← Back to search

@huggingface/mcp-client

huggingface MIT 2,415 stars Scanned 4d ago

Client for the Model Context Protocol

npm ↗
? Not scanned yet

Versions

inference-v4.13.17latest
May 20, 2026
inference-v4.13.16
May 20, 2026
tasks-v0.21.1
May 19, 2026
tasks-v0.21.0
May 13, 2026
hub-v2.12.0
May 13, 2026
+ show 51 moreshow less
tasks-v0.20.25
May 12, 2026
jinja-v0.5.9
May 8, 2026
hub-v2.11.2
May 8, 2026
xetchunk-wasm-v0.0.6
May 8, 2026
hub-v2.11.1
May 7, 2026
tasks-v0.20.24
May 7, 2026
tasks-v0.20.23
May 5, 2026
tasks-v0.20.22
Apr 27, 2026
jinja-v0.5.8
Apr 24, 2026
tasks-v0.20.21
Apr 24, 2026
tasks-v0.20.20
Apr 23, 2026
tasks-v0.20.19
Apr 23, 2026
tasks-v0.20.18
Apr 22, 2026
tasks-v0.20.17
Apr 21, 2026
ollama-utils-v0.0.18
Apr 16, 2026
tasks-v0.20.16
Apr 16, 2026
jinja-v0.5.7
Apr 16, 2026
tasks-v0.20.15
Apr 15, 2026
tasks-v0.20.14
Apr 13, 2026
tasks-v0.20.13
Apr 9, 2026
gguf-v0.4.2
Apr 8, 2026
tasks-v0.20.12
Apr 3, 2026
tasks-v0.20.11
Mar 31, 2026
tasks-v0.20.10
Mar 27, 2026
tasks-v0.20.9
Mar 26, 2026
tasks-v0.20.8
Mar 26, 2026
tasks-v0.20.7
Mar 24, 2026
tasks-v0.20.6
Mar 20, 2026
tasks-v0.20.5
Mar 20, 2026
tasks-v0.20.4
Mar 19, 2026
gguf-v0.4.1
Mar 18, 2026
tasks-v0.20.3
Mar 18, 2026
tasks-v0.20.2
Mar 18, 2026
tasks-v0.20.1
Mar 13, 2026
tasks-v0.20.0
Mar 11, 2026
gguf-v0.4.0
Mar 11, 2026
hub-v2.11.0
Mar 11, 2026
gguf-v0.3.8
Mar 11, 2026
hub-v2.10.8
Mar 11, 2026
gguf-v0.3.7
Mar 10, 2026
hub-v2.10.7
Mar 10, 2026
hub-v2.10.6
Mar 10, 2026
jinja-v0.5.6
Mar 9, 2026
inference-v4.13.15
Mar 6, 2026
gguf-v0.3.6
Mar 6, 2026
tasks-v0.19.90
Mar 6, 2026
hub-v2.10.5
Mar 3, 2026
tasks-v0.19.89
Mar 2, 2026
inference-v4.13.14
Feb 27, 2026
tasks-v0.19.88
Feb 25, 2026
inference-v2.0.0
Apr 19, 2023
inference-v4.13.18latest
first seen May 22, 2026
hub-v2.13.0
first seen May 22, 2026
0.2.3
Aug 27, 2025
0.2.2
Jul 11, 2025
0.2.1
Jul 10, 2025
+ show 6 moreshow less
0.2.0
May 13, 2025
0.1.3
May 4, 2025
0.1.2
May 4, 2025
0.1.1
Apr 25, 2025
0.1.0
Apr 25, 2025
0.0.2
Apr 25, 2025
1.0.0latest
first seen May 20, 2026

Tools 5

textToSpeech
annotations: none low

This tool takes a text input and turns it into an audio file.

imageToText
annotations: none low

Caption an image.

textToImage
annotations: none low

Generate an image from a text prompt.

speechToText
annotations: none low

Transcribe an audio file and returns its text content.

message
annotations: none low

Send data back to the user.

Permissions 4

network medium
Server uses network capabilities via: fetch(), requests
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, fs/promises, open(), os
shell high
Server uses shell capabilities via: child_process, execSync()
env_vars low
Server uses env_vars capabilities via: os.environ, process.env

