security
Security
Every MCP risk signal in one place — CVEs, tool safety, drift, naming, licenses. Heuristic: review signals, not verdicts.
45 CRITICAL
3664 HIGH
531 MEDIUM
1207 LOW
11 NONE
Static code-analysis findings — hidden prompt content in shipped skill files, committed secrets, dynamic-exec sinks, and suspicious call-home endpoints — across the analyzed catalogue. Heuristic, pure, no code executed; every row deep-links to its source. Click a kind to filter.
6275 analyzed
297 re-analysis due
1444 not analyzable
9267 not yet analyzed
711 source gone
Running analyzer v17. The scanner changelog explains what each version detects and when it changed.
- hidden prompt82
- committed secret188
- dynamic exec375
- suspicious endpoint175
- token-log85
- oauth-scope112
- skill-script60
- ide-extension2
- skill file11681
- LOW token-logbrilliant-directories-mcpcredential in log
console.log(` claude mcp add ${serverName} -- npx -y brilliant-directories-mcp --api-key ${apiKey} --url ${apiUrl}`); - LOW token-logpokecredential in log
`)}catch(r){console.error(r instanceof Error?r.message:"Failed."),process.exit(1)}});Ee.command("tunnel").description("Forward a local port to Poke (start your MCP server separately, then tunnel that - LOW token-logtask-master-aicredential in log
Context:`)),t.orgName&&console.log(B.gray(` Organization: ${t.orgName}`)),t.briefName&&console.log(B.gray(` Brief: ${t.briefName}`))),{success:!0,action:`status`,credentials:{token:e?.access_tok - LOW token-log@bike4mind/clicredential in log
console.log(`Expires: ${new Date(authTokens.expiresAt).toLocaleString()}`); - LOW token-logsocialneuron/mcp-servercredential in log
console.error(` ${pollData.api_key}`); - LOW token-logchenyuan35/aineedhelpfromotheraicredential in log
if (info.password) console.log(`::add-mask::${info.password}`); - LOW token-logkunwarvivek/mcp-github-project-managercredential in log
console.log(accessToken); - LOW token-logsmithery-ai/clicredential in log
console.log(`SMITHERY_API_KEY=${apiKey}`) - LOW token-logcline/linear-mcpcredential in log
console.log(`LINEAR_API_KEY=${process.env.LINEAR_API_KEY}`); - LOW token-logmsfeldstein/mcp-test-serverscredential in log
console.error(`✅ Token refreshed: new access token expires in ${ACCESS_TOKEN_EXPIRY_SECONDS}s`); - LOW token-logfilipecalegario/mcp-server-strateegiacredential in log
console.log(accessToken); - LOW token-loghenryhaoson/yuque-mcp-servercredential in log
Logger.log(`accessToken: ${accessToken}`); - LOW token-logtayler-id/social-media-mcpcredential in log
console.log(`Access Token: ${access_token}`); - LOW token-logcpropster/linear-mcp-servercredential in log
console.log(`LINEAR_ACCESS_TOKEN=${process.env.LINEAR_ACCESS_TOKEN}`); - LOW token-lograkeshgangwar/strava-mcp-servercredential in log
console.log(`Access Token: ${access_token}`);