuthClient.ts:178
console.log(`📌 OAuth redirect handler called - opening browser`);
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleOAuthClient.ts:184
console.log('🔐 OAuth provider created');
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleOAuthClient.ts:189
name: 'simple-oauth-client',
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleOAuthClient.ts:196
console.log('🔐 Starting OAuth flow...');
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleOAuthClient.ts:208
console.log('\n🎯 Interactive MCP Client with OAuth');
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleOAuthClient.ts:436
console.log('🚀 Simple MCP OAuth Client');
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleOAuthClientProvider.ts:4
* In-memory OAuth client provider for demonstration purposes
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleTokenProvider.ts:4
* Example demonstrating the minimal AuthProvider for bearer token authentication.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleTokenProvider.ts:10
* For OAuth flows (client_credentials, private_key_jwt, etc.), use the built-in
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/client/src/simpleTokenProvider.ts:15
*   MCP_TOKEN      - Bearer token to use for authentication (required)
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/elicitationFormExample.ts:400
app.post('/mcp', mcpPostHandler);
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/elicitationFormExample.ts:419
app.get('/mcp', mcpGetHandler);
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/elicitationFormExample.ts:446
app.delete('/mcp', mcpDeleteHandler);
How to fix

Add rate limiting middleware to all public API endpoints.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

examples/server/src/elicitationFormExample.ts:400
app.post('/mcp', mcpPostHandler);
How to fix

Implement CSRF protection using tokens or SameSite cookies.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

examples/server/src/elicitationFormExample.ts:446
app.delete('/mcp', mcpDeleteHandler);
How to fix

Implement CSRF protection using tokens or SameSite cookies.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/elicitationUrlExample.ts:299
app.get('/api-key-form', (req: Request, res: Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/elicitationUrlExample.ts:350
app.post('/api-key-form', express.urlencoded(), (req: Request, res: Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/elicitationUrlExample.ts:419
app.get('/confirm-payment', (req: Request, res: Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/elicitationUrlExample.ts:477
app.post('/confirm-payment', express.urlencoded(), (req: Request, res: Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/elicitationUrlExample.ts:644
app.post('/mcp', authMiddleware, mcpPostHandler);
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/elicitationUrlExample.ts:687
app.get('/mcp', authMiddleware, mcpGetHandler);
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/elicitationUrlExample.ts:715
app.delete('/mcp', authMiddleware, mcpDeleteHandler);
How to fix

Add rate limiting middleware to all public API endpoints.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

examples/server/src/elicitationUrlExample.ts:350
app.post('/api-key-form', express.urlencoded(), (req: Request, res: Response) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

examples/server/src/elicitationUrlExample.ts:477
app.post('/confirm-payment', express.urlencoded(), (req: Request, res: Response) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

examples/server/src/elicitationUrlExample.ts:644
app.post('/mcp', authMiddleware, mcpPostHandler);
How to fix

Implement CSRF protection using tokens or SameSite cookies.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

examples/server/src/elicitationUrlExample.ts:715
app.delete('/mcp', authMiddleware, mcpDeleteHandler);
How to fix

Implement CSRF protection using tokens or SameSite cookies.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/honoWebStandardStreamableHttp.ts:56
app.get('/health', c => c.json({ status: 'ok' }));
How to fix

Add rate limiting middleware to all public API endpoints.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

examples/server/src/jsonResponseStreamableHttp.ts:85
app.post('/mcp', async (req: Request, res: Response) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

examples/server/src/jsonResponseStreamableHttp.ts:147
app.get('/mcp', async (req: Request, res: Response) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/jsonResponseStreamableHttp.ts:85
app.post('/mcp', async (req: Request, res: Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/jsonResponseStreamableHttp.ts:147
app.get('/mcp', async (req: Request, res: Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

examples/server/src/jsonResponseStreamableHttp.ts:85
app.post('/mcp', async (req: Request, res: Response) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

examples/server/src/simpleStatelessStreamableHttp.ts:99
app.post('/mcp', async (req: Request, res: Response) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

examples/server/src/simpleStatelessStreamableHttp.ts:127
app.get('/mcp', async (req: Request, res: Response) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

