← Back to search

@civic/auth-mcp

civicteam Scanned 22d ago

Civic Auth integration for MCP servers

npm ↗
B
78.3 / 100

Versions

0.5.0latest
Jun 29, 2026
0.4.0
Jun 12, 2026
0.3.1
Mar 26, 2026
0.3.0
Mar 17, 2026
0.3.0-beta.0
Mar 17, 2026
+ show 37 moreshow less
0.2.9
Mar 11, 2026
0.2.8
Dec 3, 2025
0.2.7
Oct 26, 2025
0.2.6
Sep 12, 2025
0.2.5
Sep 9, 2025
0.2.4
Sep 8, 2025
0.2.3
Sep 7, 2025
0.2.3-alpha.0
Jul 18, 2025
0.2.2
Jul 17, 2025
0.2.2-beta.1
Jul 7, 2025
0.2.2-alpha.0
Jul 1, 2025
0.2.1
Jun 24, 2025
0.2.1-alpha.4
Jun 24, 2025
0.2.1-alpha.3
Jun 24, 2025
0.2.1-alpha.2
Jun 24, 2025
0.2.1-alpha.1
Jun 24, 2025
0.2.0-alpha.1
Jun 24, 2025
0.2.0
Jun 18, 2025
0.1.16
Jun 12, 2025
0.1.15
Jun 11, 2025
0.1.14
Jun 5, 2025
0.1.13
Jun 4, 2025
0.1.12
Jun 4, 2025
0.1.11
Jun 2, 2025
0.1.10
Jun 2, 2025
0.1.9
May 29, 2025
0.1.8
May 29, 2025
0.1.7
May 29, 2025
0.1.6
May 26, 2025
0.1.5
May 26, 2025
0.1.4
May 26, 2025
0.1.3
May 26, 2025
0.1.2
May 25, 2025
0.1.1
May 24, 2025
0.1.0
May 23, 2025
0.0.2
May 22, 2025
0.0.1
May 22, 2025
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 1

whoami
annotations: none low

Get information about the current user

Permissions 3

network medium
Server uses network capabilities via: fetch()
shell high
Server uses shell capabilities via: child_process
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 19

low
Tool 'whoami' has no annotations annotation_checker · 100%
high
Hardcoded OAuth client ID in civicteam-auth-mcp-2727d97/library/src/constants.ts auth_checker · 85%
high
Hardcoded OAuth client secret in civicteam-auth-mcp-2727d97/library/src/legacy/OAuthProxyHandler.test.ts auth_checker · 95%
high
Hardcoded OAuth client ID in civicteam-auth-mcp-2727d97/library/src/integration/jwks-direct.test.ts auth_checker · 85%
high
Hardcoded OAuth client secret in civicteam-auth-mcp-2727d97/library/src/client/providers/CLIAuthProvider.test.ts auth_checker · 95%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
info
package.json metadata manifest_parser · 100%
info
Tool: whoami manifest_parser · 70%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (4) manifest_parser · 80%
medium
Hardcoded OAuth client ID in civicteam-auth-mcp-2727d97/library/src/constants.ts oauth_scope_analyzer · 80%
high
Deprecated implicit grant flow in civicteam-auth-mcp-2727d97/library/src/legacy/OAuthProxyHandler.test.ts oauth_scope_analyzer · 85%
medium
Hardcoded OAuth client ID in civicteam-auth-mcp-2727d97/library/src/integration/jwks-direct.test.ts oauth_scope_analyzer · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 23 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%