← Back to search

@forestadmin/mcp-server

GitHub Actions Scanned 5d ago

Model Context Protocol server for Forest Admin with OAuth authentication

npm ↗
D
40 / 100

Versions

1.20.1latest
Jul 30, 2026
1.20.0
Jul 29, 2026
1.19.1
Jul 24, 2026
1.19.0
Jul 24, 2026
1.18.1
Jul 23, 2026
+ show 74 moreshow less
1.18.0
Jul 22, 2026
1.17.3
Jul 16, 2026
1.17.2
Jul 8, 2026
1.17.1
Jul 7, 2026
1.17.0
Jul 6, 2026
1.16.0
Jul 3, 2026
1.15.1
Jul 1, 2026
1.15.0
Jun 29, 2026
1.14.1
Jun 26, 2026
1.14.0
Jun 25, 2026
1.13.0
Jun 16, 2026
1.12.3
Jun 11, 2026
1.12.2
Jun 10, 2026
1.12.1
Jun 10, 2026
1.12.0
Jun 9, 2026
1.11.11
May 20, 2026
1.11.10
May 20, 2026
1.11.9
May 11, 2026
1.11.8
May 5, 2026
1.11.7
Apr 30, 2026
1.11.6
Apr 24, 2026
1.11.5
Apr 22, 2026
1.11.4
Apr 22, 2026
1.11.3
Apr 21, 2026
1.11.2
Apr 20, 2026
1.11.1
Apr 20, 2026
1.11.0
Apr 17, 2026
1.10.0
Apr 17, 2026
2.0.0
Apr 14, 2026
1.9.1
Apr 14, 2026
1.9.0
Apr 13, 2026
1.8.17
Apr 10, 2026
1.8.16
Apr 10, 2026
1.8.15
Apr 10, 2026
1.8.14
Apr 8, 2026
1.8.13
Apr 1, 2026
1.8.12
Mar 31, 2026
1.8.11
Mar 31, 2026
1.8.10
Mar 31, 2026
1.8.9
Mar 18, 2026
1.8.8
Mar 4, 2026
1.8.7
Feb 25, 2026
1.8.6
Feb 24, 2026
1.8.5
Feb 20, 2026
1.8.4
Feb 17, 2026
1.8.3
Feb 13, 2026
1.8.2
Feb 12, 2026
1.8.1
Feb 12, 2026
1.8.0
Feb 11, 2026
1.7.7
Feb 10, 2026
1.7.6
Feb 6, 2026
1.7.5
Feb 5, 2026
1.7.4
Feb 3, 2026
1.7.3
Feb 3, 2026
1.7.2
Jan 27, 2026
1.7.1
Jan 22, 2026
1.7.0
Jan 20, 2026
1.6.2
Jan 19, 2026
1.6.1
Jan 14, 2026
1.6.0
Jan 13, 2026
1.5.5
Jan 12, 2026
1.5.4
Jan 12, 2026
1.5.3
Jan 9, 2026
1.5.2
Jan 9, 2026
1.5.1
Jan 6, 2026
1.5.0
Dec 24, 2025
1.4.0
Dec 24, 2025
1.3.0
Dec 24, 2025
1.2.1
Dec 23, 2025
1.2.0
Dec 23, 2025
1.1.0
Dec 23, 2025
1.0.1
Dec 19, 2025
1.0.0
Dec 18, 2025
0.1.0
Dec 18, 2025
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 4

fake
annotations: none low

add
annotations: none low

listUsers
annotations: none low

listArticles
annotations: none low

Permissions 4

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, fs/promises, path
shell high
Server uses shell capabilities via: child_process, spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 81

