servers

Model Context Protocol Servers

@modelcontextprotocol/servers82809139 files scannedApril 2, 2026

Verified publisher — Model Context Protocol

This package is from Model Context Protocol, a verified publisher. Official MCP specification and SDKs. The findings below are expected for this type of tool — for example, a payment SDK will read API keys, and a browser tool will use child_process. These patterns are normal for a verified publisher, not signs of malice.

What We Found(9 issues)

Each card explains what was found and what it means in plain English. Click "Technical details" for the full breakdown.

HIGHHIGH-002

Caution. This package can open a terminal on your computer and run any command it wants — with YOUR permissions. It could delete files, install malware, or steal your data without you seeing anything happen.

Technical details

Importing child_process gives the package ability to spawn shell commands. MCP servers should not need to execute arbitrary system commands.

import { spawn } from 'child_process'

src/filesystem/__tests__/startup-validation.test.ts:2

HIGHHIGH-002

Technical details

Importing child_process gives the package ability to spawn shell commands. MCP servers should not need to execute arbitrary system commands.

import { spawn } from 'child_process'

src/filesystem/__tests__/structured-content.test.ts:7

HIGHHIGH-003

Caution. This package runs system commands on your computer. This is like giving someone the keys to your terminal. They could run anything — download files, change settings, or access your private data.

Technical details

Direct process execution functions (exec, spawn) can run arbitrary commands. Combined with user input, this enables remote code execution.

spawn(

src/filesystem/__tests__/startup-validation.test.ts:14

MEDIUMMED-001

Suspicious. This package contains hidden encoded text — like a secret message that gets decoded when the code runs. Legitimate packages don't usually hide their code this way. It could be a disguised payload.

Technical details

Long Base64-encoded strings (>128 chars) may contain obfuscated payloads. Legitimate code rarely embeds large encoded blobs inline.

"iVBORw0KGgoAAAANSUhEUgAAABQAAAAUCAYAAACNiR0NAAAKsGlDQ1BJQ0MgUHJvZmlsZQAASImVlwdUU+kSgOfe9JDQEiIgJfQmSCeAlBBaAAXpYCMkAUKJMRBU7MriClZURLCs6KqIgo0idizYFsWC3QVZBNR1sWDDlXeBQ9jdd9575805c+a7c+efmf+e/z9nLgC…

src/everything/tools/get-tiny-image.ts:6

MEDIUMMED-002

Risky. This package doesn't lock its dependency versions. That means if one of its dependencies gets hacked tomorrow, you'd automatically download the hacked version. Good packages always pin their versions.

Technical details

Using '*' or 'latest' as a dependency version means any future version will be installed automatically — including compromised ones.

"*"

package.json:22

MEDIUMMED-002

Technical details

Using '*' or 'latest' as a dependency version means any future version will be installed automatically — including compromised ones.

"*"

package.json:23

MEDIUMMED-002

Technical details

Using '*' or 'latest' as a dependency version means any future version will be installed automatically — including compromised ones.

"*"

package.json:24

MEDIUMMED-002

Technical details

Using '*' or 'latest' as a dependency version means any future version will be installed automatically — including compromised ones.

"*"

package.json:25

MEDIUMMED-003

Suspicious. This package downloads code from paste sites or raw URLs instead of using normal package managers. This is a common trick to sneak in malicious code that doesn't show up in the package itself.

Technical details

Network requests to paste sites or raw GitHub content may indicate payload downloading. Legitimate dependencies use npm, not pastebins.

raw.githubusercontent

src/everything/tools/gzip-file-as-resource.ts:34

Finding Summary

Critical

High

Medium

Low

Info