Self-hosted MCP gateway that turns any REST, GraphQL, or MCP server into secure, governed AI tools — OpenAPI auto-discovery, per-tool guardrails, RBAC, circuit breaking, and a real admin UI.
C elevated
- capability exposure inferred + 35
- tool safety inferred + 12
- trust mitigators mixed − 3
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
grade last moved 1w ago · see ecosystem CVEs →
- B · 32 → C · 44
- C · 35 → B · 32
Inferred surface — each links to servers holding it:
No known CVEs for this server.
- high dangerous code
committed secret: Google API key · obfuscated payload: dynamic require()/import()
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit f87ad2d · analyzer v33 · 2d ago
skills & prompt files 1
- agent-rules CarlxsMG-mcpbridge-f87ad2d/CLAUDE.md
danger signals91
- suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/__tests__/config-versions.test.ts :30
await registry.register("svc", [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 9.9.9.9 CarlxsMG-mcpbridge-f87ad2d/src/__tests__/ha.test.ts :33
VALUES (?, '9.9.9.9', 'http://9.9.9.9/health', 'http://9.9.9.9', '9.9.9.9', 0, 1, 'rest', ?, ?)`, - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/__tests__/ha.test.ts :90
await registry.register(name, [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/__tests__/ws-proxy.test.ts :69
await registry.register("dup-name", [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/approvals-mutation.test.ts :74
await registry.register(CLIENT, [doTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.5 CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/approvals-mutation.test.ts :204
await registry.register(CLIENT2, [doTool], "http://1.2.3.5/health", "1.2.3.5", "http://1.2.3.5", "1.2.3.5"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/approvals.test.ts :35
await registry.register(CLIENT, [doTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/monitor-mutation.test.ts :58
await registry.register(CLIENT, [getTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/monitor.test.ts :29
await registry.register(CLIENT, [getTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/schedules-mutation.test.ts :50
await registry.register(name, [makeTool(toolName)], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/schedules.test.ts :36
await registry.register("svc", [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/teams-mutation.test.ts :51
await registry.register(name, [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/admin/entities/__tests__/teams.test.ts :39
await registry.register(name, [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 5.6.7.8 CarlxsMG-mcpbridge-f87ad2d/src/admin/tool-policies/mutations/__tests__/mutations-batch.test.ts :1109
ws: { wsUrl: "http://5.6.7.8" }, - suspicious endpoint docs.sentry.io (telemetry) CarlxsMG-mcpbridge-f87ad2d/src/catalog/builtin.ts :129
healthUrl: "https://docs.sentry.io/", - suspicious endpoint us.sentry.io (telemetry) CarlxsMG-mcpbridge-f87ad2d/src/catalog/builtin.ts :130
baseUrl: "https://us.sentry.io", - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/lib/__tests__/tool-config-mutation.test.ts :38
"http://1.2.3.4/health", - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/canary.test.ts :26
await registry.register(CLIENT, [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 5.6.7.8 CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/canary.test.ts :31
secondaryBaseUrl: "http://5.6.7.8", - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/load-balancer-mutation.test.ts :73
await registry.register(CLIENT, [getTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 5.6.7.8 CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/load-balancer-mutation.test.ts :152
const ok = await addUpstream(CLIENT, "http://5.6.7.8", 1000); - suspicious endpoint 9.9.9.9 CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/load-balancer-mutation.test.ts :154
const rejected = await addUpstream(CLIENT, "http://9.9.9.9", 1001); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/load-balancer.test.ts :39
await registry.register(CLIENT, [getTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 5.6.7.8 CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/load-balancer.test.ts :108
markTargetDown(`${CLIENT}#http://5.6.7.8`); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/mcp-server-mutation-s3.test.ts :81
await registry.register(name, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/mcp-server-mutation-s4.test.ts :460
await registry.register(name, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/mcp/__tests__/tool-search.test.ts :43
await registry.register(clientName, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 93.184.216.34 CarlxsMG-mcpbridge-f87ad2d/src/middleware/__tests__/ip-validator-mutation.test.ts :173
const result = await validateBackendUrl("http://93.184.216.34/", false, []); - suspicious endpoint 93.184.216.34 CarlxsMG-mcpbridge-f87ad2d/src/middleware/__tests__/ip-validator.test.ts :58
