← Back to search

@caelo-cms/mcp-server

GitHub Actions Scanned 24d ago

MCP server exposing the Caelo CMS chat-runner as a `caelo_chat` tool. Lets Claude Code (or any MCP-aware client) drive a Caelo install from outside the browser.

npm ↗
? Not scanned yet

Versions

No versions found.

Tools 0

No tools indexed yet.

Permissions 5

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs
shell high
Server uses shell capabilities via: child_process, spawn(), spawnSync()
database medium
Server uses database capabilities via: drizzle-orm
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 59

high
Hardcoded OAuth client ID in caelo-cms-caelo-cms-0bcf119/packages/admin-core/src/ai/__tests__/tool-search-dangling-replay.test.ts auth_checker · 85%
high
Hardcoded OAuth client ID in caelo-cms-caelo-cms-0bcf119/packages/admin-core/src/ai/__tests__/tool-search-deferred-fixture.test.ts auth_checker · 85%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Excessive dependency count: 94 direct dependencies dependency_analyzer · 90%
medium
Vulnerable dependency: js-yaml@4.3.0 (GHSA-2883-xcg3-v3hh) dependency_analyzer · 95%
medium
Vulnerable dependency: js-yaml@4.3.0 (GHSA-5p4m-2wfm-xmqj) dependency_analyzer · 95%
medium
Vulnerable dependency: dompurify@3 (GHSA-39q2-94rc-95cp) dependency_analyzer · 95%
medium
Vulnerable dependency: dompurify@3 (GHSA-55q2-fjhq-7xh7) dependency_analyzer · 95%
medium
Vulnerable dependency: dompurify@3 (GHSA-76mc-f452-cxcm) dependency_analyzer · 95%
medium
Vulnerable dependency: dompurify@3 (GHSA-c2j3-45gr-mqc4) dependency_analyzer · 95%
medium
Vulnerable dependency: dompurify@3 (GHSA-cj63-jhhr-wcxv) dependency_analyzer · 95%
medium
Vulnerable dependency: dompurify@3 (GHSA-cjmm-f4jc-qw8r) dependency_analyzer · 95%
medium
Vulnerable dependency: dompurify@3 (GHSA-cmwh-pvxp-8882) dependency_analyzer · 95%
medium
Vulnerable dependency: dompurify@3 (GHSA-crv5-9vww-q3g8) dependency_analyzer · 95%
medium
Vulnerable dependency: dompurify@3 (GHSA-gvmj-g25r-r7wr) dependency_analyzer · 95%
medium
Vulnerable dependency: dompurify@3 (GHSA-gx9m-whjm-85jf) dependency_analyzer · 95%
medium
Vulnerable dependency: dompurify@3 (GHSA-h7mw-gpvr-xq4m) dependency_analyzer · 95%
medium
Vulnerable dependency: dompurify@3 (GHSA-h8r8-wccr-v5f2) dependency_analyzer · 95%
medium
Vulnerable dependency: dompurify@3 (GHSA-hpcv-96wg-7vj8) dependency_analyzer · 95%
medium
Vulnerable dependency: dompurify@3 (GHSA-mmhx-hmjr-r674) dependency_analyzer · 95%
medium
Vulnerable dependency: dompurify@3 (GHSA-r47g-fvhr-h676) dependency_analyzer · 95%
medium
Vulnerable dependency: dompurify@3 (GHSA-rp9w-3fw7-7cwq) dependency_analyzer · 95%
medium
Vulnerable dependency: dompurify@3 (GHSA-vhxf-7vqr-mrjg) dependency_analyzer · 95%
medium
Vulnerable dependency: dompurify@3 (GHSA-vxr8-fq34-vvx9) dependency_analyzer · 95%
medium
Vulnerable dependency: dompurify@3 (GHSA-x4vx-rjvf-j5p4) dependency_analyzer · 95%
medium
Vulnerable dependency: file-type@21 (GHSA-5v7r-6r5c-r473) dependency_analyzer · 95%
medium
Vulnerable dependency: file-type@21 (GHSA-j47w-4g3g-c36v) dependency_analyzer · 95%
medium
Vulnerable dependency: marked@18 (GHSA-6v9c-7cg6-27q7) dependency_analyzer · 95%
medium
Vulnerable dependency: sharp@0.35 (GHSA-rgj7-g3m4-5g8c) dependency_analyzer · 95%
medium
Hex string literal (>50 chars) in caelo-cms-caelo-cms-0bcf119/packages/plugin-sandbox/src/manifest.ts:65 entropy_analyzer · 70%
medium
Buffer.from base64 in caelo-cms-caelo-cms-0bcf119/packages/admin-core/src/ai/chat-runner/tool-dispatch.ts:132 entropy_analyzer · 75%
medium
Buffer.from base64 in caelo-cms-caelo-cms-0bcf119/packages/admin-core/src/ai/providers/anthropic.ts:183 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (110) manifest_parser · 80%
medium
Hardcoded OAuth client ID in caelo-cms-caelo-cms-0bcf119/packages/admin-core/src/ai/__tests__/tool-search-dangling-replay.test.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in caelo-cms-caelo-cms-0bcf119/packages/admin-core/src/ai/__tests__/tool-search-deferred-fixture.test.ts oauth_scope_analyzer · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
medium
Permission: database access detected permission_analyzer · 80%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 77 components sbom_generator · 100%
high
Hardcoded Password found in caelo-cms-caelo-cms-0bcf119/apps/admin/e2e-livedit/helpers.ts secret_scanner · 65%
high
Hardcoded Password found in caelo-cms-caelo-cms-0bcf119/apps/admin/e2e/content-reviewer-readonly.browser.ts secret_scanner · 65%
high
Hardcoded Password found in caelo-cms-caelo-cms-0bcf119/apps/admin/e2e/setup-login.browser.ts secret_scanner · 65%
high
Hardcoded Password found in caelo-cms-caelo-cms-0bcf119/apps/admin/e2e/password-reset.browser.ts secret_scanner · 65%
high
Hardcoded Password found in caelo-cms-caelo-cms-0bcf119/apps/admin/e2e/_seed.ts secret_scanner · 65%
critical
Database URL with Password found in caelo-cms-caelo-cms-0bcf119/packages/provisioning/src/compose.ts secret_scanner · 85%
critical
Database URL with Password found in caelo-cms-caelo-cms-0bcf119/packages/provisioning/stacks/gcp-firebase/index.ts secret_scanner · 85%
critical
Database URL with Password found in caelo-cms-caelo-cms-0bcf119/packages/provisioning/src/wizards/gcp.ts secret_scanner · 85%
critical
Database URL with Password found in caelo-cms-caelo-cms-0bcf119/.github/workflows/e2e-livedit.yml secret_scanner · 85%
critical
Database URL with Password found in caelo-cms-caelo-cms-0bcf119/.github/workflows/ci.yml secret_scanner · 85%
critical
Database URL with Password found in caelo-cms-caelo-cms-0bcf119/.github/workflows/release.yml secret_scanner · 85%
high
Hardcoded Password found in caelo-cms-caelo-cms-0bcf119/plans/phases/phase_16_ai_providers_cost_obs.md secret_scanner · 65%
high
Hardcoded Password found in caelo-cms-caelo-cms-0bcf119/plans/phases/phase_1_db_query_api.md secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%