The official FastMCP TypeScript library for building MCP servers, clients, and apps 🏎️ 🏎️ 🏎️
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit a969c55 · analyzer v33 · 6d ago
skills & prompt files 2
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 197
filesystem 16
- fs (weak) PrefectHQ-fastmcp-ts-a969c55/scripts/generate-api-nav.mjs :3
import { readFileSync, writeFileSync } from 'node:fs' - fs (weak) PrefectHQ-fastmcp-ts-a969c55/scripts/test-dist.mjs :15
import { readFileSync } from 'node:fs' - fs PrefectHQ-fastmcp-ts-a969c55/src/cli/commands/install/shared.ts :1
import { mkdirSync, existsSync } from 'node:fs' - fs PrefectHQ-fastmcp-ts-a969c55/src/cli/utils/config-paths.ts :3
import { readFileSync, writeFileSync, existsSync } from 'node:fs' - fs PrefectHQ-fastmcp-ts-a969c55/src/cli/utils/file-spec.ts :1
import { existsSync } from 'node:fs' - fs PrefectHQ-fastmcp-ts-a969c55/src/client/auth.ts :102
const raw = await fs.readFile(await this._path(), 'utf8') - fs (weak) PrefectHQ-fastmcp-ts-a969c55/tests/apps/generative.test.ts :69
arguments: { code: "require('fs').readFileSync('/etc/passwd', 'utf8')" }, - fs (weak) PrefectHQ-fastmcp-ts-a969c55/tests/cli.test.ts :3
import { mkdtemp, mkdir, writeFile, rm, readFile } from 'node:fs/promises' - fs (weak) PrefectHQ-fastmcp-ts-a969c55/tests/client/auth.test.ts :16
import { mkdir, rm, writeFile } from 'fs/promises' - fs (weak) PrefectHQ-fastmcp-ts-a969c55/tests/conformance/run-client.mjs :31
import { existsSync } from 'node:fs' - fs (weak) PrefectHQ-fastmcp-ts-a969c55/tests/conformance/run-server.mjs :24
import { existsSync } from 'node:fs' - fs (weak) PrefectHQ-fastmcp-ts-a969c55/tests/fixtures/openapi-server.ts :6
import { readFileSync } from 'node:fs' - fs (weak) PrefectHQ-fastmcp-ts-a969c55/tests/server/openapi/director.test.ts :1
import { readFileSync } from 'node:fs' - fs (weak) PrefectHQ-fastmcp-ts-a969c55/tests/server/openapi/parser.test.ts :1
import { readFileSync } from 'node:fs' - fs (weak) PrefectHQ-fastmcp-ts-a969c55/tests/server/openapi/server.test.ts :1
import { readFileSync } from 'node:fs' - fs PrefectHQ-fastmcp-ts-a969c55/tsup.config.ts :2
import { readFileSync } from 'node:fs'
shell / exec 8
- shell PrefectHQ-fastmcp-ts-a969c55/src/cli/commands/dev/inspector.ts :2
import { spawn } from 'node:child_process' - shell PrefectHQ-fastmcp-ts-a969c55/src/cli/commands/run.ts :2
import { spawn } from 'node:child_process' - shell PrefectHQ-fastmcp-ts-a969c55/src/client/auth.ts :972
const { spawn } = await import('child_process') - shell (weak) PrefectHQ-fastmcp-ts-a969c55/tests/cli.test.ts :166
const subprocess = execa('node', [HTTP_SERVER], { - shell (weak) PrefectHQ-fastmcp-ts-a969c55/tests/conformance/run-client.mjs :30
import { spawn } from 'node:child_process' - shell (weak) PrefectHQ-fastmcp-ts-a969c55/tests/conformance/run-server.mjs :23
import { spawn } from 'node:child_process' - shell (weak) PrefectHQ-fastmcp-ts-a969c55/tests/helpers/cli-setup.ts :6
await execa('npm', ['run', 'build'], { stdio: 'inherit' }) - shell (weak) PrefectHQ-fastmcp-ts-a969c55/tests/helpers/cli.ts :28
const result = await execa('node', [bin, ...args], {
network 32
- net PrefectHQ-fastmcp-ts-a969c55/src/client/auth.ts :720
const response = await fetch(this._tokenEndpoint, { - net PrefectHQ-fastmcp-ts-a969c55/src/client/transports.ts :198
return fetch(url, { - net PrefectHQ-fastmcp-ts-a969c55/src/server/FastMCP.ts :19
import type { Server as HttpServer, IncomingMessage, ServerResponse } from 'node:http' - net PrefectHQ-fastmcp-ts-a969c55/src/server/auth/oauth/proxy.ts :81
const response = await fetch(options.endpoints.tokenUrl, { - net PrefectHQ-fastmcp-ts-a969c55/src/server/auth/verifiers/introspection.ts :32
const response = await fetch(options.endpoint, { - net PrefectHQ-fastmcp-ts-a969c55/src/server/customRoutes.ts :1
import type { IncomingMessage, ServerResponse } from 'node:http' - net PrefectHQ-fastmcp-ts-a969c55/src/server/httpContext.ts :1
import type { IncomingMessage } from 'node:http' - net PrefectHQ-fastmcp-ts-a969c55/src/server/openapi/execute.ts :135
response = await client.fetch(url, init) - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/browser/oauth-e2e.spec.ts :114
const resp = await route.fetch({ maxRedirects: 0 }) - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/client/auth.test.ts :394
const res = await fetch(`http://localhost:${port}/callback?code=auth-code-123&state=xyz`) - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/client/capabilities.test.ts :1