examples/server/src/simpleStatelessStreamableHttp.ts:141
app.delete('/mcp', async (req: Request, res: Response) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/simpleStatelessStreamableHttp.ts:99
app.post('/mcp', async (req: Request, res: Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/simpleStatelessStreamableHttp.ts:127
app.get('/mcp', async (req: Request, res: Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/simpleStatelessStreamableHttp.ts:141
app.delete('/mcp', async (req: Request, res: Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

examples/server/src/simpleStatelessStreamableHttp.ts:99
app.post('/mcp', async (req: Request, res: Response) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

examples/server/src/simpleStatelessStreamableHttp.ts:141
app.delete('/mcp', async (req: Request, res: Response) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/simpleStreamableHttp.ts:728
app.post('/mcp', authMiddleware, mcpPostHandler);
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/simpleStreamableHttp.ts:730
app.post('/mcp', mcpPostHandler);
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/simpleStreamableHttp.ts:763
app.get('/mcp', authMiddleware, mcpGetHandler);
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/simpleStreamableHttp.ts:765
app.get('/mcp', mcpGetHandler);
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/simpleStreamableHttp.ts:795
app.delete('/mcp', authMiddleware, mcpDeleteHandler);
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/simpleStreamableHttp.ts:797
app.delete('/mcp', mcpDeleteHandler);
How to fix

Add rate limiting middleware to all public API endpoints.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

examples/server/src/simpleStreamableHttp.ts:728
app.post('/mcp', authMiddleware, mcpPostHandler);
How to fix

Implement CSRF protection using tokens or SameSite cookies.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

examples/server/src/simpleStreamableHttp.ts:730
app.post('/mcp', mcpPostHandler);
How to fix

Implement CSRF protection using tokens or SameSite cookies.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

examples/server/src/simpleStreamableHttp.ts:795
app.delete('/mcp', authMiddleware, mcpDeleteHandler);
How to fix

Implement CSRF protection using tokens or SameSite cookies.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

examples/server/src/simpleStreamableHttp.ts:797
app.delete('/mcp', mcpDeleteHandler);
How to fix

Implement CSRF protection using tokens or SameSite cookies.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

examples/server/src/simpleTaskInteractive.ts:644
app.post('/mcp', async (req: Request, res: Response) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

examples/server/src/simpleTaskInteractive.ts:703
app.get('/mcp', async (req: Request, res: Response) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

examples/server/src/simpleTaskInteractive.ts:719
app.delete('/mcp', async (req: Request, res: Response) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/simpleTaskInteractive.ts:644
app.post('/mcp', async (req: Request, res: Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/simpleTaskInteractive.ts:703
app.get('/mcp', async (req: Request, res: Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/simpleTaskInteractive.ts:719
app.delete('/mcp', async (req: Request, res: Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

examples/server/src/simpleTaskInteractive.ts:644
app.post('/mcp', async (req: Request, res: Response) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

examples/server/src/simpleTaskInteractive.ts:719
app.delete('/mcp', async (req: Request, res: Response) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

examples/server/src/ssePollingExample.ts:100
app.all('/mcp', async (req: Request, res: Response) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

examples/server/src/standaloneSseWithGetStreamableHttp.ts:50
app.post('/mcp', async (req: Request, res: Response) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

examples/server/src/standaloneSseWithGetStreamableHttp.ts:123
app.get('/mcp', async (req: Request, res: Response) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/standaloneSseWithGetStreamableHttp.ts:50
app.post('/mcp', async (req: Request, res: Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

examples/server/src/standaloneSseWithGetStreamableHttp.ts:123
app.get('/mcp', async (req: Request, res: Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

examples/server/src/standaloneSseWithGetStreamableHttp.ts:50
app.post('/mcp', async (req: Request, res: Response) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/shared/src/index.ts:2
export type { CreateDemoAuthOptions, DemoAuth } from './auth.js';
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/shared/src/index.ts:3
export { createDemoAuth } from './auth.js';
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

examples/shared/src/index.ts:11
export { createProtectedResourceMetadataRouter, getAuth, setupAuthServer, verifyAccessToken } from './authServer.js';
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

