{ "meta": { "title": "The State of MCP Servers", "as_of": "2026-11-10", "generated": "2026-11-10T12:49:41Z", "brand": "Gardu", "scanner": "Gardu static scanner (Hexbane rule philosophy, HB101-HB701)", "version": "v1.0", "scan_status": "done" }, "ecosystem": { "as_of": "2026-11-10", "github_mcp_in_name_total": 359500, "note": "Count of public GitHub repositories with 'mcp' in the name (GitHub search, as_of date). A broad upper bound on the ecosystem, not a deduped server count.", "top_categories": { "Official & SDK": 7, "Agents & Frameworks": 7, "Code & Dev tools": 7, "Design, 3D & Games": 5, "Browser & Web": 4, "Data & Scraping": 3, "Databases": 3, "Cloud & Infrastructure": 3, "Workflow & Automation": 2, "Registries & Awesome": 2, "Reverse Engineering": 2 }, "scanned_repos": [ "Cloudflare/mcp-server-cloudflare", "anthropics/skills", "geelen/mcp-remote", "github/github-mcp-server", "modelcontextprotocol/servers", "mongodb-js/mongodb-mcp-server", "wonderwhy-er/DesktopCommanderMCP" ] }, "servers": { "as_of": "2026-11-10", "count": 45, "servers": [ { "full_name": "n8n-io/n8n", "name": "n8n", "owner": "n8n-io", "stars": 209991, "desc": "", "lang": null, "pushed": null, "topics": [], "category": "Workflow & Automation", "scanned": false, "verdict": null }, { "full_name": "punkpeye/awesome-mcp-servers", "name": "awesome-mcp-servers", "owner": "punkpeye", "stars": 97557, "forks": 19620, "desc": "A collection of MCP servers.", "lang": null, "pushed": "2026-11-06T17:59:03Z", "created": "2024-11-30T04:49:10Z", "archived": false, "topics": [ "ai", "mcp" ], "homepage": "https://glama.ai/mcp/servers", "open_issues": 4703, "category": "Registries & Awesome", "scanned": false, "verdict": null }, { "full_name": "modelcontextprotocol/servers", "name": "servers", "owner": "modelcontextprotocol", "stars": 91903, "desc": "", "lang": null, "pushed": null, "topics": [], "category": "Official & SDK", "scanned": true, "verdict": "REVIEW", "files_scanned": 364, "findings_total": 146 }, { "full_name": "ChromeDevTools/chrome-devtools-mcp", "name": "chrome-devtools-mcp", "owner": "ChromeDevTools", "stars": 55054, "forks": 4579, "desc": "Chrome DevTools for coding agents", "lang": "TypeScript", "pushed": "2026-11-10T10:53:53Z", "created": "2025-09-11T10:39:55Z", "archived": false, "topics": [ "browser", "chrome", "chrome-devtools", "debugging", "devtools", "mcp", "mcp-server", "puppeteer" ], "homepage": "https://developer.chrome.com/docs/devtools/agents", "open_issues": 127, "category": "Browser & Web", "scanned": false, "verdict": null }, { "full_name": "run-llama/llama_index", "name": "llama_index", "owner": "run-llama", "stars": 52867, "desc": "", "lang": null, "pushed": null, "topics": [], "category": "Agents & Frameworks", "scanned": false, "verdict": null }, { "full_name": "DeusData/codebase-memory-mcp", "name": "codebase-memory-mcp", "owner": "DeusData", "stars": 48443, "forks": 4012, "desc": "Local code intelligence for developers and AI agents. Connect code, docs and infrastructure in a persistent graph, with CBM Lens, MCP tools, agent integrations and change-aware test selection.", "lang": "C", "pushed": "2026-11-10T01:49:49Z", "created": "2026-02-24T22:01:00Z", "archived": false, "topics": [ "aider", "ast", "claude-code", "code-analysis", "code-intelligence", "codex", "cursor", "cypher", "developer-tools", "gemini-cli", "graph-visualization", "kilocode", "knowledge-graph", "mcp", "mcp-server", "model-context-protocol", "opencode", "sqlite", "tree-sitter", "windsurf" ], "homepage": "https://deusdata.github.io/codebase-memory-mcp/", "open_issues": 556, "category": "Code & Dev tools", "scanned": false, "verdict": null }, { "full_name": "microsoft/playwright-mcp", "name": "playwright-mcp", "owner": "microsoft", "stars": 39405, "forks": 3413, "desc": "Playwright MCP server", "lang": "TypeScript", "pushed": "2026-11-10T01:37:49Z", "created": "2025-03-21T17:48:36Z", "archived": false, "topics": [ "mcp", "playwright" ], "homepage": "https://www.npmjs.com/package/@playwright/mcp", "open_issues": 1, "category": "Browser & Web", "scanned": false, "verdict": null }, { "full_name": "github/github-mcp-server", "name": "github-mcp-server", "owner": "github", "stars": 34361, "forks": 5321, "desc": "GitHub's official MCP Server", "lang": "Go", "pushed": "2026-11-09T18:56:03Z", "created": "2025-03-04T16:42:04Z", "archived": false, "topics": [ "github", "mcp", "mcp-server" ], "homepage": "", "open_issues": 444, "category": "Code & Dev tools", "scanned": true, "verdict": "REVIEW", "files_scanned": 403, "findings_total": 273 }, { "full_name": "ahujasid/mcp-for-blender", "name": "mcp-for-blender", "owner": "ahujasid", "stars": 33853, "forks": 3083, "desc": "Community plugin to control Blender 3D with any LLM of your choice. Not affiliated with the official Blender Foundation.", "lang": "Python", "pushed": "2026-11-04T13:04:08Z", "created": "2025-03-07T09:58:58Z", "archived": false, "topics": [ "3d-modeling", "ai", "blender", "blender-addon", "blender-mcp", "claude", "generative-ai", "llm", "mcp", "model-context-protocol", "python" ], "homepage": "https://www.mcp-for-blender.com/", "open_issues": 53, "category": "Design, 3D & Games", "scanned": false, "verdict": null }, { "full_name": "ComposioHQ/composio", "name": "composio", "owner": "ComposioHQ", "stars": 31010, "forks": 4934, "desc": "Composio powers 1000+ toolkits, tool search, context management, authentication, and a sandboxed workbench to help you build AI agents that turn intent into action.", "lang": "TypeScript", "pushed": "2026-11-10T12:13:47Z", "created": "2024-02-23T13:58:27Z", "archived": false, "topics": [ "agentic-ai", "agents", "ai", "ai-agents", "aiagents", "developer-tools", "function-calling", "gpt-4", "javascript", "js", "llm", "llmops", "mcp", "python", "remote-mcp-server", "sse", "typescript" ], "homepage": "https://docs.composio.dev", "open_issues": 140, "category": "Agents & Frameworks", "scanned": false, "verdict": null }, { "full_name": "modelcontextprotocol/python-sdk", "name": "python-sdk", "owner": "modelcontextprotocol", "stars": 