Scan Findings 280

medium
No build provenance detected (SLSA L0) slsa_assessor · 90%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-c24v-8rfc-w8vw) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-c27g-q93r-2cwf) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-g4jq-h2w9-997c) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-jqfw-vq24-v9c3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-vg6x-rcgg-rjx6) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-x574-m823-4x7w) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-xcj6-pq6g-qj4x) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@0.34.6 (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
medium
Vulnerable dependency: @sveltejs/kit@2.5.9 (GHSA-29g2-3rmr-qm68) dependency_analyzer · 95%
medium
Vulnerable dependency: @sveltejs/kit@2.5.9 (GHSA-2crg-3p73-43xp) dependency_analyzer · 95%
medium
Vulnerable dependency: @sveltejs/kit@2.5.9 (GHSA-3f6h-2hrp-w5wx) dependency_analyzer · 95%
medium
Vulnerable dependency: @sveltejs/kit@2.5.9 (GHSA-6q87-84jw-cjhp) dependency_analyzer · 95%
medium
Vulnerable dependency: @sveltejs/kit@2.5.9 (GHSA-866w-xmhq-wj7x) dependency_analyzer · 95%
medium
Vulnerable dependency: @sveltejs/kit@2.5.9 (GHSA-mh2x-fcqh-fmqv) dependency_analyzer · 95%
medium
Vulnerable dependency: @sveltejs/kit@2.5.9 (GHSA-rjjv-87mx-6x3h) dependency_analyzer · 95%
medium
Vulnerable dependency: @sveltejs/kit@2.5.9 (GHSA-wqjv-9729-c5q2) dependency_analyzer · 95%
medium
Vulnerable dependency: @vitest/browser@1.6.0 (GHSA-p63j-vcc4-9vmv) dependency_analyzer · 95%
medium
Vulnerable dependency: svelte@4.2.17 (GHSA-8266-84wp-wv5c) dependency_analyzer · 95%
medium
Vulnerable dependency: svelte@4.2.17 (GHSA-crpf-4hrx-3jrp) dependency_analyzer · 95%
medium
Vulnerable dependency: svelte@4.2.17 (GHSA-f7gr-6p89-r883) dependency_analyzer · 95%
medium
Vulnerable dependency: svelte@4.2.17 (GHSA-m56q-vw4c-c2cp) dependency_analyzer · 95%
medium
Vulnerable dependency: svelte@4.2.17 (GHSA-phwv-c562-gvmh) dependency_analyzer · 95%
medium
Vulnerable dependency: svelte@4.2.17 (GHSA-pr6f-5x2q-rwfp) dependency_analyzer · 95%
medium
Vulnerable dependency: svelte@4.2.17 (GHSA-rcqx-6q8c-2c42) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-356w-63v5-8wf4) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-4r4m-qw57-chr8) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-64vr-g452-qvp3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-859w-5945-r5v3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-93m4-6634-74q7) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-9cwx-2883-4wfx) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-c27g-q93r-2cwf) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-g4jq-h2w9-997c) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-jqfw-vq24-v9c3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-vg6x-rcgg-rjx6) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-x574-m823-4x7w) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-xcj6-pq6g-qj4x) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@1.6.0 (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@1.6.0 (GHSA-9crc-q9x8-hgqq) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.11.4 (GHSA-345p-7cg4-v4c7) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.11.4 (GHSA-8r9q-7v3j-jr4g) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.11.4 (GHSA-w48q-cv73-mx4w) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.11.2 (GHSA-345p-7cg4-v4c7) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.11.2 (GHSA-8r9q-7v3j-jr4g) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.11.2 (GHSA-w48q-cv73-mx4w) dependency_analyzer · 95%
medium
Vulnerable dependency: yaml@2.2.2 (GHSA-48c2-rrv3-qjmp) dependency_analyzer · 95%
medium
Vulnerable dependency: tsup@8.1.0 (GHSA-3mv9-4h5g-vhg3) dependency_analyzer · 95%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/e2e/svelte/src/test.spec.ts:16 entropy_analyzer · 70%
medium
High-entropy string (6.57 bits/char) in huggingface-huggingface.js-90d768d/packages/tasks/src/default-widget-inputs.ts:156 entropy_analyzer · 63%
medium
High-entropy string (5.94 bits/char) in huggingface-huggingface.js-90d768d/packages/ollama-utils/src/chat-template-automap.ts:570 entropy_analyzer · 54%
medium
High-entropy string (6.03 bits/char) in huggingface-huggingface.js-90d768d/packages/ollama-utils/src/chat-template-automap.ts:570 entropy_analyzer · 55%
medium
High-entropy string (6.60 bits/char) in huggingface-huggingface.js-90d768d/packages/ollama-utils/src/chat-template-automap.ts:570 entropy_analyzer · 64%
medium
High-entropy string (6.34 bits/char) in huggingface-huggingface.js-90d768d/packages/ollama-utils/src/chat-template-automap.ts:570 entropy_analyzer · 60%
medium
High-entropy string (6.24 bits/char) in huggingface-huggingface.js-90d768d/packages/ollama-utils/src/chat-template-automap.ts:893 entropy_analyzer · 58%
medium
Buffer.from base64 in huggingface-huggingface.js-90d768d/packages/inference/src/providers/wavespeed.ts:285 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:27 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:47 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:48 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:49 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:50 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:51 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:52 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:53 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:54 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:55 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:56 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:57 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:58 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:59 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:60 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:61 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:62 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:63 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:64 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:65 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:466 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:471 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:476 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:481 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:492 