package.json:26
"examples:simple-server:w": "pnpm --filter @modelcontextprotocol/examples-server exec tsx --watch src/simpleStreamableHttp.ts --oauth",
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/client/src/client/authExtensions.examples.ts:30
* Example: Using ClientCredentialsProvider for OAuth client credentials flow.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/client/src/client/authExtensions.examples.ts:47
* Example: Using PrivateKeyJwtProvider for OAuth with private key JWT.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/client/src/client/middleware.examples.ts:14
declare function withOAuth(provider: unknown, url: string): Middleware;
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/client/src/client/middleware.examples.ts:22
* Example: Creating a middleware pipeline for OAuth and logging.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/client/src/client/middleware.examples.ts:26
// Create a middleware pipeline that handles both OAuth and logging
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/client/src/client/middleware.examples.ts:27
const enhancedFetch = applyMiddlewares(withOAuth(oauthProvider, 'https://api.example.com'), withLogging({ statusLevel: 400 }))(fetch);
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/client/src/index.ts:60
export { applyMiddlewares, createMiddleware, withLogging, withOAuth } from './client/middleware.js';
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/core/src/shared/authUtils.ts:2
* Utilities for handling OAuth resource URIs.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

packages/core/src/types/spec.types.ts:583
* (e.g., "io.modelcontextprotocol/oauth-client-credentials"), and values are
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

packages/middleware/node/src/streamableHttp.examples.ts:52
app.post('/mcp', (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

packages/middleware/node/src/streamableHttp.examples.ts:52
app.post('/mcp', (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

packages/middleware/node/src/streamableHttp.examples.ts:52
app.post('/mcp', (req, res) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

packages/middleware/node/src/streamableHttp.ts:62
* app.post('/mcp', (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

packages/middleware/node/src/streamableHttp.ts:62
* app.post('/mcp', (req, res) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

scripts/cli.ts:60
app.get('/sse', async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

scripts/cli.ts:84
app.post('/message', async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

scripts/cli.ts:60
app.get('/sse', async (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

scripts/cli.ts:84
app.post('/message', async (req, res) => {
How to fix

Add rate limiting middleware to all public API endpoints.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

scripts/cli.ts:84
app.post('/message', async (req, res) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

test/conformance/src/authTestServer.ts:283
app.get('/.well-known/oauth-protected-resource', (_req: Request, res: Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

test/conformance/src/authTestServer.ts:293
app.post('/mcp', bearerAuth, adminScopeCheck, async (req: Request, res: Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

test/conformance/src/authTestServer.ts:363
app.get('/mcp', bearerAuth, async (req: Request, res: Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

test/conformance/src/authTestServer.ts:389
app.delete('/mcp', bearerAuth, async (req: Request, res: Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

test/conformance/src/authTestServer.ts:293
app.post('/mcp', bearerAuth, adminScopeCheck, async (req: Request, res: Response) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

test/conformance/src/authTestServer.ts:389
app.delete('/mcp', bearerAuth, async (req: Request, res: Response) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

test/conformance/src/everythingServer.ts:893
app.post('/mcp', async (req: Request, res: Response) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

test/conformance/src/everythingServer.ts:965
app.get('/mcp', async (req: Request, res: Response) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

test/conformance/src/everythingServer.ts:996
app.delete('/mcp', async (req: Request, res: Response) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

test/conformance/src/everythingServer.ts:893
app.post('/mcp', async (req: Request, res: Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

test/conformance/src/everythingServer.ts:965
app.get('/mcp', async (req: Request, res: Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

Missing rate limiting on endpoint

medium

API endpoints without rate limiting are vulnerable to brute force and denial of service.

test/conformance/src/everythingServer.ts:996
app.delete('/mcp', async (req: Request, res: Response) => {
How to fix

Add rate limiting middleware to all public API endpoints.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

test/conformance/src/everythingServer.ts:893
app.post('/mcp', async (req: Request, res: Response) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

No CSRF protection on state-changing endpoint

medium

POST/PUT/DELETE endpoints without CSRF tokens are vulnerable to cross-site request forgery.

test/conformance/src/everythingServer.ts:996
app.delete('/mcp', async (req: Request, res: Response) => {
How to fix

