MCP Scanner
ScanLeaderboardDocsSign in
Home/modelcontextprotocol/servers/Results
64C

servers

modelcontextprotocol/servers

97 files · 10 findings

Share GitHub SARIF JSON
1 high9 medium
Tool Poisoningclean
Command Injectionclean
Path Traversal2 issues
SSRF3 issues
Credential Theftclean
Excessive Permissionsclean
Missing Auth5 issues
Supply Chain
SSRF3

URL construction from user input

medium

Building URLs by concatenating or interpolating user input without an allowlist check enables SSRF via host manipulation.

src/everything/resources/templates.ts:119
new URL(`${textUriBase}/${resourceId}`);
How to fix

Do not construct URLs from unvalidated user input. Use a URL allowlist or domain restriction.

Missing Auth5

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

src/everything/transports/sse.ts:26
app.get("/sse", async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Path Traversal2

fs operations without path sanitization

medium

File system operations using variables without prior path validation or sanitization may allow traversal attacks.

src/memory/index.ts:73
const data = await fs.readFile(this.memoryFilePath, "utf-8");
How to fix

Add path sanitization before all fs operations. Validate paths against an allowlist of permitted directories.

clean
Rug Pullclean

URL construction from user input

medium

Building URLs by concatenating or interpolating user input without an allowlist check enables SSRF via host manipulation.

src/everything/resources/templates.ts:127
new URL(`${blobUriBase}/${resourceId}`);
How to fix

Do not construct URLs from unvalidated user input. Use a URL allowlist or domain restriction.

HTTP request with unvalidated URL parameter

high

Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.

src/everything/tools/gzip-file-as-resource.ts:190
const response = await fetch(url, { signal: controller.signal });
How to fix

Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

src/everything/transports/sse.ts:59
app.post("/message", async (req, res) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

src/everything/transports/streamableHttp.ts:60
app.post("/mcp", async (req: Request, res: Response) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

src/everything/transports/streamableHttp.ts:137
app.get("/mcp", async (req: Request, res: Response) => {
How to fix

Add authentication middleware to all routes that access or modify data.

Server route without authentication middleware

medium

HTTP endpoints defined without authentication middleware may be accessible to unauthorized users.

src/everything/transports/streamableHttp.ts:165
app.delete("/mcp", async (req: Request, res: Response) => {
How to fix

Add authentication middleware to all routes that access or modify data.

fs operations without path sanitization

medium

File system operations using variables without prior path validation or sanitization may allow traversal attacks.

src/memory/index.ts:116
await fs.writeFile(this.memoryFilePath, lines.join("\n"));
How to fix

Add path sanitization before all fs operations. Validate paths against an allowlist of permitted directories.