npm JavaScript analyzed 1.24.3-mcp-use.4

@mcp-use/modelcontextprotocol-sdk

v1.24.3-mcp-use.4

npm

Model Context Protocol implementation for TypeScript

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 1 tools

transport stdio · streamable-http · sse counts 1 tools · 0 res · 0 prompts permission surface via README inference

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v1.24.3-mcp-use.4 · analyzer v33 · 4w ago

credential in logs credential in log package/dist/cjs/examples/server/elicitationUrlExample.js :325 console.log(`🔑 Received API key \x1b[32m${apiKey}\x1b[0m for session ${sessionId}`);
credential in logs credential in log package/dist/esm/examples/server/elicitationUrlExample.js :320 console.log(`🔑 Received API key \x1b[32m${apiKey}\x1b[0m for session ${sessionId}`);

code evidence v1.24.3-mcp-use.4 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 340

shell (weak) package/dist/cjs/examples/client/elicitationUrlExample.js :14 const node_child_process_1 = require("node:child_process");
shell (weak) package/dist/cjs/examples/client/simpleOAuthClient.js :7 const node_child_process_1 = require("node:child_process");
shell package/dist/esm/client/stdio.js :66 this._process = spawn(this._serverParams.command, (_a = this._serverParams.args) !== null && _a !== void 0 ? _a : [], {
shell (weak) package/dist/esm/examples/client/elicitationUrlExample.js :12 import { exec } from 'node:child_process';
shell (weak) package/dist/esm/examples/client/simpleOAuthClient.js :5 import { exec } from 'node:child_process';

net (weak) package/dist/cjs/examples/client/elicitationUrlExample.js :17 const node_http_1 = require("node:http");
net (weak) package/dist/cjs/examples/client/simpleOAuthClient.js :4 const node_http_1 = require("node:http");
net (weak) package/dist/cjs/examples/server/elicitationUrlExample.js :185 const response = await fetch(endpoint, {
net (weak) package/dist/cjs/examples/server/simpleStreamableHttp.js :424 const response = await fetch(endpoint, {
net (weak) package/dist/esm/examples/client/elicitationUrlExample.js :15 import { createServer } from 'node:http';
net (weak) package/dist/esm/examples/client/simpleOAuthClient.js :2 import { createServer } from 'node:http';
net (weak) package/dist/esm/examples/server/elicitationUrlExample.js :180 const response = await fetch(endpoint, {
net (weak) package/dist/esm/examples/server/simpleStreamableHttp.js :419 const response = await fetch(endpoint, {

secrets (weak) package/dist/cjs/examples/client/simpleClientCredentials.js :43 const clientSecret = process.env.MCP_CLIENT_SECRET;
secrets (weak) package/dist/esm/examples/client/simpleClientCredentials.js :41 const clientSecret = process.env.MCP_CLIENT_SECRET;

show 27 more