Implement CSRF protection using tokens or SameSite cookies.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

test/helpers/src/helpers/oauth.ts:14
* Shared mock fetch implementation for OAuth flows used in client tests.
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

test/helpers/src/helpers/oauth.ts:17
* - OAuth Protected Resource Metadata discovery
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

test/helpers/src/helpers/oauth.ts:28
if (url.origin === resourceServerUrl.slice(0, -1) && url.pathname === '/.well-known/oauth-protected-resource') {
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

test/helpers/src/helpers/oauth.ts:42
if (url.origin === authServerUrl && url.pathname === '/.well-known/oauth-authorization-server') {
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

test/helpers/src/helpers/oauth.ts:66
access_token: 'test-access-token',
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

test/helpers/src/helpers/oauth.ts:67
token_type: 'Bearer'
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

test/helpers/src/helpers/oauth.ts:76
throw new Error(`Unexpected URL in mock OAuth fetch: ${url.toString()}`);
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

test/helpers/src/index.ts:2
export * from './helpers/oauth.js';
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Windows-style path traversal patterns

high

Backslash-based directory traversal patterns targeting Windows file systems.

scripts/sync-snippets.ts:533
? 'Checking code snippets are in sync...\n'
How to fix

Normalize path separators and apply traversal checks for both forward and backslashes.

Windows-style path traversal patterns

high

Backslash-based directory traversal patterns targeting Windows file systems.

scripts/sync-snippets.ts:534
: 'Syncing code snippets from example files...\n',
How to fix

Normalize path separators and apply traversal checks for both forward and backslashes.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

examples/client/src/elicitationUrlExample.ts:494
server.listen(OAUTH_CALLBACK_PORT, () => {
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

examples/client/src/simpleOAuthClient.ts:77
const server = createServer((req, res) => {
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

examples/client/src/simpleOAuthClient.ts:125
server.listen(CALLBACK_PORT, () => {
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

examples/server/src/customProtocolVersion.ts:56
createServer(async (req, res) => {
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

examples/server/src/customProtocolVersion.ts:62
}).listen(PORT, () => {
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

examples/server/src/elicitationFormExample.ts:449
app.listen(PORT, error => {
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

examples/server/src/elicitationUrlExample.ts:717
app.listen(MCP_PORT, error => {
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

examples/server/src/jsonResponseStreamableHttp.ts:155
app.listen(PORT, error => {
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

examples/server/src/serverGuide.examples.ts:482
const httpServer = app.listen(3000);
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

examples/server/src/simpleStatelessStreamableHttp.ts:157
app.listen(PORT, error => {
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

examples/server/src/simpleStreamableHttp.ts:800
app.listen(MCP_PORT, error => {
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

examples/server/src/simpleTaskInteractive.ts:669
const server = createServer();
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

examples/server/src/simpleTaskInteractive.ts:736
app.listen(PORT, () => {
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

examples/server/src/ssePollingExample.ts:127
app.listen(PORT, () => {
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

examples/server/src/standaloneSseWithGetStreamableHttp.ts:141
app.listen(PORT, error => {
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

examples/shared/src/authServer.ts:243
authApp.listen(authPort, (error?: Error) => {
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

scripts/cli.ts:97
app.listen(port, error => {
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

test/conformance/src/authTestServer.ts:415
app.listen(PORT, () => {
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

test/conformance/src/everythingServer.ts:1023
app.listen(PORT, () => {
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Missing HSTS headers on HTTP server

medium

An HTTP server is created without configuring Strict-Transport-Security (HSTS) headers. Without HSTS, browsers may allow downgrade attacks from HTTPS to HTTP.

test/helpers/src/helpers/http.ts:12
server.listen(0, host, () => {
How to fix

Add Strict-Transport-Security headers to your server responses. Use a middleware such as helmet to set HSTS automatically.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

examples/server/src/elicitationFormExample.ts:410
res.status(404).send('Session not found');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

examples/server/src/elicitationFormExample.ts:425
res.status(400).send('Missing session ID');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

examples/server/src/elicitationFormExample.ts:429
res.status(404).send('Session not found');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

examples/server/src/elicitationFormExample.ts:441
res.status(500).send('Error processing session termination');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

examples/server/src/elicitationUrlExample.ts:650
res.status(400).send('Missing session ID');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

examples/server/src/elicitationUrlExample.ts:654
res.status(404).send('Session not found');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