import { createServer } from 'node:http' - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/client/client.test.ts :8
import { createServer } from 'node:http' - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/client/subscriptions.test.ts :4
import { createServer } from 'node:http' - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/conformance/everything-client.ts :145
const prm = (await fetch(prmUrl.toString()).then((r) => (r.ok ? r.json() : null))) as { - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/fixtures/http-server.mjs :3
import { createServer } from 'node:http' - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/helpers/http.ts :56
return fetch(url, { - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/interop/interop.test.ts :3
import { createServer, type Server as NodeHttpServer } from 'node:http' - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/server/auth.test.ts :2
import { createServer } from 'node:http' - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/server/custom-routes.test.ts :3
import { createServer } from 'node:http' - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/server/dns-rebinding.test.ts :2
import http from 'node:http' - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/server/fetch.test.ts :145
const initialized = await server.fetch(legacyRequest(INITIALIZE)) - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/server/health-endpoint.test.ts :23
expect((await fetch(`http://127.0.0.1:${port}/healthz`)).status).toBe(404) - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/server/http-context.test.ts :2
import type { IncomingMessage } from 'node:http' - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/server/legacy-http-push-routing.test.ts :2
import http from 'node:http' - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/server/middleware.test.ts :295
const res1 = await fetch(url, { - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/server/mrtr.test.ts :72
const res1 = await fetch(url, { - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/server/openapi/eras-cli.test.ts :1
import { createServer } from 'node:http' - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/server/openapi/runtime.test.ts :1
import { createServer } from 'node:http' - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/server/server.test.ts :309
const res = await fetch(`http://127.0.0.1:${port}/mcp`, { - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/server/sse-polling.test.ts :2
import http from 'node:http' - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/server/stateless-http.test.ts :76
return fetch(url, { - net (weak) PrefectHQ-fastmcp-ts-a969c55/tests/wire/golden.test.ts :103
const res = await fetch(url, {
secrets 1
- secrets PrefectHQ-fastmcp-ts-a969c55/src/server/FastMCP.ts :387
const raw = process.env['FASTMCP_CLI_AUTH_TOKEN']
install hooks 1
- prepublishOnly PrefectHQ-fastmcp-ts-a969c55/package.json :53
npm run build && node scripts/test-dist.mjs && npm run test:browser-bundle
declared dependencies 40
- @modelcontextprotocol/client@^2.0.0
- @modelcontextprotocol/core@^2.0.0
- @modelcontextprotocol/node@^2.0.0
- @modelcontextprotocol/server@^2.0.0
- @modelcontextprotocol/server-legacy@^2.0.0
- @clack/prompts@^1.2.0
- @standard-schema/spec@^1.1.0
- @types/express@^5.0.6
- chalk@^5.6.2
- chokidar@^5.0.0
- citty@^0.2.2
- cli-table3@^0.6.5
- express@^5.2.1
- fastest-levenshtein@^1.0.16
- jose@6.2.2
- listr2@^10.2.1
- url-template@^3.1.1
- yaml@^2.8.3
- @anthropic-ai/sdk@^0.91.1
- @changesets/cli@^3.0.0
- @google/genai@^1.50.1
- @playwright/test@^1.61.1
- @types/node@^22.0.0
- @types/url-template@^2.0.31
- @vitest/coverage-v8@^4.1.8
- arktype@^2.2.0
- esbuild@^0.28.1
- execa@^9.6.1
- fake-indexeddb@^6.2.5
- get-bin-path@^11.0.1
- jsdom@^29.1.1
- openai@^6.34.0
- tsup@^8.5.1
- tsx@^4.21.0
- typedoc@^0.28.0
- typedoc-plugin-markdown@^4.12.0
- typescript@^5.0.0
- valibot@^1.3.1
- vitest@^4.1.8
- zod@^4.3.6
obfuscation 1
- dynamic require()/import() PrefectHQ-fastmcp-ts-a969c55/scripts/test-dist.mjs :59
const backendScript = `const { FastMCP } = await import(${JSON.stringify(new URL('../dist/server.js', import.meta.url).href)})
perm:untrusted 1
- untrusted (weak) PrefectHQ-fastmcp-ts-a969c55/tests/conformance/everything-client.ts :145
const prm = (await fetch(prmUrl.toString()).then((r) => (r.ok ? r.json() : null))) as {
transport_posture 1
- network-listening, binds all interfaces, no auth detected PrefectHQ-fastmcp-ts-a969c55/tests/server/dns-rebinding.test.ts :175
await mcp.run({ transport: 'http', port: 0, host: '0.0.0.0' })