AgentGate core engine: MCP scanning rule engine, lockfile spec, client config discovery
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport — counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 66
filesystem 5
- fs package/dist/deps/collect.js :1
import fs from 'node:fs'; - fs package/dist/deps/resolved.js :1
import fs from 'node:fs'; - fs package/dist/discovery.js :1
import fs from 'node:fs'; - fs package/dist/scanner.js :1
import fs from 'node:fs'; - fs package/dist/version.js :1
import fs from 'node:fs';
shell / exec 1
- shell package/dist/rules/rce-vectors.js :19
* Dynamic code-execution primitives. `exec(` must not be preceded by a dot or word
network 1
- net package/dist/advisories/data.js :1084
"title": "meta-ads-mcp SSRF in upload_ad_image via unrestricted image_url fetch (CVE-2026-54549)",
declared dependencies 8
- @modelcontextprotocol/sdk@^1.30.0
- smol-toml@^1.7.1
- yaml@^2.9.0
- zod@^4.4.3
- @types/node@^22.20.1
- @vitest/coverage-v8@^4.1.10
- typescript@^5.9.3
- vitest@^4.1.10