examples/server/src/elicitationUrlExample.ts:693
res.status(400).send('Missing session ID');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

examples/server/src/elicitationUrlExample.ts:697
res.status(404).send('Session not found');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

examples/server/src/elicitationUrlExample.ts:709
res.status(500).send('Error processing session termination');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

examples/server/src/simpleStreamableHttp.ts:737
res.status(400).send('Missing session ID');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

examples/server/src/simpleStreamableHttp.ts:741
res.status(404).send('Session not found');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

examples/server/src/simpleStreamableHttp.ts:772
res.status(400).send('Missing session ID');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

examples/server/src/simpleStreamableHttp.ts:776
res.status(404).send('Session not found');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

examples/server/src/simpleStreamableHttp.ts:788
res.status(500).send('Error processing session termination');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

examples/server/src/simpleTaskInteractive.ts:706
res.status(400).send('Missing session ID');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

examples/server/src/simpleTaskInteractive.ts:710
res.status(404).send('Session not found');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

examples/server/src/simpleTaskInteractive.ts:722
res.status(400).send('Missing session ID');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

examples/server/src/simpleTaskInteractive.ts:726
res.status(404).send('Session not found');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

examples/server/src/standaloneSseWithGetStreamableHttp.ts:126
res.status(400).send('Missing session ID');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

examples/server/src/standaloneSseWithGetStreamableHttp.ts:130
res.status(404).send('Session not found');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

packages/core/src/shared/protocol.ts:383
await this._transport?.send(message, { relatedRequestId });
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

packages/middleware/node/src/streamableHttp.ts:152
return this._webStandardTransport.send(message, options);
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

scripts/cli.ts:90
res.status(404).send('Session not found');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

test/conformance/src/authTestServer.ts:367
res.status(400).send('Missing session ID');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

test/conformance/src/authTestServer.ts:371
res.status(404).send('Session not found');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

test/conformance/src/authTestServer.ts:393
res.status(400).send('Missing session ID');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

test/conformance/src/authTestServer.ts:397
res.status(404).send('Session not found');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

test/conformance/src/authTestServer.ts:409
res.status(500).send('Error processing session termination');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

test/conformance/src/everythingServer.ts:969
res.status(400).send('Missing session ID');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

test/conformance/src/everythingServer.ts:973
res.status(404).send('Session not found');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

test/conformance/src/everythingServer.ts:1000
res.status(400).send('Missing session ID');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

test/conformance/src/everythingServer.ts:1004
res.status(404).send('Session not found');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Writing session data to external storage

high

Sending conversation, prompt, or session data to external storage services may leak sensitive user interactions.

test/conformance/src/everythingServer.ts:1016
res.status(500).send('Error processing session termination');
How to fix

Do not write session or conversation data to external storage. Keep user interaction data within the authorized session boundary.

Multiple MCP server instantiations in single file

medium

Detected multiple McpServer or Server instantiations in a single file. Multiple server instances in one project may indicate a shadow MCP server that intercepts or duplicates tool traffic without authorization.

examples/server/src/serverGuide.examples.ts:261
const server = new McpServer({ name: 'my-server', version: '1.0.0' }, { capabilities: { logging: {} } });
How to fix

Consolidate MCP server instances into a single, well-documented server. Remove any duplicate or shadow server instantiations.

Multiple MCP server instantiations in single file

medium

Detected multiple McpServer or Server instantiations in a single file. Multiple server instances in one project may indicate a shadow MCP server that intercepts or duplicates tool traffic without authorization.

examples/server/src/serverGuide.examples.ts:428
const server = new McpServer({ name: 'my-server', version: '1.0.0' });
How to fix

Consolidate MCP server instances into a single, well-documented server. Remove any duplicate or shadow server instantiations.

Multiple MCP server instantiations in single file

medium

Detected multiple McpServer or Server instantiations in a single file. Multiple server instances in one project may indicate a shadow MCP server that intercepts or duplicates tool traffic without authorization.

examples/server/src/serverGuide.examples.ts:441
const server = new McpServer({ name: 'my-server', version: '1.0.0' });
How to fix

Consolidate MCP server instances into a single, well-documented server. Remove any duplicate or shadow server instantiations.