const result = await validateBackendUrl("http://93.184.216.34/", false, []); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/observability/__tests__/tracing.test.ts :108
await registry.register("svc", [tool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/observability/__tests__/traffic.test.ts :24
await registry.register(CLIENT, [getTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/backends.test.ts :42
await registry.register(CLIENT, [gqlTool, wsTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 5.6.7.8 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/backends.test.ts :271
expect(await setToolWs(CLIENT, "wst", { enabled: true, wsUrl: "http://5.6.7.8" })).toMatchObject({ - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/dispatch-rest-canary-cancel.test.ts :44
await registry.register(clientName, [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 9.9.9.9 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/dispatch-rest-canary-cancel.test.ts :89
await setCanary(CLIENT, { secondaryBaseUrl: "http://9.9.9.9", mode: "canary", weight: 100, enabled: true }); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/dispatch-rest-graphql-probe.test.ts :50
await registry.register(clientName, [tool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/dispatch-rest-param-locations.test.ts :43
await registry.register(CLIENT, [tool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-guards.test.ts :25
await registry.register(CLIENT, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-isdeleting-guard.test.ts :63
await registry.register(CLIENT, [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c1-pure-helpers.test.ts :38
await registry.register(CLIENT, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c10-success-response.test.ts :42
const BASE_URL = "http://1.2.3.4"; - suspicious endpoint 5.6.7.9 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c10-success-response.test.ts :624
secondaryBaseUrl: "http://5.6.7.9", - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c11-error-retry.test.ts :43
await registry.register(CLIENT, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 5.6.7.8 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c11-error-retry.test.ts :778
await addUpstream(CLIENT, "http://5.6.7.8", 1); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c12-ws-dispatch.test.ts :39
await registry.register(name, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c2-pagination.test.ts :36
await registry.register(CLIENT, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 9.9.9.9 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c2-pagination.test.ts :730
return json([1, 2], { link: '<http://9.9.9.9/list?page=2>; rel="next"' }); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c3-wrapper-approval.test.ts :41
await registry.register(CLIENT, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c4-gates-auth.test.ts :103
await registry.register(CLIENT, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c5-gates-quarantine.test.ts :62
"http://1.2.3.4/health", - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c6-mock-cache-coalesce.test.ts :49
await registry.register(client, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c7-breaker-lb-canary.test.ts :54
await registry.register(clientName, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 5.6.7.8 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c7-breaker-lb-canary.test.ts :149
const t1 = await addUpstream(CLIENT, "http://5.6.7.8", 1); - suspicious endpoint 9.9.9.9 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c7-breaker-lb-canary.test.ts :150
const t2 = await addUpstream(CLIENT, "http://9.9.9.9", 1); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c8-path-ajv-transform.test.ts :52
await registry.register(CLIENT, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 5.6.7.9 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c9-pinip-request.test.ts :197
await addUpstream(NAME, "http://5.6.7.9", 1); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c9-pinip-request.test.ts :201
incInflight(`${NAME}#http://1.2.3.4`); - suspicious endpoint 5.6.7.10 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c9-pinip-request.test.ts :229
await setCanary(NAME, { secondaryBaseUrl: "http://5.6.7.10", mode: "canary", weight: 100, enabled: true }); - suspicious endpoint 5.6.7.12 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c9-pinip-request.test.ts :844
await addUpstream(NAME, "http://5.6.7.12", 1); - suspicious endpoint 5.6.7.11 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-mutation-c9-pinip-request.test.ts :881
await setClientOAuth(NAME, { tokenUrl: "http://5.6.7.11/token", clientId: "id", clientSecret: "s" }); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy-response-sanitization-parity.test.ts :74
await registry.register(CLIENT, [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/proxy.test.ts :42
