TypeScript-first framework for the Model Context Protocol (MCP). You write clean, typed code; FrontMCP handles the protocol, transport, DI, session/auth, and execution flow.
E critical
- vulnerabilities attested + 9
- capability exposure inferred + 35
- recent drift inferred + 20
- inherited (deps) attested + 15
- tool safety inferred + 12
- remediation lag attested + 3
- trust mitigators mixed − 14
attested inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
graded 9m ago · see ecosystem CVEs →
- D · 72 → E · 80
- D · 62 → D · 72
- C · 45 → D · 62
- C · 57 → C · 45
- C · 46 → C · 57
- C · 57 → C · 46
- C · 58 → C · 57
- C · 52 → C · 58
Inferred surface — each links to servers holding it:
HIGH
mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications
EPSS 0%
inherited (deps) · grade factor +15
HIGH
mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications
HIGH
mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications
HIGH
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
HIGH
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
HIGH
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
- high dangerous code
dynamic exec: new Function(), eval(), constructor escape, setTimeout(string) · obfuscated payload: dynamic require()/import()
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed v1.5.2 · analyzer v28 · 2d ago
skills & prompt files 24
- agent-rules agentfront-frontmcp-8cbeff6/AGENTS.md
- agent-rules agentfront-frontmcp-8cbeff6/CLAUDE.md
- skill agentfront-frontmcp-8cbeff6/apps/e2e/demo-e2e-skills/src/apps/skills/skills/docs-skill/SKILL.md
- agent-rules agentfront-frontmcp-8cbeff6/docs/frontmcp/nx-plugin/generators/agent.mdx
- skill agentfront-frontmcp-8cbeff6/docs/frontmcp/nx-plugin/generators/skill.mdx
- agent-rules agentfront-frontmcp-8cbeff6/docs/frontmcp/sdk-reference/decorators/agent.mdx
- skill agentfront-frontmcp-8cbeff6/docs/frontmcp/sdk-reference/decorators/skill.mdx
- agent-rules agentfront-frontmcp-8cbeff6/docs/frontmcp/servers/agents.mdx
- agent-rules agentfront-frontmcp-8cbeff6/libs/plugins/CLAUDE.md
- skill agentfront-frontmcp-8cbeff6/libs/skills/catalog/create-tool/SKILL.md
- skill agentfront-frontmcp-8cbeff6/libs/skills/catalog/frontmcp-auth-ui/SKILL.md
- skill agentfront-frontmcp-8cbeff6/libs/skills/catalog/frontmcp-authorities/SKILL.md
- skill agentfront-frontmcp-8cbeff6/libs/skills/catalog/frontmcp-channels/SKILL.md
- skill agentfront-frontmcp-8cbeff6/libs/skills/catalog/frontmcp-config/SKILL.md
- skill agentfront-frontmcp-8cbeff6/libs/skills/catalog/frontmcp-deployment/SKILL.md
- skill agentfront-frontmcp-8cbeff6/libs/skills/catalog/frontmcp-development/SKILL.md
- skill agentfront-frontmcp-8cbeff6/libs/skills/catalog/frontmcp-extensibility/SKILL.md
- skill agentfront-frontmcp-8cbeff6/libs/skills/catalog/frontmcp-guides/SKILL.md
- skill agentfront-frontmcp-8cbeff6/libs/skills/catalog/frontmcp-observability/SKILL.md
- skill agentfront-frontmcp-8cbeff6/libs/skills/catalog/frontmcp-production-readiness/SKILL.md
- skill agentfront-frontmcp-8cbeff6/libs/skills/catalog/frontmcp-setup/SKILL.md
- skill agentfront-frontmcp-8cbeff6/libs/skills/catalog/frontmcp-testing/SKILL.md
- agent-rules agentfront-frontmcp-8cbeff6/libs/ui/CLAUDE.md
- agent-rules agentfront-frontmcp-8cbeff6/libs/uipack/CLAUDE.md
danger signals19
- dynamic code execution new Function() agentfront-frontmcp-8cbeff6/libs/cli/src/commands/build/exec/__tests__/credential-store.spec.ts :55
