MCP Observatory
8m ago Tracked 59,479 Last 8m ago 24h 2,575
github TypeScript analyzed f1c0c38 deep scan unknown

DollhouseMCP/mcp-server

github

A Free, Open Source MCP server for dynamic custom persona management with public a GitHub collection of personas, skills, templates, and other elements for AI models.

maintainer
DollhouseMCP
licence
AGPL-3.0
first seen
2026-06-01
last seen
2026-09-05
releases · 30d
2
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged committed secret in DollhouseMCP/mcp-server
  2. HIGH code analysis flagged committed secret in DollhouseMCP/mcp-server
  3. HIGH code analysis flagged committed secret, dynamic code execution ×3 in DollhouseMCP/mcp-server
  4. HIGH code analysis flagged dynamic code execution ×3 in DollhouseMCP/mcp-server
  5. HIGH code analysis flagged committed secret in DollhouseMCP/mcp-server
  6. HIGH code analysis flagged committed secret in DollhouseMCP/mcp-server
  7. HIGH code analysis flagged committed secret ×2 in DollhouseMCP/mcp-server
capabilities 0 tools
transport stdio · http verified reported listed in the official MCP registry counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit f1c0c38 · analyzer v33 · 1w ago

danger signals8

code evidence vv2.0.42 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1067

filesystem 243

  • fs DollhouseMCP-mcp-server-f1c0c38/oauth-helper.mjs :17 import fs from 'fs/promises';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/analyze-sonarcloud-issues.cjs :7 const fs = require('fs');
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/benchmark-persona-reload.ts :10 import * as fs from 'fs/promises';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/count-tools.js :8 import fs from 'fs';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/fix-element-formatting.ts :15 import * as fs from 'node:fs';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/generate-hashes.mjs :14 import { readFileSync, writeFileSync, readdirSync, statSync } from 'node:fs';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/generate-security-tests.js :8 import { readFileSync, writeFileSync, existsSync } from 'fs';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/generate-version.js :9 import fs from 'fs';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-cleanup-manager.js :15 import { existsSync, readdirSync, unlinkSync, statSync, rmSync } from 'fs';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-collection-submission-test.js :18 import { writeFileSync, mkdirSync, existsSync, readFileSync } from 'fs';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-dashboard-generator.js :11 import fs from 'fs/promises';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-direct-test.js :12 import { writeFileSync, mkdirSync } from 'fs';
show 28 more
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-element-test.js :10 import { writeFileSync, mkdirSync } from 'fs';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-github-integration-test.js :17 import { writeFileSync, mkdirSync } from 'fs';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-inspector-cli-test.js :14 import { writeFileSync, mkdirSync } from 'fs';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-metrics-collector.js :17 import { writeFileSync, existsSync, readFileSync, mkdirSync } from 'fs';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-oauth-github-test.js :20 import fs from 'fs/promises';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-simple-test.js :10 import { writeFileSync, mkdirSync } from 'fs';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-test-runner.js :12 import { writeFileSync, mkdirSync } from 'fs';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-utils.js :10 import { mkdirSync, existsSync } from 'fs';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa/random-agent-skill-sample.ts :2 import { promises as fs } from 'node:fs';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/run-security-audit.ts :26 import * as fs from 'fs/promises';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/security-test-runner.js :9 import { writeFileSync } from 'fs';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/setup-oauth.js :12 import { promises as fs } from 'fs';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/sonarcloud-manager.cjs :308 const fs = require('fs');
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/test-capability-index.js :10 import fs from 'fs';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/totp-manual-test.ts :41 import { mkdtemp, rm } from 'node:fs/promises';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/update-readme-version.js :10 import { readFileSync, writeFileSync } from 'fs';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/update-version.mjs :17 import fs from 'fs';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/utils/github-auth.js :13 import fs from 'fs/promises';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/validate-pat-setup.js :24 import fs from 'fs/promises';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/validation/run-comprehensive-audit.js :4 import fs from 'fs/promises';
  • fs (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/verify-npm-package-assets.mjs :3 import { existsSync, mkdtempSync, rmSync } from 'node:fs';
  • fs DollhouseMCP-mcp-server-f1c0c38/src/auto-dollhouse/portDiscovery.ts :12 import { mkdir, writeFile, unlink } from 'node:fs/promises';
  • fs DollhouseMCP-mcp-server-f1c0c38/src/cli/convert.ts :33 import * as fs from 'node:fs';
  • fs DollhouseMCP-mcp-server-f1c0c38/src/collection/ElementInstaller.ts :21 * The vulnerability existed in installContent() where fs.writeFile() was called after validation
  • fs DollhouseMCP-mcp-server-f1c0c38/src/config/ConfigWizardCheck.ts :8 import { readFileSync } from 'fs';
  • fs DollhouseMCP-mcp-server-f1c0c38/src/converters/AnthropicToDollhouseConverter.ts :28 import * as fs from 'node:fs';
  • fs DollhouseMCP-mcp-server-f1c0c38/src/converters/DollhouseToAnthropicConverter.ts :18 import * as fs from 'node:fs';
  • fs DollhouseMCP-mcp-server-f1c0c38/src/elements/base/ElementFileOperations.ts :18 import { promises as fs } from 'fs';

