MCP Observatory
npm analyzed 1.1.72

@msfeldstein/mcp-test-servers

v1.1.72
npm

A collection of MCP test servers including working servers (ping, resource, combined, env-echo) and test failure cases (broken-tool, crash-on-startup)

maintainer
msfeldstein
license
ISC
first seen
2026-06-10
last seen
2026-06-17
releases · 30d
0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio · streamable-http · http · sse counts 0 tools · 0 res · 0 prompts permission surface via code analysis

no tools enumerated yet for this server.

skills & danger signals npm-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v1.1.72 · analyzer v18 · 10h ago

skills & prompt files 2

danger signals1

code evidence v1.1.72 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

filesystem 4

  • fs package/scripts/add-server.js :3 import { readFileSync, writeFileSync } from 'fs';
  • fs package/scripts/oauth-debug-setup.js :4 import { readFileSync } from 'fs';
  • fs package/src/cli.js :3 import { readFileSync } from 'fs';
  • fs package/src/file-ops-server.js :5 import fs from 'fs/promises';

shell / exec 2

  • shell package/scripts/oauth-debug-setup.js :3 import { spawn } from 'child_process';
  • shell package/src/shell-exec-server.js :5 import { exec, spawn } from 'child_process';

network 1

  • net package/src/oauth-repro-server.js :417 const response = await fetch(`${AUTH_SERVER_URL}/oauth/userinfo`, {

secrets 2

  • secrets package/src/long-description-server.js :7 const descriptionTokens = process.env.DESCRIPTION_TOKENS;
  • secrets package/src/oauth-token-refresh-server.js :14 const ACCESS_TOKEN_EXPIRY_SECONDS = parseInt(process.env.ACCESS_TOKEN_EXPIRY_SECONDS || "30", 10);

tool registrations 65

  • get-headers package/src/auth-headers-server.js :31
  • ping package/src/auth-headers-server.js :45
  • generate_big_response package/src/big-response-server.js :51
  • crash package/src/broken-tool-server.js :18
  • ping package/src/combined-server.js :47
  • fizzbuzz package/src/combined-server.js :63
  • analyze_text package/src/dual-content-server.js :104
  • format_data package/src/dual-content-server.js :151
  • optionalTool package/src/dynamic-tools-server.js :28
  • toggleTool package/src/dynamic-tools-server.js :42
  • status package/src/env-check-server.js :23
  • env_echo package/src/env-echo-server.js :18
  • echo_with_params package/src/everything-server.js :27
  • simple_ping package/src/everything-server.js :48
  • get_mixed_resources package/src/everything-server.js :58
  • test_all_elicitations package/src/everything-server.js :79
  • dynamic_feature package/src/everything-server.js :199
  • toggle_dynamic_tool package/src/everything-server.js :214
  • echo_mcp_roots package/src/everything-server.js :237
  • echo_env_var package/src/everything-server.js :257
  • long_running_progress package/src/everything-server.js :268
  • execute-sql package/src/gpt5-breaker-server.js :42
  • ping package/src/http-ping-server-improved.js :34
  • ping package/src/http-ping-server.js :31
  • generate_image package/src/image-server.js :15
  • makeRequest package/src/instructions-server.js :36
  • test-simple-integer package/src/integer-anyof-bug-server.js :69
  • test-anyof-integer package/src/integer-anyof-bug-server.js :81
  • test-both-params package/src/integer-anyof-bug-server.js :93
  • get-info package/src/long-description-server.js :41
  • tool_${i} package/src/many-tools-server.js :34
  • add package/src/math-server.js :110
  • subtract package/src/math-server.js :124
  • multiply package/src/math-server.js :138
  • divide package/src/math-server.js :152
  • power package/src/math-server.js :174
  • sqrt package/src/math-server.js :188
  • factorial package/src/math-server.js :215
  • missing-type-tool package/src/missing-type-server.js :51
  • another-missing-type package/src/missing-type-server.js :60
  • number-param package/src/number-param-server.js :33
  • bug-status package/src/oauth-bug-trigger-server.js :366
  • debug-oauth package/src/oauth-debug-server.js :465
  • test-edge-cases package/src/oauth-edge-case-server.js :421
  • whoami package/src/oauth-repro-server.js :390
  • token-info package/src/oauth-token-refresh-server.js :407
  • ping package/src/oauth-token-refresh-server.js :443
  • echo package/src/optional-param-server.js :32
  • parse_bugsnag_error_url package/src/pattern-param-server.js :42
  • ping package/src/ping-server.js :22
  • long-running-ping package/src/ping-server.js :32
  • echo package/src/ping-server.js :50
  • get-resource-list package/src/resource-lister-server.js :67
  • root-echo package/src/root-echo-server.js :28
  • ping package/src/session-inactivity-server.js :36
  • echo package/src/session-inactivity-server.js :65
  • get-session-info package/src/session-inactivity-server.js :96
  • ping package/src/session-management-server.js :51
  • terminate-session package/src/session-management-server.js :61
  • ping package/src/sse-timeout-server.js :43
  • echo package/src/sse-timeout-server.js :52
  • log-to-stderr package/src/stderr-server.js :27
  • ping package/src/stdout-server.js :32
  • echo_structured package/src/structured-output-server.js :47
  • get-time package/src/ui-server.js :241

declared dependencies 5

  • @modelcontextprotocol/ext-apps@^1.0.1
  • @modelcontextprotocol/sdk@^1.17.0
  • cors@^2.8.5
  • express@^4.21.2
  • zod@^3.25.76

cursor-plugin 1

  • opaque (low) package/.cursor/rules/create-server.mdc bundled .cursor/ plugin descriptor (package/.cursor/rules/create-server.mdc) — presence-detected; review the descriptor