MCPCAN is a centralized management platform for MCP services. It deploys each MCP service using a container deployment method. The platform supports container monitoring and MCP service token verification, solving security risks and enabling rapid deployment of MCP services. It uses SSE, STDIO, and STREAMABLEHTTP access protocols to deploy MCP。
Drift inferred · capture-to-capture
- HIGH code analysis flagged committed secret ×5 in Kymo-MCP/mcpcan
transport stdio · http · sse counts 5 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
get_cpu_usage
-
get_disk_usage
-
get_memory_usage
-
get_system_info
-
get_top_processes
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 67969dd · analyzer v33 · 4w ago
skills & prompt files 1
- agent-rules Kymo-MCP-mcpcan-67969dd/.cursorrules
danger signals3
- committed secret private key Kymo-MCP-mcpcan-67969dd/deploy/docker-compose/config-template/certs/mcpcan.example.com.key :1
PEM private key block (redacted) - committed secret private key Kymo-MCP-mcpcan-67969dd/deploy/flow-step/env/mcpcan-enterprise-dev/tls.key :1
PEM private key block (redacted) - committed secret private key Kymo-MCP-mcpcan-67969dd/frontend/key.pem :1
PEM private key block (redacted)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 319
filesystem 3
- fs Kymo-MCP-mcpcan-67969dd/frontend/vite.config.docker.local.ts :3
import fs from 'node:fs' - fs Kymo-MCP-mcpcan-67969dd/frontend/vite.config.https.ts :6
import fs from 'node:fs' // 使用ES模块风格导入fs - fs (weak) Kymo-MCP-mcpcan-67969dd/frontend/vite.config.ts :3
import fs from 'node:fs'
shell / exec 1
- shell (weak) Kymo-MCP-mcpcan-67969dd/frontend/vite.config.ts :4
import { execSync } from 'node:child_process'
network 3
- net Kymo-MCP-mcpcan-67969dd/frontend/src/pages/ai-chat/composables/useChat.ts :470
const response = await fetch(url, { - net Kymo-MCP-mcpcan-67969dd/frontend/src/utils/mcp-client.ts :110
const resp = await fetch(url, { - net Kymo-MCP-mcpcan-67969dd/frontend/src/utils/request.ts :1
import axios, { type InternalAxiosRequestConfig, type AxiosResponse } from 'axios'
tool registrations 5
- get_system_info Kymo-MCP-mcpcan-67969dd/backend/init-data/code-package/python-mcp-sys-monitor.zip!/mcp-sys-monitor/server/main.py :36
- get_cpu_usage Kymo-MCP-mcpcan-67969dd/backend/init-data/code-package/python-mcp-sys-monitor.zip!/mcp-sys-monitor/server/main.py :58
- get_memory_usage Kymo-MCP-mcpcan-67969dd/backend/init-data/code-package/python-mcp-sys-monitor.zip!/mcp-sys-monitor/server/main.py :96
- get_disk_usage Kymo-MCP-mcpcan-67969dd/backend/init-data/code-package/python-mcp-sys-monitor.zip!/mcp-sys-monitor/server/main.py :129
- get_top_processes Kymo-MCP-mcpcan-67969dd/backend/init-data/code-package/python-mcp-sys-monitor.zip!/mcp-sys-monitor/server/main.py :175
declared dependencies 174
- github.com/mark3labs/mcp-go@v0.44.0-beta.3
- @element-plus/icons-vue@^2.3.1
- @types/lodash-es@^4.17.12
- @types/markdown-it@^14.1.2
- @vueuse/core@^13.6.0
- axios@^1.12.2
- cobe@^0.6.5
- countup.js@^2.9.0
- element-plus@^2.11.3
- gsap@^3.13.0
- js-yaml@^4.1.0
- jsrsasign@^10.9.0
show 28 more
- lodash-es@^4.17.21
- markdown-it@^14.1.0
- monaco-editor@^0.55.1
- nprogress@^0.2.0
- path-browserify@^1.0.1
- pinia@^3.0.3
- qs@^6.14.0
- v-drag@^3.0.9
- vue@^3.5.18
- vue-i18n@^11.1.12
- vue-router@^4.5.1
- vue-virtual-scroller@2.0.0-beta.8
- @element-plus/theme-chalk@^2.2.16
- @testing-library/vue@^8.1.0
- @tsconfig/node22@^22.0.2
- @types/js-yaml@^4.0.9
- @types/jsrsasign@^10.5.15
- @types/node@^22.16.5
- @types/nprogress@^0.2.3
- @types/path-browserify@^1.0.3
- @types/qs@^6.14.0
- @typescript-eslint/eslint-plugin@^8.44.0
- @typescript-eslint/parser@^8.44.0
- @unocss/reset@^66.5.1
- @vitejs/plugin-vue@^6.0.1
- @vitest/ui@4.0.16
- @vue/eslint-config-prettier@^10.2.0
- @vue/eslint-config-typescript@^14.6.0
134 more not shown — this panel samples each group; the count above is the real total.
transport_posture 2
- network-listening, binds all interfaces, no auth detected Kymo-MCP-mcpcan-67969dd/frontend/vite.config.docker.local.ts :22
host: '0.0.0.0', - network-listening, binds all interfaces, no auth detected Kymo-MCP-mcpcan-67969dd/frontend/vite.config.https.ts :20
host: '0.0.0.0',