203 more not shown — this panel samples each group; the count above is the real total.

shell / exec 58

  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/docker/test-mcp-tools.cjs :62 const { exec } = require('node:child_process');
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/docker/test-trigger-index.cjs :5 const { spawn } = require('node:child_process');
  • shell DollhouseMCP-mcp-server-f1c0c38/packages/safety/src/DisplayService.ts :11 import { execFileSync, execSync } from 'child_process';
  • shell DollhouseMCP-mcp-server-f1c0c38/packages/safety/src/TieredSafetyService.ts :108 'exec() call',
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/packages/safety/tests/DisplayService.test.ts :13 import type { ExecFileSyncOptions, ExecSyncOptions } from 'child_process';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/lib/gh-command.js :19 import { spawnSync, execFileSync } from 'node:child_process';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/measure-docker-tokens.ts :9 import { spawn } from 'child_process';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-direct-test.js :13 import { spawn } from 'child_process';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-inspector-cli-test.js :13 import { spawn } from 'child_process';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-oauth-github-test.js :19 import { exec } from 'child_process';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-test-runner.js :14 import { spawn } from 'child_process';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/security-test-runner.js :8 import { spawn } from 'child_process';
show 28 more
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/sonarcloud-manager.cjs :14 const { execSync } = require('child_process');
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/test-capability-index.js :9 import { spawn } from 'child_process';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/test-oauth-full-flow.js :17 import { spawn, exec } from 'child_process';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/update-version.mjs :19 import { execSync } from 'child_process';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/verify-npm-package-assets.mjs :6 import { execFileSync } from 'node:child_process';
  • shell DollhouseMCP-mcp-server-f1c0c38/src/elements/agents/Agent.ts :513 'exec() call': /exec\s*\(/i,
  • shell DollhouseMCP-mcp-server-f1c0c38/src/handlers/GitHubAuthHandler.ts :16 import * as child_process from 'child_process';
  • shell DollhouseMCP-mcp-server-f1c0c38/src/security/audit/config/suppressions.ts :1049 reason: 'Command injection mitigated: interfaceMode and endpointMode are validated against VALID_INTERFACE_MODES and VALID_ENDPOINT_MODES allowlists before use in spawn(). TypeScript types also constr
  • shell DollhouseMCP-mcp-server-f1c0c38/src/security/commandValidator.ts :1 import * as child_process from 'child_process';
  • shell DollhouseMCP-mcp-server-f1c0c38/src/services/BuildInfoService.ts :12 import * as child_process from 'child_process';
  • shell DollhouseMCP-mcp-server-f1c0c38/src/services/VerificationNotifier.ts :8 * - DisplayService uses execSync (blocking). We need non-blocking spawn so
  • shell DollhouseMCP-mcp-server-f1c0c38/src/utils/git.ts :5 import * as child_process from 'child_process';
  • shell DollhouseMCP-mcp-server-f1c0c38/src/web/console/StaleProcessRecovery.ts :237 const { execFile: execFileCb } = await import('node:child_process');
  • shell DollhouseMCP-mcp-server-f1c0c38/src/web/routes/setupRoutes.ts :12 import { execFile } from 'node:child_process';
  • shell DollhouseMCP-mcp-server-f1c0c38/src/web/server.ts :17 import { execFile } from 'node:child_process';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/tests/docker/permission-hooks/run-hook-case.mjs :5 import { spawn } from 'node:child_process';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/tests/e2e/mcp-tool-flow.test.ts :10 import { spawn, ChildProcess } from 'child_process';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/tests/integration/ci/ci-environment.test.ts :5 import { execSync } from 'child_process';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/tests/integration/console-lifecycle.test.ts :15 import { spawn } from 'node:child_process';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/tests/integration/hooks/permission-hook-docker.test.ts :2 import { execFileSync, spawnSync } from 'node:child_process';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/tests/integration/mcp-aql/memory-addentry-persistence.test.ts :109 const untrustedProse = 'Historical example: exec("dangerous command")';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/tests/integration/mcp-protocol-compliance.test.ts :13 import { spawn, ChildProcess } from 'node:child_process';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/tests/integration/security-audit-batch-a.integration.test.ts :100 const result = classifyTool('Bash', { command: 'ruby -e "exec(\'id\')"' });
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/tests/integration/startup/startup-readiness.test.ts :16 import { spawn, ChildProcess } from 'node:child_process';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/tests/integration/web/nvm-launcher.integration.test.ts :29 import { execFile } from 'node:child_process';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/tests/scripts/test-element-lifecycle.js :55 import { spawn } from 'child_process';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/tests/scripts/test-full-validation.js :11 import { spawn } from 'child_process';
  • shell (weak) DollhouseMCP-mcp-server-f1c0c38/tests/scripts/test-mcp-docker.js :8 import { spawn } from 'child_process';