24819, "desc": "", "lang": null, "pushed": null, "topics": [], "category": "Official & SDK", "scanned": false, "verdict": null }, { "full_name": "czlonkowski/n8n-mcp", "name": "n8n-mcp", "owner": "czlonkowski", "stars": 23235, "forks": 3682, "desc": "A MCP for Claude Desktop / Claude Code / Windsurf / Cursor to build n8n workflows for you", "lang": "TypeScript", "pushed": "2026-11-09T12:08:18Z", "created": "2025-06-07T12:15:57Z", "archived": false, "topics": [ "mcp", "mcp-server", "n8n", "workflows" ], "homepage": "https://www.n8n-mcp.com/", "open_issues": 60, "category": "Workflow & Automation", "scanned": false, "verdict": null }, { "full_name": "microsoft/mcp-for-beginners", "name": "mcp-for-beginners", "owner": "microsoft", "stars": 17633, "forks": 5683, "desc": "This open-source curriculum introduces the fundamentals of Model Context Protocol (MCP) through real-world, cross-language examples in .NET, Java, TypeScript, JavaScript, Rust and Python. Designed for developers, it focuses on practical techniques for building modular, scalable, and secure AI workflows from session setup to service orchestration.", "lang": "Jupyter Notebook", "pushed": "2026-11-02T03:13:47Z", "created": "2025-04-04T20:46:17Z", "archived": false, "topics": [ "csharp", "java", "javascript", "javascript-applications", "mcp", "mcp-client", "mcp-security", "mcp-server", "model", "model-context-protocol", "modelcontextprotocol", "python", "rust", "typescript" ], "homepage": "", "open_issues": 25, "category": "Code & Dev tools", "scanned": false, "verdict": null }, { "full_name": "xpzouying/xiaohongshu-mcp", "name": "xiaohongshu-mcp", "owner": "xpzouying", "stars": 17057, "forks": 2508, "desc": "MCP for xiaohongshu.com", "lang": "Go", "pushed": "2026-11-09T04:35:53Z", "created": "2025-08-03T09:08:45Z", "archived": false, "topics": [ "mcp", "mcp-server", "xiaohongshu-mcp" ], "homepage": "https://www.haha.ai/xiaohongshu-mcp", "open_issues": 114, "category": "Data & Scraping", "scanned": false, "verdict": null }, { "full_name": "googleapis/mcp-toolbox", "name": "mcp-toolbox", "owner": "googleapis", "stars": 16832, "forks": 1796, "desc": "MCP Toolbox for Databases is an open source MCP server for databases.", "lang": "Go", "pushed": "2026-11-10T06:49:41Z", "created": "2024-06-07T20:52:54Z", "archived": false, "topics": [ "agent", "agents", "ai", "bigquery", "clickhouse", "cockroachdb", "database", "elasticsearch", "firestore", "genai", "llm", "mcp", "mongodb", "mysql", "oracle", "postgresql", "redis", "server", "spanner", "tidb" ], "homepage": "https://mcp-toolbox.dev/documentation/introduction/", "open_issues": 439, "category": "Databases", "scanned": false, "verdict": null }, { "full_name": "GLips/Figma-Context-MCP", "name": "Figma-Context-MCP", "owner": "GLips", "stars": 16187, "forks": 1283, "desc": "MCP server to provide Figma layout information to AI coding agents like Cursor", "lang": "TypeScript", "pushed": "2026-10-27T05:37:12Z", "created": "2025-02-13T02:55:06Z", "archived": false, "topics": [ "ai", "cursor", "figma", "mcp", "typescript" ], "homepage": "https://www.framelink.ai/", "open_issues": 29, "category": "Design, 3D & Games", "scanned": false, "verdict": null }, { "full_name": "CoplayDev/unity-mcp", "name": "unity-mcp", "owner": "CoplayDev", "stars": 15855, "forks": 1633, "desc": "Unity MCP acts as a bridge between AI assistants and your Unity Editor. Give your LLM tools to manage assets, control scenes, edit scripts, and automate tasks within Unity.", "lang": "C#", "pushed": "2026-10-30T18:15:23Z", "created": "2025-03-18T11:01:58Z", "archived": false, "topics": [ "ai", "ai-integration", "anthropic", "claude", "copilot", "cursor", "game-development", "gamedev", "gemini", "llm", "mcp", "model-context-protocol", "openai", "unity", "unity3d", "videogames" ], "homepage": "https://coplaydev.github.io/unity-mcp/", "open_issues": 130, "category": "Design, 3D & Games", "scanned": false, "verdict": null }, { "full_name": "apify/apify-mcp-server", "name": "apify-mcp-server", "owner": "apify", "stars": 15559, "forks": 444, "desc": "The Apify MCP server enables your AI agents to extract data from social media, search engines, maps, e-commerce sites, or any other website using thousands of ready-made scrapers, crawlers, and automation tools available on the Apify Store.", "lang": "TypeScript", "pushed": "2026-11-10T11:50:09Z", "created": "2025-01-02T15:43:09Z", "archived": false, "topics": [ "agents", "ai", "mcp", "mcp-server" ], "homepage": "https://mcp.apify.com", "open_issues": 252, "category": "Data & Scraping", "scanned": false, "verdict": null }, { "full_name": "modelcontextprotocol/typescript-sdk", "name": "typescript-sdk", "owner": "modelcontextprotocol", "stars": 13741, "desc": "", "lang": null, "pushed": null, "topics": [], "category": "Official & SDK", "scanned": false, "verdict": null }, { "full_name": "mrexodia/ida-pro-mcp", "name": "ida-pro-mcp", "owner": "mrexodia", "stars": 13431, "forks": 1644, "desc": "AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.", "lang": "Python", "pushed": "2026-09-26T15:42:10Z", "created": "2025-03-25T22:23:41Z", "archived": false, "topics": [ "ai", "aiagent", "binary-analysis", "ida-plugin", "ida-pro", "mcp", "mcp-server", "modelcontextprotocol", "reverse-engineering" ], "homepage": "https://plugins.hex-rays.com/mrexodia/ida-pro-mcp", "open_issues": 57, "category": "Reverse Engineering", "scanned": false, "verdict": null }, { "full_name": "hangwin/mcp-chrome", "name": "mcp-chrome", "owner": "hangwin", "stars": 12538, "forks": 1152, "desc": "Chrome MCP Server is a Chrome extension-based Model Context Protocol (MCP) server that exposes your Chrome browser functionality to AI assistants like Claude, enabling complex browser automation, content analysis, and semantic search.", "lang": "TypeScript", "pushed": "2026-01-06T13:05:39Z", "created": "2025-06-09T09:07:06Z", "archived": false, "topics": [], "homepage": "", "open_issues": 239, "category": "Browser & Web", "scanned": false, "verdict": null }, { "full_name": "tadata-org/fastapi_mcp", "name": "fastapi_mcp", "owner": "tadata-org", "stars": 12028, "forks": 965, "desc": "Expose your FastAPI endpoints as Model Context Protocol (MCP) tools, with Auth!", "lang": "Python", "pushed": "2025-11-24T14:51:54Z", "created": "2025-03-08T11:15:43Z", "archived": false, "topics": [ "ai", "authentication", "authorization", "claude", "cursor", "fastapi", "llm", "mcp", "mcp-server", "mcp-servers", "modelcontextprotocol", "openapi", "windsurf" ], "homepage": "https://fastapi-mcp.tadata.com/", "open_issues": 175, "category": "Agents & Frameworks", "scanned": false, "verdict": null }, { "full_name": "LaurieWired/GhidraMCP", "name": "GhidraMCP", "owner": "LaurieWired", "stars": 11871, "forks": 1299, "desc": "MCP Server for Ghidra", "lang": "Java", "pushed": "2026-10-10T20:08:37Z", "created": "2025-03-23T05:36:55Z", "archived": false, "topics": [], "homepage": "", "open_issues": 96, "category": "Reverse Engineering", "scanned": false, "verdict": null }, { "full_name": "BeehiveInnovations/pal-mcp-server", "name": "pal-mcp-server", "owner": "BeehiveInnovations", "stars": 11836, "forks": 1036, "desc": "The power of Claude Code / GeminiCLI / CodexCLI + [Gemini / OpenAI / OpenRouter / Azure / Grok / Ollama / Custom Model / All Of The Above] working as one.", "lang": "Python", "pushed": "2025-12-15T17:07:31Z", "created": "2025-06-08T15:36:50Z", "archived": false, "topics": [], "homepage": "", "open_issues": 153, "category": "Agents & Frameworks", "scanned": false, "verdict": null }, { "full_name": "CursorTouch/Windows-MCP", "name": "Windows-MCP", "owner": "CursorTouch", "stars": 11463, "forks": 1225, "desc": "MCP Server for Computer Use in Windows", "lang": "Python", "pushed": "2026-11-10T06:53:30Z", "created": "2025-05-13T02:27:53Z", "archived": false, "topics": [ "ai", "desktop", "mcp", "tools", "windows", "windows-automation" ], "homepage": "", "open_issues": 39, "category": "Design, 3D & Games", "scanned": false, "verdict": null }, { "full_name": "modelcontextprotocol/inspector", "name": "inspector", "owner": "modelcontextprotocol", "stars": 11268, "desc": "", "lang": null, "pushed": null, "topics": [], "category": "Official & SDK", "scanned": false, "verdict": null }, { "full_name": "mcp-use/mcp-use", "name": "mcp-use", "owner": "mcp-use", "stars": 10862, "forks": 1546, "desc": "The fullstack MCP framework to develop MCP Apps for ChatGPT / Claude & MCP Servers for AI Agents.", "lang": "TypeScript", "pushed": "2026-11-09T21:53:52Z", "created": "2025-03-28T10:06:31Z", "archived": false, "topics": [ "agent-plugins", "agentic-framework", "ai", "apps-sdk", "chatgpt", "claude-code", "claude-connectors", "llms", "mcp", "mcp-apps", "mcp-client", "mcp-gateway", "mcp-inspector", "mcp-server", "mcp-servers", "mcp-tools", "mcp-ui", "model-context-protocol", "modelcontextprotocol", "skills" ], "homepage": "https://manufact.com", "open_issues": 130, "category": "Agents & Frameworks", "scanned": false, "verdict": null }, { "full_name": "mobile-next/mobile-mcp", "name": "mobile-mcp", "owner": "mobile-next", "stars": 10469, "forks": 937, "desc": "Mobile MCP: let AI agents drive your iOS and Android apps. MCP server for simulators, emulators and real devices. Works with Claude Code, Codex, Cursor and any MCP client.", "lang": "TypeScript", "pushed": "2026-11-07T08:39:20Z", "created": "2025-03-28T16:21:06Z", "archived": false, "topics": [ "agent", "android", "android-automation", "appium-alternative", "claude-code", "codex", "cursor", "emulator", "ios", "ios-automation", "mcp", "mcp-server", "mobile", "mobile-automation", "mobile-testing", "real-device", "simulator", "skills" ], "homepage": "https://mobilenext.ai", "open_issues": 67, "category": "Design, 3D & Games", "scanned": false, "verdict": null }, { "full_name": "wonderwhy-er/DesktopCommanderMCP", "name": "DesktopCommanderMCP", "owner": "wonderwhy-er", "stars": 10278, "forks": 1285, "desc": "This is MCP server for Claude that gives it terminal control, file system search and diff file editing capabilities", "lang": "JavaScript", "pushed": "2026-11-10T12:03:55Z", "created": "2024-12-04T08:26:08Z", "archived": false, "topics": [ "agent", "ai", "code-analysis", "code-generation", "gemini-cli-extension", "mcp", "terminal-ai", "terminal-automation", "vibe-coding" ], "homepage": "https://desktopcommander.app/", "open_issues": 342, "category": "Code & Dev tools", "scanned": true, "verdict": "REVIEW", "files_scanned": 638, "findings_total": 337 }, { "full_name": "awslabs/mcp", "name": "mcp", "owner": "awslabs", "stars": 9899, "forks": 1868, "desc": "Open source MCP Servers for AWS", "lang": "Python", "pushed": "2026-11-10T07:15:12Z", "created": "2025-03-21T00:39:00Z", "archived": false, "topics": [ "aws", "mcp", "mcp-client", "mcp-clients", "mcp-host", "mcp-server", "mcp-servers", "mcp-tools", "modelcontextprotocol" ], "homepage": "https://awslabs.github.io/mcp/", "open_issues": 275, "category": "Cloud & Infrastructure", "scanned": false, "verdict": null }, { "full_name": "modelcontextprotocol/modelcontextprotocol", "name": "modelcontextprotocol", "owner": "modelcontextprotocol", "stars": 9655, "forks": 1906, "desc": "Specification and documentation for the Model Context Protocol", "lang": "TypeScript", "pushed": "2026-11-10T00:13:08Z", "created": "2024-09-24T20:26:52Z", "archived": false, "topics": [ "docs", "mcp", "specification", "standard" ], "homepage": "https://modelcontextprotocol.io", "open_issues": 118, "category": "Official & SDK", "scanned": false, "verdict": null }, { "full_name": "mark3labs/mcp-go", "name": "mcp-go", "owner": "mark3labs", "stars": 9232, "forks": 943, "desc": "A Go implementation of the Model Context Protocol (MCP), enabling seamless integration between LLM applications and external data sources and tools.", "lang": "Go", "pushed": "2026-11-09T14:41:38Z", "created": "2024-11-27T12:38:33Z", "archived": false, "topics": [], "homepage": "http://mcp-go.dev/", "open_issues": 51, "category": "Code & Dev tools", "scanned": false, "verdict": null }, { "full_name": "Ryze-AI-Adgent/open-seo-mcp-skills", "name": "open-seo-mcp-skills", "owner": "Ryze-AI-Adgent", "stars": 