npm JavaScript analyzed 2.0.0

@modelcontextprotocol/server

v2.0.0

npm

Model Context Protocol implementation for TypeScript - Server package

Drift inferred · capture-to-capture

HIGH 2026-07-27 code analysis flagged dynamic code execution ×2 in @modelcontextprotocol/server
HIGH 2026-07-13 code analysis flagged dynamic code execution ×2 in @modelcontextprotocol/server
HIGH 2026-07-09 code analysis flagged dynamic code execution ×2 in @modelcontextprotocol/server
HIGH 2026-07-02 code analysis flagged dynamic code execution in @modelcontextprotocol/server
HIGH 2026-06-30 code analysis flagged dynamic code execution in @modelcontextprotocol/server
HIGH 2026-06-25 code analysis flagged dynamic code execution in @modelcontextprotocol/server
HIGH 2026-06-09 code analysis flagged dynamic code execution in @modelcontextprotocol/server

capabilities 2 tools

transport stdio · streamable-http counts 2 tools · 0 res · 0 prompts permission surface via code analysis

skills & danger signals npm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v2.0.0 · analyzer v28 · 3d ago

dynamic code execution new Function() package/dist/ajvProvider-CEoC__sr.mjs :2594 const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get());
dynamic code execution new Function() package/dist/ajvProvider-ZaoO9afR.cjs :2594 const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get());

code evidence v2.0.0 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 26

net package/dist/index.cjs :298 * async fetch(request: Request): Promise<Response> {
net package/dist/index.mjs :296 * async fetch(request: Request): Promise<Response> {