Model Context Protocol (MCP) server for FreshRSS, the self-hosted RSS feed aggregator
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · http
verified
reported
listed in the official MCP registry counts 16 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
delete_category_or_label
-
export_opml
-
get_articles
-
get_unread_counts
-
get_user_info
-
import_opml
-
list_article_ids
-
list_articles
-
list_categories
-
list_feeds
-
mark_all_as_read
-
mark_articles
-
rename_category_or_label
-
subscribe_feed
-
unsubscribe_feed
-
update_feed
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit e4017c1 · analyzer v33 · 1d ago
danger signals3
- suspicious endpoint 169.254.169.254 (cloud metadata) ni-c-freshrss-mcp-e4017c1/test/hardening.test.ts :320
'http://169.254.169.254/latest/meta-data/', - suspicious endpoint 169.254.169.254 (cloud metadata) ni-c-freshrss-mcp-e4017c1/test/integration/tools.integration.test.ts :272
'<outline text="f" xmlUrl="http://169.254.169.254/latest/meta-data/"/>' + - suspicious endpoint 93.184.216.34 ni-c-freshrss-mcp-e4017c1/test/server.test.ts :848
opml: '<opml><body><outline xmlUrl="https://93.184.216.34/rss"/></body></opml>',
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 40
filesystem 4
- fs (weak) ni-c-freshrss-mcp-e4017c1/docs/.vitepress/config.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) ni-c-freshrss-mcp-e4017c1/test/docs.test.ts :1
import { readFileSync } from 'node:fs'; - fs (weak) ni-c-freshrss-mcp-e4017c1/test/review-2.test.ts :6
import { readFileSync } from 'node:fs'; - fs (weak) ni-c-freshrss-mcp-e4017c1/test/server.test.ts :1
import { readFileSync } from 'node:fs';
network 2
- net ni-c-freshrss-mcp-e4017c1/src/api.ts :5
} from 'undici'; - net (weak) ni-c-freshrss-mcp-e4017c1/test/integration/bootstrap.ts :54
const response = await fetch(
tool registrations 16
- list_articles ni-c-freshrss-mcp-e4017c1/src/tools/articles.ts :198
- get_articles ni-c-freshrss-mcp-e4017c1/src/tools/articles.ts :273
- list_article_ids ni-c-freshrss-mcp-e4017c1/src/tools/articles.ts :339
- mark_articles ni-c-freshrss-mcp-e4017c1/src/tools/articles.ts :397
- mark_all_as_read ni-c-freshrss-mcp-e4017c1/src/tools/articles.ts :540
- get_user_info ni-c-freshrss-mcp-e4017c1/src/tools/feeds.ts :93
- list_feeds ni-c-freshrss-mcp-e4017c1/src/tools/feeds.ts :125
- get_unread_counts ni-c-freshrss-mcp-e4017c1/src/tools/feeds.ts :165
- subscribe_feed ni-c-freshrss-mcp-e4017c1/src/tools/feeds.ts :240
- update_feed ni-c-freshrss-mcp-e4017c1/src/tools/feeds.ts :321
- unsubscribe_feed ni-c-freshrss-mcp-e4017c1/src/tools/feeds.ts :367
- export_opml ni-c-freshrss-mcp-e4017c1/src/tools/opml.ts :40
show 4 more
- import_opml ni-c-freshrss-mcp-e4017c1/src/tools/opml.ts :471
- list_categories ni-c-freshrss-mcp-e4017c1/src/tools/tags.ts :31
- rename_category_or_label ni-c-freshrss-mcp-e4017c1/src/tools/tags.ts :92
- delete_category_or_label ni-c-freshrss-mcp-e4017c1/src/tools/tags.ts :142
install hooks 1
- prepublishOnly ni-c-freshrss-mcp-e4017c1/package.json :50
npm run lint && npm run typecheck && npm test && npm run build
declared dependencies 16
- @modelcontextprotocol/server@^2.0.0
- @modelcontextprotocol/client@^2.0.0
- mcp-approval@^0.8.2
- mcp-internal-hosts@^0.2.1
- mcp-tool-allowlist@^0.2.1
- undici@^8.10.0
- zod@^4.4.3
- @types/node@^26.2.0
- @vitest/coverage-v8@5.0.0
- fast-check@^4.9.0
- mcp-integration-harness@^0.4.0
- oxlint@^1.80.0
show 4 more
- prettier@^3.9.6
- svg-asset-set@https://github.com/ni-c/svg-asset-set/releases/download/v0.3.0/svg-asset-set-0.3.0.tgz
- typescript@^7.0.2
- vitest@^5.0.0