9075, "forks": 395, "desc": "Free SEO MCP server + open-source SEO and GEO skills for Claude: keyword research, rank tracking, audits, backlinks, AI visibility on your real GSC/GA4/ads data. claude mcp add ryze --transport http https://connector.get-ryze.ai/mcp", "lang": "Shell", "pushed": "2026-10-27T08:57:55Z", "created": "2026-08-29T23:37:01Z", "archived": false, "topics": [ "ai-seo", "ai-visibility", "backlinks", "claude", "claude-code", "claude-skills", "dataforseo", "generative-engine-optimization", "geo", "geo-mcp", "keyword-research", "llm-seo", "mcp", "mcp-server", "open-source-seo", "rank-tracking", "seo", "seo-audit", "seo-mcp", "seo-mcp-server" ], "homepage": "https://www.get-ryze.ai/how-to-connect-claude-to-google-meta-ads-mcp", "open_issues": 4, "category": "Agents & Frameworks", "scanned": false, "verdict": null }, { "full_name": "lastmile-ai/mcp-agent", "name": "mcp-agent", "owner": "lastmile-ai", "stars": 8578, "forks": 894, "desc": "Build effective agents using Model Context Protocol and simple workflow patterns", "lang": "Python", "pushed": "2026-01-25T16:35:16Z", "created": "2024-12-18T01:55:10Z", "archived": false, "topics": [ "agents", "ai", "ai-agents", "llm", "llms", "mcp", "model-context-protocol", "python" ], "homepage": "", "open_issues": 161, "category": "Agents & Frameworks", "scanned": false, "verdict": null }, { "full_name": "idosal/git-mcp", "name": "git-mcp", "owner": "idosal", "stars": 8510, "forks": 762, "desc": "Put an end to code hallucinations! GitMCP is a free, open-source, remote MCP server for any GitHub project", "lang": "TypeScript", "pushed": "2026-05-08T14:21:24Z", "created": "2025-03-29T00:44:19Z", "archived": false, "topics": [ "agentic-ai", "agents", "ai", "claude", "copilot", "cursor", "git", "llm", "mcp" ], "homepage": "https://gitmcp.io", "open_issues": 87, "category": "Code & Dev tools", "scanned": false, "verdict": null }, { "full_name": "yzfly/Awesome-MCP-ZH", "name": "Awesome-MCP-ZH", "owner": "yzfly", "stars": 7826, "forks": 1096, "desc": "MCP 资源精选， MCP指南，Claude MCP，MCP Servers, MCP Clients", "lang": null, "pushed": "2026-11-01T02:54:38Z", "created": "2025-04-03T00:38:51Z", "archived": false, "topics": [ "claude", "claude-mcp", "deepseek", "deepseek-mcp", "mcp", "mcp-clients", "mcp-host", "mcp-server", "mcp-servers", "mcp-servers-directory", "mcp-tools", "qwen-mcp" ], "homepage": "", "open_issues": 87, "category": "Registries & Awesome", "scanned": false, "verdict": null }, { "full_name": "firecrawl/firecrawl-mcp-server", "name": "firecrawl-mcp-server", "owner": "firecrawl", "stars": 7793, "forks": 928, "desc": "Official Firecrawl MCP server, the context API for AI agents: search, scrape, and interact with the web, plus parse, crawl, map, Agent and Monitor, from any MCP client.", "lang": "JavaScript", "pushed": "2026-11-10T09:09:24Z", "created": "2024-12-06T07:50:27Z", "archived": false, "topics": [ "batch-processing", "claude", "content-extraction", "data-collection", "firecrawl", "firecrawl-ai", "gemini-cli-extension", "javascript-rendering", "llm-tools", "mcp", "mcp-server", "model-context-protocol", "search-api", "web-crawler", "web-scraping" ], "homepage": "https://firecrawl.dev", "open_issues": 196, "category": "Data & Scraping", "scanned": false, "verdict": null }, { "full_name": "modelcontextprotocol/registry", "name": "registry", "owner": "modelcontextprotocol", "stars": 7456, "forks": 1048, "desc": "A community driven registry service for Model Context Protocol (MCP) servers.", "lang": "Go", "pushed": "2026-11-10T11:21:18Z", "created": "2025-02-05T17:58:01Z", "archived": false, "topics": [ "mcp", "mcp-servers" ], "homepage": "https://github.com/modelcontextprotocol/registry/tree/main/docs", "open_issues": 122, "category": "Official & SDK", "scanned": false, "verdict": null }, { "full_name": "AgentDeskAI/browser-tools-mcp", "name": "browser-tools-mcp", "owner": "AgentDeskAI", "stars": 7342, "forks": 538, "desc": "Monitor browser logs directly from Cursor and other MCP compatible IDEs.", "lang": "TypeScript", "pushed": "2026-10-28T19:06:19Z", "created": "2025-02-10T09:20:38Z", "archived": false, "topics": [ "ai", "anthropic", "cursor", "mcp", "mcp-server" ], "homepage": "https://agentdesk.ai/", "open_issues": 9, "category": "Browser & Web", "scanned": false, "verdict": null }, { "full_name": "modelcontextprotocol/go-sdk", "name": "go-sdk", "owner": "modelcontextprotocol", "stars": 5330, "desc": "", "lang": null, "pushed": null, "topics": [], "category": "Official & SDK", "scanned": false, "verdict": null }, { "full_name": "firebase/firebase-tools", "name": "firebase-tools", "owner": "firebase", "stars": 4489, "desc": "", "lang": null, "pushed": null, "topics": [], "category": "Cloud & Infrastructure", "scanned": false, "verdict": null }, { "full_name": "Cloudflare/mcp-server-cloudflare", "name": "mcp-server-cloudflare", "owner": "Cloudflare", "stars": 4456, "desc": "", "lang": null, "pushed": null, "topics": [], "category": "Cloud & Infrastructure", "scanned": true, "verdict": "REVIEW", "files_scanned": 422, "findings_total": 564 }, { "full_name": "supabase/mcp", "name": "mcp", "owner": "supabase", "stars": 3003, "forks": 428, "desc": "Connect Supabase to your AI assistants", "lang": "TypeScript", "pushed": "2026-11-10T06:14:29Z", "created": "2024-12-20T23:52:42Z", "archived": false, "topics": [], "homepage": "https://supabase.com/mcp", "open_issues": 123, "category": "Databases", "scanned": false, "verdict": null }, { "full_name": "geelen/mcp-remote", "name": "mcp-remote", "owner": "geelen", "stars": 1667, "desc": "", "lang": null, "pushed": null, "topics": [], "category": "Code & Dev tools", "scanned": true, "verdict": "REVIEW", "files_scanned": 63, "findings_total": 257 }, { "full_name": "mongodb-js/mongodb-mcp-server", "name": "mongodb-mcp-server", "owner": "mongodb-js", "stars": 1160, "desc": "", "lang": null, "pushed": null, "topics": [], "category": "Databases", "scanned": true, "verdict": "REVIEW", "files_scanned": 792, "findings_total": 