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:493 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:494 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:499 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:500 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:502 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/xetchunk-wasm/tests/index.test.ts:506 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/scripts/bench.ts:30 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/scripts/bench.ts:35 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/scripts/bench.ts:40 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/scripts/bench.ts:45 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/scripts/bench.ts:53 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/src/lib/list-files.spec.ts:36 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/src/lib/list-files.spec.ts:40 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/src/lib/list-files.spec.ts:48 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/src/lib/list-files.spec.ts:52 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/src/lib/list-files.spec.ts:114 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/src/lib/list-files.spec.ts:118 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/src/lib/list-files.spec.ts:131 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/src/lib/list-files.spec.ts:135 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/src/lib/paths-info.spec.ts:23 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/src/lib/file-download-info.spec.ts:16 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/src/lib/file-download-info.spec.ts:57 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/src/utils/sha256.spec.ts:5 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/src/utils/sha256.spec.ts:7 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/src/utils/sha256.spec.ts:9 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/src/utils/XetBlob.spec.ts:39 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/src/utils/XetBlob.spec.ts:51 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/src/utils/XetBlob.spec.ts:79 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/src/utils/XetBlob.spec.ts:108 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/src/utils/XetBlob.spec.ts:137 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/src/utils/XetBlob.spec.ts:160 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/packages/hub/src/utils/shardParser.spec.ts:22 entropy_analyzer · 70%
info
package.json metadata manifest_parser · 100%
info
Tool: textToSpeech manifest_parser · 90%
info
Tool: imageToText manifest_parser · 90%
info
Tool: textToImage manifest_parser · 90%
info
Tool: speechToText manifest_parser · 90%
info
Tool: message manifest_parser · 90%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (18) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 90%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 63 components sbom_generator · 100%
low
Tool 'textToSpeech' has no annotations annotation_checker · 100%
low
Tool 'imageToText' has no annotations annotation_checker · 100%
low
Tool 'textToImage' has no annotations annotation_checker · 100%
low
Tool 'speechToText' has no annotations annotation_checker · 100%
low
Tool 'message' has no annotations annotation_checker · 100%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: @vitest/browser@0.34.6 (GHSA-p63j-vcc4-9vmv) dependency_analyzer · 95%
medium
Vulnerable dependency: semver@7.5.0 (GHSA-c2qf-rxjj-qqgw) dependency_analyzer · 95%
medium
Hex string literal (>50 chars) in huggingface-huggingface.js-90d768d/e2e/svelte/src/test.spec.ts:23 entropy_analyzer · 70%
medium
Vulnerable dependency: tsup@6.7.0 (GHSA-3mv9-4h5g-vhg3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-356w-63v5-8wf4) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-4r4m-qw57-chr8) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-64vr-g452-qvp3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-859w-5945-r5v3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-8jhw-289h-jh2g) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-92r3-m2mg-pj97) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-93m4-6634-74q7) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-9cwx-2883-4wfx) dependency_analyzer · 95%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (18) manifest_parser · 80%
medium
Permission: network access detected permission_analyzer · 90%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
medium
Vulnerable dependency: semver@7.5.0 (GHSA-c2qf-rxjj-qqgw) dependency_analyzer · 95%
medium
Vulnerable dependency: tsup@6.7.0 (GHSA-3mv9-4h5g-vhg3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-356w-63v5-8wf4) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-4r4m-qw57-chr8) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-64vr-g452-qvp3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-859w-5945-r5v3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-8jhw-289h-jh2g) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-92r3-m2mg-pj97) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-93m4-6634-74q7) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-9cwx-2883-4wfx) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-c24v-8rfc-w8vw) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-g4jq-h2w9-997c) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-jqfw-vq24-v9c3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-vg6x-rcgg-rjx6) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-x574-m823-4x7w) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.0.2 (GHSA-xcj6-pq6g-qj4x) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.11.4 (GHSA-345p-7cg4-v4c7) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.11.4 (GHSA-8r9q-7v3j-jr4g) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.11.4 (GHSA-w48q-cv73-mx4w) dependency_analyzer · 95%
medium
Vulnerable dependency: tsup@8.1.0 (GHSA-3mv9-4h5g-vhg3) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.11.2 (GHSA-345p-7cg4-v4c7) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.11.2 (GHSA-8r9q-7v3j-jr4g) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.11.2 (GHSA-w48q-cv73-mx4w) dependency_analyzer · 95%
medium
Vulnerable dependency: yaml@2.2.2 (GHSA-48c2-rrv3-qjmp) dependency_analyzer · 95%
medium
