Deco CMS — Self-hostable MCP Gateway for managing AI connections and tools
- capability exposure inferred + 26
- tool safety inferred + 5
- trust mitigators mixed − 14
inferred mixed
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
grade last moved 1w ago · see ecosystem CVEs →
- A · 12 → B · 17
- B · 27 → A · 12
- B · 17 → B · 27
- A · 12 → B · 17
- B · 27 → A · 12
- B · 17 → B · 27
- A · 12 → B · 17
- B · 17 → A · 12
- A · 12 → B · 17
- B · 17 → A · 12
- B · 27 → B · 17
- B · 17 → B · 27
- A · 12 → B · 17
- B · 17 → A · 12
- A · 4 → B · 17
- A · 0 → A · 4
- A · 4 → A · 0
- A · 0 → A · 4
- A · 8 → A · 0
No known CVEs for this server.
- medium dangerous code
dynamic exec: new Function()
analyzed v4.376.0 · analyzer v33 · 54m ago
danger signals5
- dynamic code execution new Function() package/dist/client/assets/index-COJyT2bn.js :52
($=this.opts.code.process($,C));const j=new Function(`${o.default.self}`,`${o.default.scope}`,$)(this,this.scope.get());if(this.scope.value(O,{ref:j}),j.errors=nu - dynamic code execution new Function() package/dist/client/assets/reports-AdPTt8B7.js :18
peof JSON<"u"&&JSON.parse?JSON.parse(r):new Function("return ("+r+");")():r}var Ds=re();const Fa={registerMap:function(r,e,t){if(e.svg){var a=new W6(r,e.svg);Ds.set(r,a)}else{var n=e.geoJson||e.geoJSO - dynamic code execution new Function() package/dist/client/monaco/0.52.0/vs/base/worker/workerMain.js :6
(a?self.eval(a.createScript("","true")):new Function("true")).call(self),!0}catch{return!1}}class A{constructor(){this._cachedCanUseEval=null}_canUseEval(a){return this._cachedCanUseEval===null&&(this - dynamic code execution new Function() package/dist/client/monaco/0.52.0/vs/loader.js :6
(e?self.eval(e.createScript("","true")):new Function("true")).call(self),!0}catch{return!1}}class h{constructor(){this._cachedCanUseEval=null}_canUseEval(e){return this._cachedCanUseEval===null&&(this - suspicious endpoint analytics.google.com (telemetry) package/dist/client/assets/use-connect-companion-CXSMXGsq.js :1
4:{label:"Google Analytics",consoleUrl:"https://analytics.google.com/analytics/web/#/admin",consoleLinkKey:"reportsOnboarding.saBinding.ga4.openConsole"
[](https://mcpobservatory.com/servers/npm:decocms/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of camudo.