new Function(source); - dynamic code execution new Function() agentfront-frontmcp-8cbeff6/libs/cli/src/commands/build/exec/__tests__/daemon-client.spec.ts :169
new Function(source); - dynamic code execution new Function() agentfront-frontmcp-8cbeff6/libs/cli/src/commands/build/exec/__tests__/generated-cli-smoke.spec.ts :48
expect(() => new Function(stripShebang(source))).not.toThrow(); - dynamic code execution new Function() agentfront-frontmcp-8cbeff6/libs/cli/src/commands/build/exec/__tests__/oauth-helper.spec.ts :24
new Function(source); - dynamic code execution new Function() agentfront-frontmcp-8cbeff6/libs/cli/src/commands/build/exec/__tests__/output-formatter.spec.ts :310
new Function(source); - dynamic code execution new Function() agentfront-frontmcp-8cbeff6/libs/cli/src/commands/build/exec/__tests__/session-manager.spec.ts :54
new Function(source); - dynamic code execution new Function() agentfront-frontmcp-8cbeff6/libs/cli/src/commands/build/exec/cli-runtime/__tests__/extract-public-message-parity.spec.ts :25
const factory = new Function( - dynamic code execution new Function() agentfront-frontmcp-8cbeff6/libs/sdk/src/esm-loader/esm-module-loader.ts :265
const fn = new Function('module', 'exports', bundleContent); - dynamic code execution eval() agentfront-frontmcp-8cbeff6/libs/sdk/src/ha/session-takeover.ts :15
eval(script: string, numkeys: number, ...args: (string | number)[]): Promise<unknown>; - dynamic code execution eval() agentfront-frontmcp-8cbeff6/libs/sdk/src/transport/bus/redis-transport-bus.ts :23
eval(script: string, numkeys: number, ...args: (string | number)[]): Promise<unknown>; - dynamic code execution new Function() agentfront-frontmcp-8cbeff6/libs/ui/src/renderer/react/index.ts :187
const factory = new Function(...argNames, code) as (...args: unknown[]) => React.ComponentType; - dynamic code execution eval() agentfront-frontmcp-8cbeff6/plugins/plugin-codecall/src/__tests__/enclave.service.spec.ts :388
eval('return 42'); - dynamic code execution new Function() agentfront-frontmcp-8cbeff6/plugins/plugin-codecall/src/__tests__/enclave.service.spec.ts :400
const fn = new Function('return 42'); - dynamic code execution constructor escape agentfront-frontmcp-8cbeff6/plugins/plugin-codecall/src/__tests__/enclave.service.spec.ts :1081
const fn = [].constructor.constructor('return process'); - dynamic code execution setTimeout(string) agentfront-frontmcp-8cbeff6/plugins/plugin-codecall/src/__tests__/enclave.service.spec.ts :1209
setTimeout('return process', 0); - suspicious endpoint 1.2.3.4 agentfront-frontmcp-8cbeff6/libs/sdk/src/auth/flows/__tests__/oauth.register.flow.spec.ts :96
'http://1.2.3.4.evil.com/cb', - suspicious endpoint 8.8.8.8 agentfront-frontmcp-8cbeff6/libs/sdk/src/auth/flows/__tests__/oauth.register.flow.spec.ts :99
'https://8.8.8.8/cb', - suspicious endpoint 169.254.169.254 (cloud metadata) agentfront-frontmcp-8cbeff6/plugins/plugin-skilled-openapi/src/__tests__/ssrf-guard.spec.ts :137
'https://169.254.169.254/latest/meta-data/', - suspicious endpoint 8.8.8.8 agentfront-frontmcp-8cbeff6/plugins/plugin-skilled-openapi/src/__tests__/ssrf-guard.spec.ts :187
const r = await checkOutboundUrl('https://8.8.8.8/x', new Set(['8.8.8.8']), baseOutbound());
- recent drift +20 capability drift →
[](https://mcpobservatory.com/servers/npm:@frontmcp/adapters/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of agentfront.