646 } ], "categories": { "Official & SDK": 7, "Agents & Frameworks": 7, "Code & Dev tools": 7, "Design, 3D & Games": 5, "Browser & Web": 4, "Data & Scraping": 3, "Databases": 3, "Cloud & Infrastructure": 3, "Workflow & Automation": 2, "Registries & Awesome": 2, "Reverse Engineering": 2 } }, "skills": { "as_of": "2026-11-10", "count": 7, "skills": [ { "full_name": "obra/superpowers", "name": "superpowers", "owner": "obra", "stars": 315429, "forks": 28055, "desc": "An agentic skills framework & software development methodology that works.", "lang": "Shell", "pushed": "2026-11-03T23:24:58Z", "created": "2025-10-09T19:45:18Z", "archived": false, "topics": [ "ai", "brainstorming", "coding", "obra", "sdlc", "skills", "subagent-driven-development", "superpowers" ], "homepage": "", "open_issues": 335, "category": "Skills framework", "verdict": null }, { "full_name": "anthropics/skills", "name": "skills", "owner": "anthropics", "stars": 191779, "desc": "", "lang": null, "pushed": null, "topics": [], "category": "Official (Anthropic)", "verdict": "REVIEW", "files_scanned": 270, "findings_total": 223 }, { "full_name": "anthropics/claude-code", "name": "claude-code", "owner": "anthropics", "stars": 155160, "desc": "", "lang": null, "pushed": null, "topics": [], "category": "Coding agent (with skills)", "verdict": null }, { "full_name": "hesreallyhim/awesome-claude-code", "name": "awesome-claude-code", "owner": "hesreallyhim", "stars": 57669, "forks": 4939, "desc": "A hand-picked collection of the finest of resources for the most awesome of agents, Claude Code, the undisputed champion of coding companions, from the unstoppable team at Anthropic PBC (no affiliation). A delectable showcase of top tier skills, ambidextrous agents, scintillating status lines, top notch developer tooling, and also we have plugins", "lang": "Python", "pushed": "2026-11-10T12:09:02Z", "created": "2025-04-19T20:55:59Z", "archived": false, "topics": [ "agent-skills", "agentic-code", "agentic-coding", "ai-workflow-optimization", "ai-workflows", "anthropic", "anthropic-claude", "awesome", "awesome-claude-code", "awesome-list", "awesome-lists", "awesome-resources", "claude", "claude-code", "coding-agent", "coding-agents", "coding-assistant", "coding-assistants", "llm" ], "homepage": "", "open_issues": 1225, "category": "Awesome list", "verdict": null }, { "full_name": "anthropics/claude-cookbooks", "name": "claude-cookbooks", "owner": "anthropics", "stars": 54482, "forks": 6617, "desc": "A collection of notebooks/recipes showcasing some fun and effective ways of using Claude.", "lang": "Jupyter Notebook", "pushed": "2026-11-04T19:23:29Z", "created": "2023-08-15T20:23:51Z", "archived": false, "topics": [], "homepage": null, "open_issues": 382, "category": "Cookbook / recipes", "verdict": null }, { "full_name": "wshobson/agents", "name": "agents", "owner": "wshobson", "stars": 42384, "forks": 4476, "desc": "Plugins, agents, skills, and commands for Claude Code, Codex CLI, Cursor, OpenCode, Antigravity CLI, GitHub Copilot, and Pi, written once in Markdown and adapted to each tool by generators with validation and evals.", "lang": "Python", "pushed": "2026-11-09T01:08:33Z", "created": "2025-07-24T23:28:14Z", "archived": false, "topics": [ "agent-skills", "agentic-ai", "ai-agents", "anthropic", "antigravity", "claude", "claude-code", "claude-code-marketplace", "claude-code-plugin", "claude-skills", "codex", "coding-agents", "cursor", "cursor-rules", "github-copilot", "mcp", "multi-agent", "opencode", "pi-coding-agent", "subagents" ], "homepage": "https://sethhobson.com", "open_issues": 11, "category": "Multi-agent skills", "verdict": null }, { "full_name": "davila7/claude-code-templates", "name": "claude-code-templates", "owner": "davila7", "stars": 33254, "forks": 3903, "desc": "Open-source registry and CLI for Claude Code components: agents, commands, skills, hooks, MCPs, settings and mods", "lang": "Python", "pushed": "2026-11-10T03:57:09Z", "created": "2025-07-04T01:26:26Z", "archived": false, "topics": [ "agent-skills", "ai-agents", "anthropic", "anthropic-claude", "claude", "claude-code", "claude-code-plugins", "cli", "mcp", "registry" ], "homepage": "https://aitmpl.com", "open_issues": 483, "category": "Registry / templates", "verdict": null } ], "categories": { "Skills framework": 1, "Official (Anthropic)": 1, "Coding agent (with skills)": 1, "Awesome list": 1, "Cookbook / recipes": 1, "Multi-agent skills": 1, "Registry / templates": 1 } }, "scan": { "scanned_at": "2026-11-10", "results": [ { "repo": "wonderwhy-er/DesktopCommanderMCP", "files_total": 638, "files_scanned": 638, "files_binary_skipped": 0, "files_size_skipped": 0, "findings_total": 337, "findings_real": 84, "high": 0, "medium": 20, "verdict": "REVIEW", "rules": { "HB602": 234, "HB501": 46, "HB403": 7, "HB401": 12, "HB405": 6, "HB101": 3, "HB310": 1, "HB503": 27, "HB301": 1 }, "notable": [ { "rule": "HB403", "family": "Execution & exfiltration", "severity": "medium", "file": "install-docker.ps1", "line": 242, "snippet": "docker run --rm -v dc-system:/target mcp/desktop-commander:latest sh -c 'rm -rf /target/src/app && cp -a /usr/. /target/'", "note": "", "likely_doc": false }, { "rule": "HB403", "family": "Execution & exfiltration", "severity": "medium", "file": "install-docker.sh", "line": 271, "snippet": "if docker run --rm -v dc-system:/target \"$DOCKER_IMAGE\" sh -c 'rm -rf /target/src/app && cp -a /usr/. /target/'; then", "note": "", "likely_doc": false }, { "rule": "HB403", "family": "Execution & exfiltration", "severity": "medium", "file": "install.sh", "line": 36, "snippet": "rm -rf /tmp/nodejs-install", "note": "", "likely_doc": false }, { "rule": "HB501", "family": "MCP config", "severity": "medium", "file": "install.sh", "line": 46, "snippet": "if npx @wonderwhy-er/desktop-commander@latest setup; then", "note": "", "likely_doc": false }, { "rule": "HB501", "family": "MCP config", "severity": "medium", "file": "package.json", "line": 59, "snippet": "\"inspector\": \"npx @modelcontextprotocol/inspector