18 more not shown — this panel samples each group; the count above is the real total.

network 50

  • net (weak) DollhouseMCP-mcp-server-f1c0c38/docker/test-mcp-tools.cjs :7 const http = require('node:http');
  • net DollhouseMCP-mcp-server-f1c0c38/oauth-helper.mjs :116 const response = await fetch(TOKEN_URL, {
  • net (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-collection-submission-test.js :22 import fetch from 'node-fetch';
  • net (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-github-integration-test.js :356 const response = await fetch(
  • net (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-oauth-github-test.js :151 const response = await fetch(url, {
  • net (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-test-runner.js :11 import fetch from 'node-fetch';
  • net (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-utils.js :9 import fetch from 'node-fetch';
  • net (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/sonarcloud-manager.cjs :13 const https = require('https');
  • net (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/test-oauth-full-flow.js :417 const response = await fetch(
  • net (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/totp-manual-test.ts :81 const res = await fetch(`http://127.0.0.1:${TEST_PORT}${path}`, {
  • net (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/utils/github-auth.js :75 const response = await fetch('https://api.github.com/user', {
  • net DollhouseMCP-mcp-server-f1c0c38/src/auth/GitHubAuthManager.ts :188 const response = await fetch(url, options);
show 28 more
  • net DollhouseMCP-mcp-server-f1c0c38/src/auto-dollhouse/portDiscovery.ts :9 import { createServer } from 'node:net';
  • net DollhouseMCP-mcp-server-f1c0c38/src/cache/CollectionIndexCache.ts :152 const response = await fetch(this.INDEX_URL, { headers });
  • net DollhouseMCP-mcp-server-f1c0c38/src/collection/CollectionIndexManager.ts :341 const response = await fetch(this.INDEX_URL, {
  • net DollhouseMCP-mcp-server-f1c0c38/src/collection/ElementInstaller.ts :635 const response = await fetch(match.entry.githubDownloadUrl);
  • net DollhouseMCP-mcp-server-f1c0c38/src/collection/GitHubClient.ts :83 const response = await fetch(url, {
  • net DollhouseMCP-mcp-server-f1c0c38/src/portfolio/GitHubPortfolioIndexer.ts :472 const response = await fetch(fileInfo.download_url);
  • net DollhouseMCP-mcp-server-f1c0c38/src/portfolio/PortfolioRepoManager.ts :124 const response = await fetch(url, options);
  • net DollhouseMCP-mcp-server-f1c0c38/src/portfolio/PortfolioSyncManager.ts :376 const response = await fetch(entry.downloadUrl, {
  • net DollhouseMCP-mcp-server-f1c0c38/src/security/tokenManager.ts :259 const response = await fetch('https://api.github.com/user', {
  • net DollhouseMCP-mcp-server-f1c0c38/src/tools/portfolio/submitToPortfolioTool.ts :1141 const response = await fetch(url, {
  • net DollhouseMCP-mcp-server-f1c0c38/src/utils/SecureDownloader.ts :418 const response = await fetch(url, {
  • net DollhouseMCP-mcp-server-f1c0c38/src/web/console/IngestRoutes.ts :463 const legacyRes = await fetch('http://127.0.0.1:3939/api/sessions', {
  • net DollhouseMCP-mcp-server-f1c0c38/src/web/console/LeaderElection.ts :438 const res = await fetch(`http://127.0.0.1:${leaderInfo.port}/api/logs/stats`, {
  • net DollhouseMCP-mcp-server-f1c0c38/src/web/console/LeaderForwardingSink.ts :128 const response = await fetch(`${this.leaderUrl}/api/ingest/logs`, {
  • net DollhouseMCP-mcp-server-f1c0c38/src/web/portDiscovery.ts :18 import { createServer, type Server } from 'node:net';
  • net DollhouseMCP-mcp-server-f1c0c38/src/web/public/app.js :224 const res = await fetch(`${RAW_BASE}/${el.path}`, { method: 'HEAD' });
  • net DollhouseMCP-mcp-server-f1c0c38/src/web/public/consoleAuth.js :13 * fetch('/api/elements') → DollhouseAuth.apiFetch('/api/elements')
  • net DollhouseMCP-mcp-server-f1c0c38/src/web/public/setup.js :1784 const res = await fetch('/api/setup/license');
  • net DollhouseMCP-mcp-server-f1c0c38/src/web/routes.ts :462 const response = await fetch('https://raw.githubusercontent.com/DollhouseMCP/collection/main/public/collection-index.json');
  • net DollhouseMCP-mcp-server-f1c0c38/src/web/routes/setupRoutes.ts :521 const response = await fetch(workerUrl, {
  • net (weak) DollhouseMCP-mcp-server-f1c0c38/tests/docker/permission-hooks/run-hook-case.mjs :1 import { createServer } from 'node:http';
  • net (weak) DollhouseMCP-mcp-server-f1c0c38/tests/e2e/setup-test-env.ts :117 const response = await fetch('https://api.github.com/user', {
  • net (weak) DollhouseMCP-mcp-server-f1c0c38/tests/helpers/github-api-client.ts :280 const response = await fetch(url, { method: 'HEAD' });
  • net (weak) DollhouseMCP-mcp-server-f1c0c38/tests/integration/collection/collection-submission-mcp.test.ts :445 const response = await fetch(
  • net (weak) DollhouseMCP-mcp-server-f1c0c38/tests/integration/console-lifecycle.test.ts :14 import * as net from 'node:net';
  • net (weak) DollhouseMCP-mcp-server-f1c0c38/tests/integration/templates/template-rendering-proof.test.ts :556 fetch('/api/action', {
  • net (weak) DollhouseMCP-mcp-server-f1c0c38/tests/qa/oauth-pat-test.mjs :350 const response = await fetch('https://api.github.com/user', { headers });
  • net (weak) DollhouseMCP-mcp-server-f1c0c38/tests/security/backtick-validation.test.ts :18 'Call the API with: `fetch("/api/data")`'

