Risk grades

patchable now 1 server · fix published, not adopted

A fix already ships upstream but the server still runs an older, vulnerable version — remediation lag, actionable today.

1. agentfront/frontmcp HIGH CVE-2026-39885 1.5.2 → 2.3.0

Grades are inferred review prompts, not verdicts. Every claim is tagged by what backs it: attested a verifiable record reported a third party's claim inferred our own heuristic methodology →

1. 1 E PrefectHQ/fastmcp 100
   • vuln 50
   • exposure 35
   • drift 20
   • safety 12
2. 2 E clidey/whodb 100
   • vuln 50
   • exposure 35
   • drift 20
   • safety 12
3. 3 E modelcontextprotocol/inspector 97
   • vuln 50
   • exposure 35
   • safety 12
4. 4 E IBM/mcp-context-forge 96
   • vuln 50
   • exposure 35
   • safety 19
5. 5 E awslabs/mcp 94
   • vuln 50
   • exposure 35
   • safety 17
6. 6 E dep0we/atomic-agents-stack 94
   • vuln 50
   • exposure 35
   • safety 12
7. 7 E electerm/electerm 91
   • vuln 50
   • exposure 35
   • safety 14
8. 8 E strands-agents/tools 91
   • vuln 50
   • exposure 30
   • safety 19
9. 9 E ThinkInAIXYZ/deepchat 89
   • vuln 50
   • exposure 35
   • safety 12
10. 10 E dagucloud/dagu 89
    • vuln 50
    • exposure 35
    • safety 12
11. 11 E modelcontextprotocol/inspector 89
    • vuln 50
    • exposure 35
    • safety 12
12. 12 E modelcontextprotocol/typescript-sdk 89
    • vuln 50
    • exposure 35
    • safety 12
13. 13 E opena2a-org/hackmyagent 89
    • vuln 50
    • exposure 35
    • safety 12
14. 14 E cuga-project/cuga-agent 87
    • exposure 35
    • drift 20
    • inherited 15
    • safety 25
15. 15 E danielealbano/android-remote-control-mcp 87
    • vuln 35
    • exposure 28
    • drift 20
    • safety 12