MCP Observatory
github analyzed e84ff7e

samanhappy/mcphub

github

A unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies.

maintainer
samanhappy
license
Apache-2.0
first seen
2026-06-01
last seen
2026-06-15
releases · 30d
16
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged hidden prompt content in samanhappy/mcphub
  2. HIGH code analysis flagged hidden prompt content in samanhappy/mcphub
capabilities0 tools
transport stdio · streamable-http · http · sse counts 0 tools · 0 res · 0 prompts permission surface via code analysis

no tools enumerated yet for this server.

skills & danger signalsgithub-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit e84ff7e · analyzer v17 · 2d ago

skills & prompt files 1

danger signals1

code evidencevv1.0.14 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

filesystem 18

  • fs samanhappy-mcphub-e84ff7e/bin/cli.js :5 import fs from 'fs';
  • fs samanhappy-mcphub-e84ff7e/frontend/vite.config.ts :6 import { readFileSync } from 'fs';
  • fs samanhappy-mcphub-e84ff7e/scripts/validate-release-notes.js :1 import fs from 'fs';
  • fs samanhappy-mcphub-e84ff7e/scripts/verify-dist.js :2 import fs from 'fs';
  • fs samanhappy-mcphub-e84ff7e/src/cli/call-arguments.ts :1 import fs from 'node:fs';
  • fs samanhappy-mcphub-e84ff7e/src/cli/commands/export.ts :1 import fs from 'node:fs';
  • fs samanhappy-mcphub-e84ff7e/src/cli/commands/install.ts :1 import fs from 'node:fs';
  • fs samanhappy-mcphub-e84ff7e/src/cli/commands/servers.ts :1 import fs from 'node:fs';
  • fs samanhappy-mcphub-e84ff7e/src/cli/profile.ts :1 import fs from 'node:fs';
  • fs samanhappy-mcphub-e84ff7e/src/config/index.ts :2 import fs from 'fs';
  • fs samanhappy-mcphub-e84ff7e/src/controllers/mcpbController.ts :4 import fs from 'fs';
  • fs samanhappy-mcphub-e84ff7e/src/dao/base/JsonFileBaseDao.ts :1 import fs from 'fs';
  • fs samanhappy-mcphub-e84ff7e/src/server.ts :5 import fs from 'fs';
  • fs samanhappy-mcphub-e84ff7e/src/services/marketService.ts :1 import fs from 'fs';
  • fs samanhappy-mcphub-e84ff7e/src/services/mcpService.ts :3 import fs from 'fs';
  • fs samanhappy-mcphub-e84ff7e/src/utils/path.ts :1 import fs from 'fs';
  • fs samanhappy-mcphub-e84ff7e/src/utils/proxyTrust.ts :1 import fs from 'fs';
  • fs samanhappy-mcphub-e84ff7e/src/utils/version.ts :1 import fs from 'fs';

network 14

  • net samanhappy-mcphub-e84ff7e/frontend/src/services/betterAuthClient.ts :41 const response = await fetch(`${resolveBaseUrl(basePathOverride)}/sign-in/oauth2`, {
  • net samanhappy-mcphub-e84ff7e/frontend/src/utils/fetchInterceptor.ts :87 let response = await fetch(url, config);
  • net samanhappy-mcphub-e84ff7e/frontend/src/utils/runtime.ts :70 const response = await fetch(configPath, {
  • net samanhappy-mcphub-e84ff7e/src/clients/openapi.ts :1 import axios, { AxiosInstance, AxiosRequestConfig } from 'axios';
  • net samanhappy-mcphub-e84ff7e/src/controllers/registryController.ts :30 const response = await fetch(url.toString(), {
  • net samanhappy-mcphub-e84ff7e/src/server.ts :24 import http from 'http';
  • net samanhappy-mcphub-e84ff7e/src/services/changelogService.ts :78 const response = await fetch(url, {
  • net samanhappy-mcphub-e84ff7e/src/services/cloudService.ts :1 import axios, { AxiosRequestConfig } from 'axios';
  • net samanhappy-mcphub-e84ff7e/src/services/hostedControlPlaneClient.ts :156 const response = await fetch(`${controlPlaneBaseUrl()}${path}`, {
  • net samanhappy-mcphub-e84ff7e/src/services/oauthClientRegistration.ts :76 const response = await fetch(resourceMetadataUrl, {
  • net samanhappy-mcphub-e84ff7e/src/services/oauthService.ts :46 const response = await fetch(oauthConfig.verifyAccessToken.endpoint, {
  • net samanhappy-mcphub-e84ff7e/src/services/vectorSearchService.ts :18 import axios from 'axios';
  • net samanhappy-mcphub-e84ff7e/src/utils/bearerAuth.ts :1 import { IncomingHttpHeaders } from 'node:http';
  • net samanhappy-mcphub-e84ff7e/src/utils/tokenTruncation.ts :178 const response = await fetch(url, {

