security
Security
Every MCP risk signal in one place — CVEs, tool safety, drift, naming, licenses. Heuristic: review signals, not verdicts. New here? The Risk tab gives an at-a-glance composite grade per server; the Code Analysis tab shows what the static scanner found in published source.
91 CRITICAL
7986 HIGH
2858 MEDIUM
4914 LOW
16 NONE
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
15630 analyzed
7941 re-analysis due
2806 not analyzable
2 not yet analyzed
3178 source gone
not analyzable
2,360 no source 446 too large
Running analyzer v28. The scanner changelog explains what each version detects and when it changed.
- hidden prompt 123
- committed secret 1059
- dynamic exec 3654
- obfuscation 689
- suspicious endpoint 3710
- token-log 220
- oauth-scope 979
- skill-script 87
- ide-extension 16
- skill file 74313
- HIGH dynamic exec 4R9UN/mcp-kql-server __import__()
__import__(module_name) - HIGH dynamic exec prjct-app/cli new Function()
new Function('module', 'exports', 'require', result.outputFiles[0].text)( - HIGH dynamic exec prjct-app/cli eval()
async eval( - LOW obfuscation prjct-app/cli dynamic require()/import()
const m = await import(`../../services/settings-installer?t=${Date.now()}`) - LOW oauth-scope @a-bonus/google-docs-mcp gmail.modify
'https://www.googleapis.com/auth/gmail.modify', - LOW oauth-scope @a-bonus/google-docs-mcp https://www.googleapis.com/auth/drive
'https://www.googleapis.com/auth/drive', - LOW oauth-scope @a-bonus/google-docs-mcp https://www.googleapis.com/auth/spreadsheets
'https://www.googleapis.com/auth/spreadsheets', - LOW oauth-scope @a-bonus/google-docs-mcp https://www.googleapis.com/auth/documents
'https://www.googleapis.com/auth/documents', - LOW oauth-scope @a-bonus/google-docs-mcp gmail.modify
'https://www.googleapis.com/auth/gmail.modify', - LOW oauth-scope @a-bonus/google-docs-mcp https://www.googleapis.com/auth/spreadsheets
'https://www.googleapis.com/auth/spreadsheets', - LOW oauth-scope @a-bonus/google-docs-mcp https://www.googleapis.com/auth/drive
'https://www.googleapis.com/auth/drive', - LOW oauth-scope @a-bonus/google-docs-mcp https://www.googleapis.com/auth/documents
'https://www.googleapis.com/auth/documents', - HIGH dynamic exec @vpxa/aikit eval()
- Avoid \`eval()\`, \`new Function()\`, and dynamic \`require()\`. - HIGH dynamic exec @vpxa/aikit new Function()
- Avoid \`eval()\`, \`new Function()\`, and dynamic \`require()\`. - HIGH dynamic exec @vpxa/aikit eval()
- [ ] **eval/Function prevention**: No dynamic code execution from user input (\`eval()\`, \`new Function()\`, \`vm.runInNewContext()\`)