This repository may not be an MCP server
We could not detect MCP SDK imports or tool registrations.
Requests targeting 127.0.0.1, localhost, or [::1] may access internal services not intended to be exposed.
const BASE_URI = process.env.BASE_URI || `http://localhost:${PORT}`;Block requests to localhost and loopback addresses. Implement URL validation that rejects 127.x.x.x and ::1.
preinstall and postinstall scripts in package.json execute automatically during npm install and can run malicious code.
"postinstall": "echo '// no-op: server uses SWC' > node_modules/typescript/bin/tsc",
Remove preinstall/postinstall scripts or audit their content. Use prepare scripts for build steps only.
File system operations using variables without prior path validation or sanitization may allow traversal attacks.
const content = fs.readFileSync(file, "utf8");
Add path sanitization before all fs operations. Validate paths against an allowlist of permitted directories.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
"description": "Bad request (e.g., missing body or invalid parameters)"
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
"description": "Bad request (e.g., missing body or invalid parameters)"
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
"description": "Bad request (e.g., missing body or invalid parameters)"
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Passing user-controlled variables directly to fetch, axios, or http.get without URL validation enables SSRF attacks.
"description": "Bad request (e.g., missing body or invalid parameters)"
Validate and sanitize all URLs before making HTTP requests. Use an allowlist of permitted domains.
Package names that are common misspellings of popular packages may be typosquatting attacks.
"axios": "^1.13.5",
Verify package names against the official registry. Use lockfiles and integrity hashes.
File system operations using variables without prior path validation or sanitization may allow traversal attacks.
fs.writeFileSync(file, fixed);
Add path sanitization before all fs operations. Validate paths against an allowlist of permitted directories.