Multiple MCP server instantiations in single file

medium

Detected multiple McpServer or Server instantiations in a single file. Multiple server instances in one project may indicate a shadow MCP server that intercepts or duplicates tool traffic without authorization.

examples/server/src/serverGuide.examples.ts:454
const server = new McpServer({ name: 'my-server', version: '1.0.0' });
How to fix

Consolidate MCP server instances into a single, well-documented server. Remove any duplicate or shadow server instantiations.

Multiple MCP server instantiations in single file

medium

Detected multiple McpServer or Server instantiations in a single file. Multiple server instances in one project may indicate a shadow MCP server that intercepts or duplicates tool traffic without authorization.

examples/server/src/serverGuide.examples.ts:468
const server = new McpServer({ name: 'my-server', version: '1.0.0' });
How to fix

Consolidate MCP server instances into a single, well-documented server. Remove any duplicate or shadow server instantiations.

Multiple MCP server instantiations in single file

medium

Detected multiple McpServer or Server instantiations in a single file. Multiple server instances in one project may indicate a shadow MCP server that intercepts or duplicates tool traffic without authorization.

packages/server/src/server/mcp.examples.ts:21
const server = new McpServer({
How to fix

Consolidate MCP server instances into a single, well-documented server. Remove any duplicate or shadow server instantiations.

Multiple MCP server instantiations in single file

medium

Detected multiple McpServer or Server instantiations in a single file. Multiple server instances in one project may indicate a shadow MCP server that intercepts or duplicates tool traffic without authorization.

packages/server/src/server/mcp.examples.ts:107
const server = new McpServer({ name: 'my-server', version: '1.0.0' });
How to fix

Consolidate MCP server instances into a single, well-documented server. Remove any duplicate or shadow server instantiations.

Multiple MCP server instantiations in single file

medium

Detected multiple McpServer or Server instantiations in a single file. Multiple server instances in one project may indicate a shadow MCP server that intercepts or duplicates tool traffic without authorization.

packages/server/src/server/mcp.ts:55
* const server = new McpServer({
How to fix

Consolidate MCP server instances into a single, well-documented server. Remove any duplicate or shadow server instantiations.

Multiple MCP server instantiations in single file

medium

Detected multiple McpServer or Server instantiations in a single file. Multiple server instances in one project may indicate a shadow MCP server that intercepts or duplicates tool traffic without authorization.

packages/server/src/server/mcp.ts:76
this.server = new Server(serverInfo, options);
How to fix

Consolidate MCP server instances into a single, well-documented server. Remove any duplicate or shadow server instantiations.

Multiple MCP server instantiations in single file

medium

Detected multiple McpServer or Server instantiations in a single file. Multiple server instances in one project may indicate a shadow MCP server that intercepts or duplicates tool traffic without authorization.

packages/server/src/server/mcp.ts:102
* const server = new McpServer({ name: 'my-server', version: '1.0.0' });
How to fix

Consolidate MCP server instances into a single, well-documented server. Remove any duplicate or shadow server instantiations.

Multiple MCP server instantiations in single file

medium

Detected multiple McpServer or Server instantiations in a single file. Multiple server instances in one project may indicate a shadow MCP server that intercepts or duplicates tool traffic without authorization.

scripts/cli.ts:64
const server = new Server(
How to fix

Consolidate MCP server instances into a single, well-documented server. Remove any duplicate or shadow server instantiations.

Multiple MCP server instantiations in single file

medium

Detected multiple McpServer or Server instantiations in a single file. Multiple server instances in one project may indicate a shadow MCP server that intercepts or duplicates tool traffic without authorization.

scripts/cli.ts:105
const server = new Server(
How to fix

Consolidate MCP server instances into a single, well-documented server. Remove any duplicate or shadow server instantiations.

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.

Dynamic tool description modification at runtime

critical

Detected runtime reassignment of a tool's description property to a non-literal value. Dynamically modifying tool descriptions can allow an attacker to inject misleading instructions that alter LLM behavior.

packages/server/src/server/mcp.ts:807
if (updates.description !== undefined) registeredTool.description = updates.description;
How to fix

Use only static, hardcoded string literals for tool descriptions. Never assign descriptions from variables, user input, or external data sources.