Preview release of FusionAuth API MCP server
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · streamable-http · http counts 6 tools · 0 res
· 0 prompts
permission surface via README inference
tools
-
create
-
delete
-
patch
-
retrieve
-
search
-
update
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit d03f3e2 · analyzer v33 · 4w ago
danger signals2
- dynamic code execution eval() FusionAuth-fusionauth-mcp-api-d03f3e2/packages/mcp-api/src/index.ts :4088
const zodSchema = eval(zodSchemaString); - dynamic code execution eval() FusionAuth-fusionauth-mcp-api-d03f3e2/packages/openapi-mcp-generator/src/generator/server-code.ts :238
const zodSchema = eval(zodSchemaString);
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 24
filesystem 2
- fs FusionAuth-fusionauth-mcp-api-d03f3e2/bin/update-server-json-version.js :1
const fs = require('fs'); - fs FusionAuth-fusionauth-mcp-api-d03f3e2/packages/openapi-mcp-generator/src/index.ts :8
import fs from 'fs/promises';
network 4
- net FusionAuth-fusionauth-mcp-api-d03f3e2/packages/mcp-api/src/index.ts :23
import axios, { type AxiosRequestConfig, type AxiosError } from 'axios'; - net FusionAuth-fusionauth-mcp-api-d03f3e2/packages/openapi-mcp-generator/src/generator/server-code.ts :107
import axios, { type AxiosRequestConfig, type AxiosError } from 'axios'; - net FusionAuth-fusionauth-mcp-api-d03f3e2/packages/openapi-mcp-generator/src/generator/streamable-http.ts :470
const response = await fetch('/mcp', { - net FusionAuth-fusionauth-mcp-api-d03f3e2/packages/openapi-mcp-generator/src/generator/web-server.ts :617
const response = await fetch(fullEndpoint, {