medium
Vulnerable dependency: koa@3.0.1 (GHSA-7gcc-r8m5-44qm) dependency_analyzer · 95%
medium
Vulnerable dependency: koa@3.0.1 (GHSA-g8mr-fgfg-5qpc) dependency_analyzer · 95%
low
Tool 'fake' has no annotations annotation_checker · 100%
low
Tool 'add' has no annotations annotation_checker · 100%
low
Tool 'listUsers' has no annotations annotation_checker · 100%
low
Tool 'listArticles' has no annotations annotation_checker · 100%
high
Hardcoded OAuth client secret in ForestAdmin-agent-nodejs-8e14caa/packages/workflow-executor/test/http/mcp-oauth-credentials.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in ForestAdmin-agent-nodejs-8e14caa/packages/workflow-executor/test/http/mcp-oauth-credentials-route.test.ts auth_checker · 95%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Excessive dependency count: 176 direct dependencies dependency_analyzer · 90%
medium
Vulnerable dependency: express@4.18.2 (GHSA-qw6h-vgh9-j6wx) dependency_analyzer · 95%
medium
Vulnerable dependency: express@4.18.2 (GHSA-rv95-896h-c2vc) dependency_analyzer · 95%
medium
Vulnerable dependency: fastify@3.29.0 (GHSA-3fjj-p79j-c9hh) dependency_analyzer · 95%
medium
Vulnerable dependency: fastify@3.29.0 (GHSA-444r-cwp2-x5xf) dependency_analyzer · 95%
medium
Vulnerable dependency: fastify@3.29.0 (GHSA-jx2c-rxcm-jvmq) dependency_analyzer · 95%
medium
Vulnerable dependency: fastify@3.29.0 (GHSA-mrq3-vjjr-p77c) dependency_analyzer · 95%
medium
Vulnerable dependency: mysql2@3.0.1 (GHSA-49j4-86m8-q2jw) dependency_analyzer · 95%
medium
Vulnerable dependency: mysql2@3.0.1 (GHSA-4rch-2fh8-94vw) dependency_analyzer · 95%
medium
Vulnerable dependency: mysql2@3.0.1 (GHSA-fpw7-j2hg-69v5) dependency_analyzer · 95%
medium
Vulnerable dependency: mysql2@3.0.1 (GHSA-mqr2-w7wj-jjgr) dependency_analyzer · 95%
medium
Vulnerable dependency: mysql2@3.0.1 (GHSA-pmh2-wpjm-fj45) dependency_analyzer · 95%
medium
Vulnerable dependency: sqlite3@5.1.4 (GHSA-jqv5-7xpx-qj74) dependency_analyzer · 95%
medium
Vulnerable dependency: @fastify/express@1.1.0 (GHSA-6hw5-45gm-fj88) dependency_analyzer · 95%
medium
Vulnerable dependency: @fastify/express@1.1.0 (GHSA-g6q3-96cp-5r5m) dependency_analyzer · 95%
medium
Vulnerable dependency: @fastify/express@1.1.0 (GHSA-hrwm-hgmj-7p9c) dependency_analyzer · 95%
medium
Vulnerable dependency: ws@8.20.1 (GHSA-96hv-2xvq-fx4p) dependency_analyzer · 95%
medium
Vulnerable dependency: @babel/core@7.26.10 (GHSA-4x5r-pxfx-6jf8) dependency_analyzer · 95%
medium
Hex string literal (>50 chars) in ForestAdmin-agent-nodejs-8e14caa/packages/agent-testing/test/sandbox-with-real-agent.test.ts:10 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in ForestAdmin-agent-nodejs-8e14caa/packages/agent-testing/src/index.ts:110 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in ForestAdmin-agent-nodejs-8e14caa/packages/agent-testing/example/test/test-any-agent-setup.test.ts:19 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in ForestAdmin-agent-nodejs-8e14caa/packages/agent-testing/example/test/test-any-agent-setup.test.ts:20 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in ForestAdmin-agent-nodejs-8e14caa/packages/agent-testing/example/test/test-any-agent-setup.test.ts:27 entropy_analyzer · 70%
medium
Buffer.from base64 in ForestAdmin-agent-nodejs-8e14caa/packages/datasource-customizer/test/decorators/binary/collection.test.ts:267 entropy_analyzer · 75%
medium
Buffer.from base64 in ForestAdmin-agent-nodejs-8e14caa/packages/datasource-customizer/test/decorators/binary/collection.test.ts:343 entropy_analyzer · 75%
medium
Buffer.from base64 in ForestAdmin-agent-nodejs-8e14caa/packages/datasource-customizer/test/decorators/binary/collection.test.ts:368 entropy_analyzer · 75%
medium
Buffer.from base64 in ForestAdmin-agent-nodejs-8e14caa/packages/datasource-customizer/test/decorators/binary/collection.test.ts:386 entropy_analyzer · 75%
medium
Buffer.from base64 in ForestAdmin-agent-nodejs-8e14caa/packages/datasource-customizer/test/decorators/binary/collection.test.ts:417 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in ForestAdmin-agent-nodejs-8e14caa/packages/forestadmin-client/test/__factories__/forest-admin-client-options.ts:6 entropy_analyzer · 70%
medium
Buffer.from base64 in ForestAdmin-agent-nodejs-8e14caa/packages/agent-bff/test/oauth/token-cipher.test.ts:30 entropy_analyzer · 75%
medium
