MCP server for querying CKAN open data portals (package search, DataStore SQL, organizations, groups, tags)
Drift inferred · capture-to-capture
- HIGH code analysis flagged dynamic code execution in ondata/ckan-mcp-server
- HIGH code analysis flagged dynamic code execution in ondata/ckan-mcp-server
- HIGH code analysis flagged dynamic code execution in ondata/ckan-mcp-server
- HIGH code analysis flagged dynamic code execution in ondata/ckan-mcp-server
transport stdio · streamable-http · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit fd03d6c · analyzer v28 · 4d ago
skills & prompt files 5
- skill ondata-ckan-mcp-server-fd03d6c/.claude/skills/data-exploration/SKILL.md
- agent-rules ondata-ckan-mcp-server-fd03d6c/AGENTS.md
- agent-rules ondata-ckan-mcp-server-fd03d6c/CLAUDE.md
- agent-rules ondata-ckan-mcp-server-fd03d6c/openspec/AGENTS.md
- skill ondata-ckan-mcp-server-fd03d6c/skills/ckan-mcp/SKILL.md
danger signals3
- dynamic code execution concat require() ondata-ckan-mcp-server-fd03d6c/src/utils/http.ts :93
const mod = (await import("node:" + "zlib")) as ZlibModule; - suspicious endpoint 169.254.169.254 (cloud metadata) ondata-ckan-mcp-server-fd03d6c/tests/integration/sparql.test.ts :74
querySparqlEndpoint('https://169.254.169.254/sparql', 'SELECT * WHERE { }') - suspicious endpoint 169.254.169.254 (cloud metadata) ondata-ckan-mcp-server-fd03d6c/tests/unit/http.test.ts :40
expect(() => validateServerUrl('http://169.254.169.254/latest/meta-data/')).toThrow('private/internal');
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 78
network 4
- net ondata-ckan-mcp-server-fd03d6c/src/tools/portal-discovery.ts :6
import axios from "axios"; - net ondata-ckan-mcp-server-fd03d6c/src/tools/quality.ts :6
import axios from "axios"; - net ondata-ckan-mcp-server-fd03d6c/src/utils/http.ts :5
import axios, { AxiosError } from "axios"; - net ondata-ckan-mcp-server-fd03d6c/src/worker.ts :20
async fetch(request: Request, env: Env): Promise<Response> {
install hooks 1
- prepack ondata-ckan-mcp-server-fd03d6c/package.json :26
cp README.md .readme-full.md && cp .readme-npm.md README.md
declared dependencies 14
- @modelcontextprotocol/ext-apps@^1.0.1
- @modelcontextprotocol/sdk@^1.27.1
- axios@^1.7.2
- express@^4.19.2
- zod@^3.23.8
- @types/express@^4.17.21
- @types/node@^20.12.12
- @types/react@^19.2.9
- @types/react-dom@^19.2.3
- @vitest/coverage-v8@^4.0.16
- esbuild@^0.27.2
- typescript@^5.4.5
- vitest@^4.0.16
- wrangler@^4.58.0
obfuscation 1
- dynamic require()/import() ondata-ckan-mcp-server-fd03d6c/src/utils/http.ts :93
const mod = (await import("node:" + "zlib")) as ZlibModule;