10 more not shown — this panel samples each group; the count above is the real total.

secrets 30

  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/generate-security-tests.js :100 process.env.SENSITIVE_KEY = 'secret-value-12345';
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-collection-submission-test.js :339 ...(process.env.GITHUB_TOKEN ? {
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-github-integration-test.js :362 ...(process.env.GITHUB_TOKEN ? {
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-metrics-collector.js :36 github_token_available: !!process.env.TEST_GITHUB_TOKEN
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-simple-test.js :222 github_token_available: !!process.env.TEST_GITHUB_TOKEN
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-test-runner.js :33 let SESSION_TOKEN = process.env.MCP_SESSION_TOKEN || '';
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/qa-utils.js :269 if (requirements.requiresGitHubToken && !process.env.TEST_GITHUB_TOKEN) {
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/utils/github-auth.js :26 return !!process.env.TEST_GITHUB_TOKEN;
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/scripts/validate-pat-setup.js :106 const token = process.env.TEST_GITHUB_TOKEN;
  • secrets DollhouseMCP-mcp-server-f1c0c38/src/config/portfolioConfig.ts :184 !!process.env.GITHUB_TEST_TOKEN?.trim();
  • secrets DollhouseMCP-mcp-server-f1c0c38/src/security/DangerZoneEnforcer.ts :152 private adminToken: string | null = process.env.DOLLHOUSE_DANGER_ZONE_ADMIN_TOKEN || null;
  • secrets DollhouseMCP-mcp-server-f1c0c38/src/security/tokenManager.ts :133 let token = process.env.GITHUB_TOKEN;
show 18 more
  • secrets DollhouseMCP-mcp-server-f1c0c38/src/telemetry/OperationalTelemetry.ts :120 const customApiKey = process.env.POSTHOG_API_KEY;
  • secrets DollhouseMCP-mcp-server-f1c0c38/src/web/routes/setupRoutes.ts :53 const POSTHOG_PROJECT_KEY = process.env.POSTHOG_API_KEY || 'phc_xFJKIHAqRX1YLa0TSdTGwGj19d1JeoXDKjJNYq492vq';
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/tests/e2e/mcp-tool-flow.test.ts :239 process.env.GITHUB_TOKEN = testEnv.githubToken;
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/tests/e2e/test-mcp-simple-submit.js :51 process.env.GITHUB_TOKEN = token;
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/tests/e2e/test-real-mcp-submit.js :56 process.env.GITHUB_TOKEN = token;
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/tests/integration/collection/collection-submission-mcp.test.ts :159 if (!process.env.GITHUB_TOKEN) {
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/tests/qa/oauth-auth-test.mjs :127 check: () => process.env.GITHUB_TOKEN,
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/tests/qa/oauth-pat-test.mjs :40 const hasPAT = !!process.env.TEST_GITHUB_TOKEN;