secrets 8

  • secrets samanhappy-mcphub-e84ff7e/src/betterAuth.ts :31 process.env.GOOGLE_CLIENT_SECRET
  • secrets samanhappy-mcphub-e84ff7e/src/cli/context.ts :45 (process.env.MCPHUB_TOKEN_KIND as TokenKind | undefined) ??
  • secrets samanhappy-mcphub-e84ff7e/src/config/jwt.ts :3 let jwtSecret = process.env.JWT_SECRET;
  • secrets samanhappy-mcphub-e84ff7e/src/models/User.ts :132 const adminPasswordFromEnv = process.env.ADMIN_PASSWORD;
  • secrets samanhappy-mcphub-e84ff7e/src/services/betterAuthConfig.ts :246 process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET,
  • secrets samanhappy-mcphub-e84ff7e/src/services/cloudService.ts :21 apiKey: mcpRouterConfig?.apiKey || process.env.MCPROUTER_API_KEY || '',
  • secrets samanhappy-mcphub-e84ff7e/src/services/hostedInternalAuth.ts :67 const secret = process.env.INTERNAL_API_SECRET;
  • secrets samanhappy-mcphub-e84ff7e/src/utils/smartRouting.ts :134 [process.env.OPENAI_API_KEY],

database 2

  • db samanhappy-mcphub-e84ff7e/src/betterAuth.ts :4 import { Pool } from 'pg';
  • db samanhappy-mcphub-e84ff7e/src/services/hostedEventSubscriber.ts :1 import { createClient } from 'redis';

declared dependencies 91

  • @apidevtools/swagger-parser@^12.0.0
  • @google/genai@^1.44.0
  • @huggingface/tokenizers@^0.1.3
  • @modelcontextprotocol/sdk@^1.29.0
  • @node-oauth/oauth2-server@^5.2.1
  • @types/adm-zip@^0.5.7
  • @types/bcrypt@^6.0.0
  • @types/multer@^2.0.0
  • @types/pg@^8.15.5
  • adm-zip@^0.5.16
  • axios@^1.12.2
  • bcrypt@^6.0.0
  • bcryptjs@^3.0.2
  • better-auth@^1.4.14
  • better-sqlite3@^12.6.2
  • cors@^2.8.5
  • dotenv@^17.2.3
  • dotenv-expand@^12.0.2
  • express@^4.21.2
  • express-rate-limit@^8.3.0
  • express-validator@^7.3.1
  • gpt-tokenizer@^3.4.0
  • hono@4.12.21
  • i18next@^25.5.0
  • i18next-fs-backend@^2.6.0
  • ipaddr.js@^2.4.0
  • jsonwebtoken@^9.0.2
  • kysely@^0.28.9
  • multer@^2.0.2
  • openai@^6.7.0
  • openapi-types@^12.1.3
  • openid-client@^6.8.1
  • pg@^8.16.3
  • pgvector@^0.2.1
  • postgres@^3.4.7
  • redis@^5.12.1
  • reflect-metadata@^0.2.2
  • typeorm@^0.3.26
  • undici@^7.16.0
  • uuid@^14.0.0
  • @eslint/eslintrc@^3.3.3
  • @eslint/js@^9.39.2
  • @radix-ui/react-accordion@^1.2.12
  • @radix-ui/react-slot@^1.2.3
  • @shadcn/ui@^0.0.4
  • @swc/core@^1.13.5
  • @swc/jest@^0.2.39
  • @tailwindcss/line-clamp@^0.4.4
  • @tailwindcss/postcss@^4.1.12
  • @tailwindcss/vite@^4.1.12
  • @types/bcryptjs@^3.0.0
  • @types/better-sqlite3@^7.6.7
  • @types/cors@^2.8.19
  • @types/express@^4.17.23
  • @types/jest@^30.0.0
  • @types/jsonwebtoken@^9.0.10
  • @types/node@^24.6.2
  • @types/react@^19.1.11
  • @types/react-dom@^19.1.7
  • @types/supertest@^6.0.3
  • @types/uuid@^11.0.0
  • @typescript-eslint/eslint-plugin@^8.0.0
  • @typescript-eslint/parser@^8.0.0
  • @vitejs/plugin-react@^5.1.3
  • autoprefixer@^10.4.21
  • class-variance-authority@^0.7.1
  • clsx@^2.1.1
  • concurrently@^9.2.0
  • eslint@^9.39.2
  • globals@^13.24.0
  • i18next-browser-languagedetector@^8.2.0
  • jest@^30.2.0
  • jest-environment-node@^30.0.5
  • jest-mock-extended@4.0.0
  • lucide-react@^0.552.0
  • postcss@^8.5.6
  • prettier@^3.6.2
  • react@19.2.7
  • react-dom@19.2.7
  • react-i18next@^16.2.4
  • react-router-dom@^7.12.0
  • supertest@^7.1.4
  • tailwind-merge@^3.3.1
  • tailwind-scrollbar-hide@^4.0.0
  • tailwindcss@^4.1.12
  • ts-jest@^29.4.1
  • ts-node-dev@^2.0.0
  • tsx@^4.20.5
  • typescript@^5.9.2
  • vite@^6.3.5
  • zod@^3.25.76