MCP Scanner
ScanLeaderboardDocsSign in
Home/tavily-ai/tavily-mcp/Results
83B

tavily-mcp

tavily-ai/tavily-mcp

5 files · 6 findings

Share GitHub SARIF JSON
1 high2 medium3 low
Tool Poisoningclean
Command Injectionclean
Path Traversalclean
SSRFclean
Credential Theft1 issue
Excessive Permissionsclean
Missing Auth1 issue
Supply Chain
Supply Chain1

Typosquatting-susceptible dependency name

medium

Package names that are common misspellings of popular packages may be typosquatting attacks.

package.json:51
"axios": "^1.6.7",
How to fix

Verify package names against the official registry. Use lockfiles and integrity hashes.

Credential Theft1

Dot-notation access to sensitive env vars

high

Accessing process.env properties like API_KEY, SECRET, TOKEN, or PASSWORD via dot notation may indicate credential harvesting.

src/index.ts:14
const API_KEY = process.env.TAVILY_API_KEY;
How to fix

Avoid accessing sensitive env vars directly. Use a configuration module that validates and restricts access.

Missing Auth1

Missing OAuth scope validation

medium

OAuth-protected endpoints that don't validate scopes may allow unauthorized actions.

src/index.ts:97
'Authorization': `Bearer ${API_KEY}`,
How to fix

Validate OAuth scopes on every endpoint. Check that the token has required permissions.

Logging Deficiency3

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

src/index.ts:869
console.log("Available tools:");
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

1 issue
Rug Pullclean
Data Exfiltrationclean
Insecure Communicationclean
Excessive Data Exposureclean
Logging Deficiency3 issues
Runtime Tool Poisoningclean
Shadow MCP Serverclean

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

src/index.ts:871
console.log(`\n- ${tool.name}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.

Console.log in production code

low

Detected console.log() usage in non-test source code. Console.log is not appropriate for production logging as it lacks log levels, structured output, and proper log management.

src/index.ts:872
console.log(`  Description: ${tool.description}`);
How to fix

Replace console.log with a structured logging library (e.g., winston, pino) that supports log levels and proper log management.