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/tests/scripts/test-element-lifecycle.js :287 const ghToken = process.env.GITHUB_TEST_TOKEN || process.env.TEST_GITHUB_TOKEN || process.env.GITHUB_TOKEN;
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/tests/scripts/test-full-validation.js :364 if (!process.env.GITHUB_TEST_TOKEN) {
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/tests/security/framework/RapidSecurityTesting.ts :206 process.env.GITHUB_TOKEN = fakeToken;
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/tests/security/tests/mcp-tools-security.test.ts :357 process.env.GITHUB_TOKEN = fakeToken;
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/tests/setup-e2e-env.mjs :18 if (!process.env.GITHUB_TOKEN && !process.env.CI) {
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/tests/unit/TokenManager.test.ts :13 delete process.env.GITHUB_TOKEN;
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/tests/unit/auth/oauth-helper.test.ts :196 const originalTokenSecret = process.env.DOLLHOUSE_TOKEN_SECRET;
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/tests/unit/config/portfolioConfig.test.ts :373 delete process.env.GITHUB_TEST_TOKEN;
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/tests/unit/security/tokenManager.rateLimit.test.ts :155 process.env.GITHUB_TOKEN = 'ghp_' + 'x'.repeat(36);
  • secrets (weak) DollhouseMCP-mcp-server-f1c0c38/tests/unit/security/tokenManager.storage.test.ts :62 delete process.env.GITHUB_TOKEN;

install hooks 1

  • prepublishOnly DollhouseMCP-mcp-server-f1c0c38/package.json :25 cp README.md README.md.backup 2>/dev/null || true && cp README.npm.md README.md && BUILD_TYPE=npm npm run build

declared dependencies 47

  • @modelcontextprotocol/sdk@^1.25.1
  • @modelcontextprotocol/inspector@^0.21.1
  • @dollhousemcp/safety@^1.0.2
  • chalk@^5.6.2
  • dompurify@^3.4.11
  • dotenv@^17.2.3
  • express@^5.2.1
  • extract-zip@^2.0.1
  • graphql@^16.12.0
  • graphql-tag@^2.12.6
  • gray-matter@^4.0.3
  • install-mcp@^1.10.2
show 28 more
  • js-yaml@^4.1.1
  • jsdom@^24.1.3
  • node-fetch@^3.3.2
  • otpauth@^9.5.0
  • posthog-node@^5.24.17
  • qrcode@^1.5.4
  • smol-toml@^1.6.1
  • uuid@^11.1.1
  • zod@^4.3.6
  • @eslint/js@^9.38.0
  • @jest/globals@^30.3.0
  • @playwright/test@^1.59.1
  • @types/archiver@^7.0.0
  • @types/dompurify@^3.2.0
  • @types/express@^5.0.6
  • @types/jest@^30.0.0
  • @types/js-yaml@^4.0.9
  • @types/jsdom@^21.1.7
  • @types/node@^24.10.0
  • @types/qrcode@^1.5.6
  • @types/semver@^7.7.1
  • @types/supertest@^7.2.0
  • @types/uuid@^10.0.0
  • @typescript-eslint/eslint-plugin@^8.46.2
  • @typescript-eslint/parser@^8.48.1
  • archiver@^7.0.1
  • cross-env@^10.1.0
  • eslint@^9.38.0

7 more not shown — this panel samples each group; the count above is the real total.

perm:untrusted 1

  • untrusted DollhouseMCP-mcp-server-f1c0c38/src/web/public/consoleAuth.js :84 return fetch(input, opts).then(function (response) {