Buffer.from base64 in ForestAdmin-agent-nodejs-8e14caa/packages/agent-bff/test/oauth/token-cipher.test.ts:54 entropy_analyzer · 75%
medium
Buffer.from base64 in ForestAdmin-agent-nodejs-8e14caa/packages/agent-bff/src/oauth/token-cipher.ts:18 entropy_analyzer · 75%
medium
Buffer.from base64 in ForestAdmin-agent-nodejs-8e14caa/packages/agent-bff/src/config/env-config.ts:71 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in ForestAdmin-agent-nodejs-8e14caa/packages/agent/test/utils/http-driver-options.test.ts:6 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in ForestAdmin-agent-nodejs-8e14caa/packages/agent/test/__factories__/forest-admin-http-driver-options.ts:10 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in ForestAdmin-agent-nodejs-8e14caa/packages/workflow-executor/test/crypto/credential-encryption.test.ts:190 entropy_analyzer · 70%
medium
Buffer.from base64 in ForestAdmin-agent-nodejs-8e14caa/packages/datasource-toolkit/src/utils/data-uri.ts:49 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in ForestAdmin-agent-nodejs-8e14caa/packages/forest-cloud/test/services/http-server.unit.test.ts:244 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in ForestAdmin-agent-nodejs-8e14caa/packages/forest-cloud/test/services/http-server.unit.test.ts:279 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in ForestAdmin-agent-nodejs-8e14caa/packages/forest-cloud/test/commands/bootstrap.test.ts:63 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in ForestAdmin-agent-nodejs-8e14caa/packages/forest-cloud/test/commands/bootstrap.test.ts:119 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in ForestAdmin-agent-nodejs-8e14caa/packages/forest-cloud/test/commands/bootstrap.test.ts:151 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in ForestAdmin-agent-nodejs-8e14caa/packages/forest-cloud/test/commands/bootstrap.test.ts:201 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in ForestAdmin-agent-nodejs-8e14caa/packages/forest-cloud/test/commands/bootstrap.test.ts:228 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in ForestAdmin-agent-nodejs-8e14caa/packages/forest-cloud/test/commands/start.test.ts:38 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in ForestAdmin-agent-nodejs-8e14caa/packages/forest-cloud/test/commands/logs.test.ts:76 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in ForestAdmin-agent-nodejs-8e14caa/packages/forest-cloud/test/commands/utils.ts:34 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in ForestAdmin-agent-nodejs-8e14caa/packages/forest-cloud/test/commands/utils.ts:60 entropy_analyzer · 70%
medium
Buffer.from base64 in ForestAdmin-agent-nodejs-8e14caa/packages/forest-cloud/src/services/publish.ts:10 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: fake manifest_parser · 85%
info
Tool: add manifest_parser · 75%
info
Tool: listUsers manifest_parser · 70%
info
Tool: listArticles manifest_parser · 70%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (44) manifest_parser · 80%
high
Deprecated implicit grant flow in ForestAdmin-agent-nodejs-8e14caa/packages/agent-bff/test/oauth/oauth-routes.test.ts oauth_scope_analyzer · 85%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 168 components sbom_generator · 100%
critical
Database URL with Password found in ForestAdmin-agent-nodejs-8e14caa/packages/_example/README.md secret_scanner · 85%
critical
Database URL with Password found in ForestAdmin-agent-nodejs-8e14caa/packages/datasource-mongoose/CLAUDE.md secret_scanner · 85%
critical
Database URL with Password found in ForestAdmin-agent-nodejs-8e14caa/packages/_example/src/connections/mongoose.ts secret_scanner · 85%
critical
Database URL with Password found in ForestAdmin-agent-nodejs-8e14caa/packages/_example/src/connections/sequelize-postgres.ts secret_scanner · 85%
critical
Database URL with Password found in ForestAdmin-agent-nodejs-8e14caa/packages/_example/src/connections/sequelize-mysql.ts secret_scanner · 85%
high
Hardcoded Password found in ForestAdmin-agent-nodejs-8e14caa/packages/_example/src/forest/agent.ts secret_scanner · 65%
critical
Database URL with Password found in ForestAdmin-agent-nodejs-8e14caa/packages/workflow-executor/example/.env.executors.example secret_scanner · 85%
critical
Database URL with Password found in ForestAdmin-agent-nodejs-8e14caa/packages/forest-cloud/src/services/generate-datasource-config-file.ts secret_scanner · 85%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%