dist/index.js\",", "note": "", "likely_doc": false }, { "rule": "HB501", "family": "MCP config", "severity": "medium", "file": "scripts/remote/remote-linux.sh", "line": 79, "snippet": "'npx @wonderwhy-er/desktop-commander@latest remote'", "note": "", "likely_doc": false }, { "rule": "HB401", "family": "Execution & exfiltration", "severity": "medium", "file": "scripts/remote/remote-linux.sh", "line": 202, "snippet": "# -t 0 checks whether stdin is a terminal. A curl | sh pipe needs /dev/tty for interactive input.", "note": "", "likely_doc": false }, { "rule": "HB501", "family": "MCP config", "severity": "medium", "file": "scripts/remote/remote-macos.sh", "line": 76, "snippet": "'npx @wonderwhy-er/desktop-commander@latest remote'", "note": "", "likely_doc": false }, { "rule": "HB401", "family": "Execution & exfiltration", "severity": "medium", "file": "scripts/remote/remote-macos.sh", "line": 174, "snippet": "# -t 0 checks whether stdin is a terminal. A curl | sh pipe needs /dev/tty for interactive input.", "note": "", "likely_doc": false }, { "rule": "HB501", "family": "MCP config", "severity": "medium", "file": "setup-claude-server.js", "line": 211, "snippet": "// Usage: npx @wonderwhy-er/desktop-commander setup alpha", "note": "", "likely_doc": false }, { "rule": "HB501", "family": "MCP config", "severity": "medium", "file": "setup-claude-server.js", "line": 217, "snippet": "// e.g., npx @wonderwhy-er/desktop-commander@0.2.18-alpha setup", "note": "", "likely_doc": false }, { "rule": "HB501", "family": "MCP config", "severity": "medium", "file": "src/npm-scripts/remote.ts", "line": 42, "snippet": "npx @wonderwhy-er/desktop-commander@latest remote", "note": "", "likely_doc": false }, { "rule": "HB501", "family": "MCP config", "severity": "medium", "file": "src/npm-scripts/remote.ts", "line": 43, "snippet": "npx @wonderwhy-er/desktop-commander@latest remote --debug", "note": "", "likely_doc": false }, { "rule": "HB501", "family": "MCP config", "severity": "medium", "file": "src/npm-scripts/remote.ts", "line": 44, "snippet": "npx @wonderwhy-er/desktop-commander@latest remote --logout", "note": "", "likely_doc": false }, { "rule": "HB501", "family": "MCP config", "severity": "medium", "file": "src/npm-scripts/remote.ts", "line": 45, "snippet": "npx @wonderwhy-er/desktop-commander@latest remote --report", "note": "", "likely_doc": false }, { "rule": "HB501", "family": "MCP config", "severity": "medium", "file": "src/remote-device/device.ts", "line": 455, "snippet": "console.log('│ Help: npx @wonderwhy-er/desktop-commander@latest remote --help');", "note": "", "likely_doc": false }, { "rule": "HB501", "family": "MCP config", "severity": "medium", "file": "src/remote-device/device.ts", "line": 456, "snippet": "console.log('│ Log out: npx @wonderwhy-er/desktop-commander@latest remote --logout');", "note": "", "likely_doc": false }, { "rule": "HB101", "family": "Hidden content", "severity": "medium", "file": "src/remote-device/diagnostics/device-log.ts", "line": 86, "snippet": "‍ (+1 hidden chars total)", "note": "zero-width=1 bidi=0 tags=0", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "src/remote-device/diagnostics/redact.ts", "line": 13, "snippet": "const SECRET_KEYS = 'access_token|refresh_token|provider_token|provider_refresh_token|apikey|api_key|password|passwd|secret|client_secret';", "note": "", "likely_doc": false }, { "rule": "HB501", "family": "MCP config", "severity": "medium", "file": "uninstall-claude-server.js", "line": 694, "snippet": "logToFile('npx @wonderwhy-er/desktop-commander@latest setup');", "note": "", "likely_doc": false } ] }, { "repo": "github/github-mcp-server", "files_total": 403, "files_scanned": 403, "files_binary_skipped": 0, "files_size_skipped": 0, "findings_total": 273, "findings_real": 47, "high": 0, "medium": 6, "verdict": "REVIEW", "rules": { "HB310": 6, "HB602": 225, "HB403": 7, "HB105": 1, "HB503": 11, "HB201": 1, "HB311": 21, "HB101": 1 }, "notable": [ { "rule": "HB403", "family": "Execution & exfiltration", "severity": "medium", "file": ".github/workflows/issue-triage.lock.yml", "line": 1750, "snippet": "run: rm -rf /tmp/gh-aw/sandbox/agent/logs/copilot-session-state", "note": "", "likely_doc": false }, { "rule": "HB403", "family": "Execution & exfiltration", "severity": "medium", "file": ".github/workflows/issue-triage.lock.yml", "line": 1753, "snippet": "rm -rf /tmp/gh-aw/sandbox/firewall/logs", "note": "", "likely_doc": false }, { "rule": "HB403", "family": "Execution & exfiltration", "severity": "medium", "file": ".github/workflows/issue-triage.lock.yml", "line": 1754, "snippet": "rm -rf /tmp/gh-aw/sandbox/firewall/audit", "note": "", "likely_doc": false }, { "rule": "HB403", "family": "Execution & exfiltration", "severity": "medium", "file": ".github/workflows/pr-triage.lock.yml", "line": 1693, "snippet": "run: rm -rf /tmp/gh-aw/sandbox/agent/logs/copilot-session-state", "note": "", "likely_doc": false }, { "rule": "HB403", "family": "Execution & exfiltration", "severity": "medium", "file": ".github/workflows/pr-triage.lock.yml", "line": 1696, "snippet": "rm -rf /tmp/gh-aw/sandbox/firewall/logs", "note": "", "likely_doc": false }, { "rule": "HB403", "family": "Execution & exfiltration", "severity": "medium", "file": ".github/workflows/pr-triage.lock.yml", "line": 1697, "snippet": "rm -rf /tmp/gh-aw/sandbox/firewall/audit", "note": "", "likely_doc": false } ] }, { "repo": "geelen/mcp-remote", "files_total": 63, "files_scanned": 63, "files_binary_skipped": 0, "files_size_skipped": 0, "findings_total": 257, "findings_real": 35, "high": 0, "medium": 8, "verdict": "REVIEW", "rules": { "HB602": 196, "HB503": 6, "HB310": 52, "HB403": 3 }, "notable": [ { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "src/lib/client-credentials.ts", "line": 50, "snippet": "if (!clientInformation.client_secret) {", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "src/lib/device-authorization.ts", "line": 208, "snippet": "if (method === 'client_secret_basic') {", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "src/lib/device-authorization.ts", "line": 