"http://1.2.3.4/health", - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/response-cache.test.ts :43
await registry.register(CLIENT, [getTool, postTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/streaming.test.ts :25
await registry.register(CLIENT, [streamTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/proxy/__tests__/transform.test.ts :32
await registry.register(CLIENT, [getTool, postTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 5.6.7.8 CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-canary-mutation.test.ts :169
body: JSON.stringify({ secondaryBaseUrl: "http://5.6.7.8" }), - suspicious endpoint 5.6.7.8 CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-lb-mutation.test.ts :280
body: JSON.stringify({ baseUrl: "http://5.6.7.8" }), - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-monitors-mutation.test.ts :47
await registry.register(CLIENT, [tool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 5.6.7.8 CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-oauth-mutation.test.ts :236
body: JSON.stringify({ tokenUrl: "http://5.6.7.8", clientId: "cid", clientSecret: "csecret" }), - suspicious endpoint 169.254.169.254 (cloud metadata) CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-register.test.ts :436
health_url: "http://169.254.169.254/latest/meta-data/", - suspicious endpoint 5.6.7.8 CarlxsMG-mcpbridge-f87ad2d/src/routes/__tests__/routes-ws-proxy-admin-mutation.test.ts :357
const res = await createTarget(baseUrl, "svc-wspa-bad-protocol", { backendWsUrl: "http://5.6.7.8" }); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/security/__tests__/oauth-mutation.test.ts :52
await registry.register(CLIENT, [getTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 5.6.7.8 CarlxsMG-mcpbridge-f87ad2d/src/security/__tests__/oauth-mutation.test.ts :111
const result = await setClientOAuth(CLIENT, { tokenUrl: "http://5.6.7.8/t", clientId: "id", clientSecret: "s" }); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/security/__tests__/oauth.test.ts :30
await registry.register(CLIENT, [getTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 5.6.7.8 CarlxsMG-mcpbridge-f87ad2d/src/security/__tests__/oauth.test.ts :72
await setClientOAuth("ghost", { tokenUrl: "http://5.6.7.8/t", clientId: "id", clientSecret: "s" }), - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/tool-policies/__tests__/coalesce.test.ts :37
await registry.register(CLIENT, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/tool-policies/__tests__/guardrails-mutation-compile-row.test.ts :53
await registry.register(CLIENT, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/tool-policies/__tests__/guardrails-mutation-final.test.ts :38
await registry.register(CLIENT, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/tool-policies/__tests__/guardrails-mutation-setguardrails.test.ts :35
await registry.register(CLIENT, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/tool-policies/__tests__/guardrails.test.ts :41
await registry.register(CLIENT, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/tool-policies/__tests__/mock.test.ts :25
await registry.register(CLIENT, [getTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/tool-policies/__tests__/pagination-mutation.test.ts :29
await registry.register(CLIENT, [listTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/tool-policies/__tests__/pagination.test.ts :33
await registry.register(CLIENT, [listTool], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 9.9.9.9 CarlxsMG-mcpbridge-f87ad2d/src/tool-policies/__tests__/pagination.test.ts :197
return json([1, 2], { link: '<http://9.9.9.9/list?page=2>; rel="next"' }); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/tool-policies/__tests__/quarantine-mutation.test.ts :49
"http://1.2.3.4/health", - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/tool-policies/__tests__/quarantine.test.ts :44
await registry.register(CLIENT, [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/tool-policies/__tests__/tool-alias.test.ts :30
await registry.register(clientName, tools, "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/tool-policies/__tests__/tool-examples-mutation.test.ts :28
await registry.register(CLIENT, [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/tool-policies/__tests__/tool-examples.test.ts :27
await registry.register("svc", [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - suspicious endpoint 1.2.3.4 CarlxsMG-mcpbridge-f87ad2d/src/tool-policies/__tests__/tool-mock-mutation.test.ts :27
await registry.register(CLIENT, [makeTool()], "http://1.2.3.4/health", "1.2.3.4", "http://1.2.3.4", "1.2.3.4"); - committed secret Google API key CarlxsMG-mcpbridge-f87ad2d/src/tool-policies/__tests__/guardrails-mutation-secrets.test.ts :128
AIza01…(39 chars, redacted)
[](https://mcpobservatory.com/servers/github:CarlxsMG/mcpbridge/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of CarlxsMG.