209, "snippet": "if (!client_secret) throw new Error('client_secret_basic authentication requires a client_secret')", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "src/lib/device-authorization.ts", "line": 214, "snippet": "if (method === 'client_secret_post') {", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "src/lib/device-authorization.ts", "line": 216, "snippet": "if (client_secret) params.set('client_secret', client_secret)", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "src/lib/node-oauth-client-provider.ts", "line": 224, "snippet": "const TOKEN_ENDPOINT_AUTH_METHOD_PREFERENCE = ['none', 'client_secret_post', 'client_secret_basic']", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "src/lib/node-oauth-client-provider.ts", "line": 503, "snippet": "if (!clientInformation?.client_secret) {", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "src/lib/node-oauth-client-provider.ts", "line": 610, "snippet": "* gets. RFC 8414's `client_secret_basic` default describes servers that publish metadata; one", "note": "", "likely_doc": false } ] }, { "repo": "Cloudflare/mcp-server-cloudflare", "files_total": 422, "files_scanned": 422, "files_binary_skipped": 0, "files_size_skipped": 0, "findings_total": 564, "findings_real": 341, "high": 0, "medium": 37, "verdict": "REVIEW", "rules": { "HB602": 449, "HB310": 85, "HB501": 9, "HB503": 20, "HB403": 1 }, "notable": [ { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "apps/ai-gateway/src/ai-gateway.context.ts", "line": 8, "snippet": "CLOUDFLARE_CLIENT_SECRET: string", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "apps/auditlogs/src/auditlogs.context.ts", "line": 9, "snippet": "CLOUDFLARE_CLIENT_SECRET: string", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "apps/autorag/src/autorag.context.ts", "line": 8, "snippet": "CLOUDFLARE_CLIENT_SECRET: string", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "apps/browser-rendering/src/browser.context.ts", "line": 8, "snippet": "CLOUDFLARE_CLIENT_SECRET: string", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "apps/cloudflare-one-casb/src/cf1-casb.context.ts", "line": 10, "snippet": "CLOUDFLARE_CLIENT_SECRET: string", "note": "", "likely_doc": false }, { "rule": "HB503", "family": "MCP config", "severity": "medium", "file": "apps/demo-day/frontend/index.html", "line": 109, "snippet": "xmlns=\"http://www.w3.org/2000/svg\"", "note": "plain-HTTP remote (no TLS)", "likely_doc": false }, { "rule": "HB503", "family": "MCP config", "severity": "medium", "file": "apps/demo-day/frontend/index.html", "line": 144, "snippet": "xmlns=\"http://www.w3.org/2000/svg\"", "note": "plain-HTTP remote (no TLS)", "likely_doc": false }, { "rule": "HB503", "family": "MCP config", "severity": "medium", "file": "apps/demo-day/frontend/index.html", "line": 276, "snippet": "xmlns=\"http://www.w3.org/2000/svg\"", "note": "plain-HTTP remote (no TLS)", "likely_doc": false }, { "rule": "HB503", "family": "MCP config", "severity": "medium", "file": "apps/demo-day/frontend/index.html", "line": 311, "snippet": "xmlns=\"http://www.w3.org/2000/svg\"", "note": "plain-HTTP remote (no TLS)", "likely_doc": false }, { "rule": "HB503", "family": "MCP config", "severity": "medium", "file": "apps/demo-day/frontend/index.html", "line": 346, "snippet": "xmlns=\"http://www.w3.org/2000/svg\"", "note": "plain-HTTP remote (no TLS)", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "apps/dex-analysis/src/dex-analysis.context.ts", "line": 10, "snippet": "CLOUDFLARE_CLIENT_SECRET: string", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "apps/dns-analytics/src/dns-analytics.context.ts", "line": 8, "snippet": "CLOUDFLARE_CLIENT_SECRET: string", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "apps/dns-analytics/src/dns-analytics.context.ts", "line": 11, "snippet": "SENTRY_ACCESS_CLIENT_SECRET: string", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "apps/docs-ai-search/src/docs-ai-search.context.ts", "line": 7, "snippet": "SENTRY_ACCESS_CLIENT_SECRET: string", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "apps/graphql/src/graphql.context.ts", "line": 8, "snippet": "CLOUDFLARE_CLIENT_SECRET: string", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "apps/graphql/src/graphql.context.ts", "line": 11, "snippet": "SENTRY_ACCESS_CLIENT_SECRET: string", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "apps/logpush/src/logpush.context.ts", "line": 8, "snippet": "CLOUDFLARE_CLIENT_SECRET: string", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "apps/radar/src/radar.context.ts", "line": 8, "snippet": "CLOUDFLARE_CLIENT_SECRET: string", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "apps/sandbox-container/server/sandbox.server.context.ts", "line": 8, "snippet": "CLOUDFLARE_CLIENT_SECRET: string", "note": "", "likely_doc": false }, { "rule": "HB403", "family": "Execution & exfiltration", "severity": "medium", "file": "apps/sandbox-container/server/sandboxTemplate.ts", "line": 19, "snippet": "rm -rf /var/lib/apt/lists/*", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "apps/sandbox-container/worker-configuration.d.ts", "line": 61, "snippet": "| 'CLOUDFLARE_CLIENT_SECRET'", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "apps/workers-bindings/src/bindings.context.ts", "line": 8, "snippet": "CLOUDFLARE_CLIENT_SECRET: string", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "apps/workers-builds/src/workers-builds.context.ts", "line": 8, "snippet": "CLOUDFLARE_CLIENT_SECRET: string", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "apps/workers-builds/src/workers-builds.context.ts", "line": 11, "snippet": "SENTRY_ACCESS_CLIENT_SECRET: string", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "apps/workers-observability/src/workers-observability.context.ts", "line": 8, "snippet": "CLOUDFLARE_CLIENT_SECRET: string", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "apps/workers-observability/src/workers-observability.context.ts", "line": 11, "snippet": "SENTRY_ACCESS_CLIENT_SECRET: string", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/mcp-common/src/cloudflare-auth.ts", "line": 161, "snippet": "client_secret,", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/mcp-common/src/cloudflare-auth.ts", "line": 167, "snippet": "client_secret: string", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/mcp-common/src/cloudflare-auth.ts", "line": 201, "snippet": "client_secret,", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/mcp-common/src/cloudflare-auth.ts", "line": 205, "snippet": "client_secret: string", "note": "", "likely_doc": false } ] }, { "repo": "mongodb-js/mongodb-mcp-server", "files_total": 792, "files_scanned": 792, "files_binary_skipped": 0, "files_size_skipped": 0, "findings_total": 646, "findings_real": 237, "high": 0, "medium": 23, "verdict": "REVIEW", "rules": { "HB310": 97, "HB602": 535, "HB105": 2, "HB503": 5, "HB402": 2, "HB311": 4, "HB101": 1 }, "notable": [ { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/accuracy-tests/src/sdk/describeAccuracyTests.ts", "line": 92, "snippet": "apiClientSecret: process.env.MDB_API_CLIENT_SECRET,", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/atlas-api-client/src/auth/clientCredentials.ts", "line": 29, "snippet": "token_endpoint_auth_methods_supported: [\"client_secret_basic\"],", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/e2e-tests/src/utils/useAtlasApiAgent.ts", "line": 10, "snippet": "const ATLAS_CLIENT_SECRET = process.env.AGENT_E2E_ATLAS_CLIENT_SECRET ?? \"\";", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/e2e-tests/src/utils/useAtlasApiAgent.ts", "line": 16, "snippet": "return !!ATLAS_CLIENT_ID && !!ATLAS_CLIENT_SECRET;", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/e2e-tests/src/utils/useAtlasApiAgent.ts", "line": 60, "snippet": "apiClientSecret: ATLAS_CLIENT_SECRET,", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/e2e-tests/src/utils/useRemoteAtlasMcpAgent.ts", "line": 15, "snippet": "const REMOTE_MCP_CLIENT_SECRET = process.env.AGENT_E2E_MCP_CLIENT_SECRET ?? \"\";", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/e2e-tests/src/utils/useRemoteAtlasMcpAgent.ts", "line": 23, "snippet": "return !!REMOTE_MCP_CLIENT_ID && !!REMOTE_MCP_CLIENT_SECRET;", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/e2e-tests/src/utils/useRemoteAtlasMcpAgent.ts", "line": 56, "snippet": "MDB_MCP_API_CLIENT_SECRET: REMOTE_MCP_CLIENT_SECRET,", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/integration-tests/src/tools/atlas/atlasHelpers.ts", "line": 28, "snippet": "!process.env.MDB_MCP_API_CLIENT_ID?.length || !process.env.MDB_MCP_API_CLIENT_SECRET?.length", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/integration-tests/src/tools/atlas/atlasHelpers.ts", "line": 36, "snippet": "apiClientSecret: process.env.MDB_MCP_API_CLIENT_SECRET || \"test-secret\",", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/integration-tests/src/tools/atlas/atlasHelpers.ts", "line": 47, "snippet": "!process.env.MDB_MCP_API_CLIENT_ID?.length || !process.env.MDB_MCP_API_CLIENT_SECRET?.length", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/integration-tests/src/tools/atlas/atlasHelpers.ts", "line": 55, "snippet": "apiClientSecret: process.env.MDB_MCP_API_CLIENT_SECRET || \"test-secret\",", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/integration-tests/src/tools/atlas/atlasHelpers.ts", "line": 90, "snippet": "!process.env.MDB_MCP_API_CLIENT_ID?.length || !process.env.MDB_MCP_API_CLIENT_SECRET?.length", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/integration-tests/src/tools/atlas/atlasHelpers.ts", "line": 330, "snippet": "\"MDB_MCP_API_CLIENT_ID / MDB_MCP_API_CLIENT_SECRET configured so that streamsGlobalSetup.ts \" +", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/integration-tests/src/tools/atlas/streamsGlobalSetup.ts", "line": 29, "snippet": "if (!process.env.MDB_MCP_API_CLIENT_ID?.length || !process.env.MDB_MCP_API_CLIENT_SECRET?.length) {", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/integration-tests/src/tools/atlas/streamsGlobalSetup.ts", "line": 70, "snippet": "clientSecret: process.env.MDB_MCP_API_CLIENT_SECRET || \"\",", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/mongodb-atlas-mcp-remote/src/config.ts", "line": 41, "snippet": "const clientSecret = process.env.MDB_MCP_API_CLIENT_SECRET;", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/mongodb-atlas-mcp-remote/src/config.ts", "line": 43, "snippet": "errors.push(\"MDB_MCP_API_CLIENT_SECRET is required\");", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/mongodb-mcp-server/packaging/mcpb/manifest.json", "line": 75, "snippet": "\"atlas_client_secret\": {", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/mongodb-mcp-server/server.json", "line": 48, "snippet": "\"name\": \"MDB_MCP_API_CLIENT_SECRET\",", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/mongodb-mcp-server/server.json", "line": 759, "snippet": "\"name\": \"MDB_MCP_API_CLIENT_SECRET\",", "note": "", "likely_doc": false }, { "rule": "HB310", "family": "Secrets", "severity": "medium", "file": "packages/setup/src/setupMcpServer.ts", "line": 38, "snippet": "env.MDB_MCP_API_CLIENT_SECRET = serviceWorkerSecret;", "note": "", "likely_doc": false }, { "rule": "HB101", "family": "Hidden content", "severity": "medium", "file": "packages/ui/src/lib/tools/list-databases.ts", "line": 7, "snippet": "‌ (+6 hidden chars total)", "note": "zero-width=6 bidi=0 tags=0", "likely_doc": false } ] }, { "repo": "modelcontextprotocol/servers", "files_total": 365, "files_scanned": 364, "files_binary_skipped": 0, "files_size_skipped": 1, "findings_total": 146, "findings_real": 14, "high": 0, "medium": 3, "verdict": "REVIEW", "rules": { "HB602": 83, "HB501": 38, "HB503": 23, "HB105": 1, "HB310": 1 }, "notable": [ { "rule": "HB501", "family": "MCP config", "severity": "medium", "file": ".github/ISSUE_TEMPLATE/1-bug_report.yml", "line": 70, "snippet": "- uvx or pip (PyPI package)", "note": "", "likely_doc": false }, { "rule": "HB503", "family": "MCP config", "severity": "medium", "file": "src/everything/server/icons.ts", "line": 37, "snippet": "`