Vulnerable dependency: @sveltejs/kit@2.5.9 (GHSA-2crg-3p73-43xp) dependency_analyzer · 95%
medium
Vulnerable dependency: @sveltejs/kit@2.5.9 (GHSA-3f6h-2hrp-w5wx) dependency_analyzer · 95%
medium
Vulnerable dependency: @sveltejs/kit@2.5.9 (GHSA-6q87-84jw-cjhp) dependency_analyzer · 95%
medium
Vulnerable dependency: @sveltejs/kit@2.5.9 (GHSA-mh2x-fcqh-fmqv) dependency_analyzer · 95%
medium
Vulnerable dependency: @sveltejs/kit@2.5.9 (GHSA-rjjv-87mx-6x3h) dependency_analyzer · 95%
medium
Vulnerable dependency: svelte@4.2.17 (GHSA-8266-84wp-wv5c) dependency_analyzer · 95%
medium
Vulnerable dependency: svelte@4.2.17 (GHSA-crpf-4hrx-3jrp) dependency_analyzer · 95%
medium
Vulnerable dependency: svelte@4.2.17 (GHSA-f7gr-6p89-r883) dependency_analyzer · 95%
medium
Vulnerable dependency: svelte@4.2.17 (GHSA-m56q-vw4c-c2cp) dependency_analyzer · 95%
medium
Vulnerable dependency: svelte@4.2.17 (GHSA-phwv-c562-gvmh) dependency_analyzer · 95%
medium
Vulnerable dependency: svelte@4.2.17 (GHSA-pr6f-5x2q-rwfp) dependency_analyzer · 95%
medium
Vulnerable dependency: svelte@4.2.17 (GHSA-rcqx-6q8c-2c42) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-356w-63v5-8wf4) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-4r4m-qw57-chr8) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-64vr-g452-qvp3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-859w-5945-r5v3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-93m4-6634-74q7) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-9cwx-2883-4wfx) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-g4jq-h2w9-997c) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-jqfw-vq24-v9c3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-vg6x-rcgg-rjx6) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-x574-m823-4x7w) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.2.11 (GHSA-xcj6-pq6g-qj4x) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@1.6.0 (GHSA-9crc-q9x8-hgqq) dependency_analyzer · 95%
medium
High-entropy string (6.57 bits/char) in packages/tasks/src/default-widget-inputs.ts:156 entropy_analyzer · 63%
medium
High-entropy string (5.94 bits/char) in packages/ollama-utils/src/chat-template-automap.ts:570 entropy_analyzer · 54%
medium
High-entropy string (6.03 bits/char) in packages/ollama-utils/src/chat-template-automap.ts:570 entropy_analyzer · 55%
medium
High-entropy string (6.60 bits/char) in packages/ollama-utils/src/chat-template-automap.ts:570 entropy_analyzer · 64%
medium
High-entropy string (6.34 bits/char) in packages/ollama-utils/src/chat-template-automap.ts:570 entropy_analyzer · 60%
medium
High-entropy string (6.24 bits/char) in packages/ollama-utils/src/chat-template-automap.ts:893 entropy_analyzer · 58%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:27 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:47 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:48 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:49 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:50 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:51 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:52 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:53 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:54 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:55 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:56 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:57 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:58 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:59 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:60 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:61 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:62 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:63 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:64 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:65 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:466 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:471 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:476 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:481 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:485 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:486 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:487 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:492 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:493 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:495 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/xetchunk-wasm/tests/index.test.ts:499 entropy_analyzer · 70%
medium
Buffer.from base64 in packages/inference/src/providers/wavespeed.ts:285 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in packages/hub/scripts/bench.ts:30 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/scripts/bench.ts:35 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/scripts/bench.ts:40 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/scripts/bench.ts:45 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/scripts/bench.ts:53 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/src/utils/shardParser.spec.ts:22 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/src/utils/sha256.spec.ts:5 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/src/utils/sha256.spec.ts:7 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/src/utils/sha256.spec.ts:9 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/src/utils/XetBlob.spec.ts:38 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/src/utils/XetBlob.spec.ts:50 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/src/utils/XetBlob.spec.ts:78 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/src/utils/XetBlob.spec.ts:107 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/src/utils/XetBlob.spec.ts:136 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/src/utils/XetBlob.spec.ts:159 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/src/lib/list-files.spec.ts:36 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/src/lib/list-files.spec.ts:40 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/src/lib/list-files.spec.ts:48 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/src/lib/list-files.spec.ts:52 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/src/lib/list-files.spec.ts:114 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/src/lib/list-files.spec.ts:118 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/src/lib/list-files.spec.ts:131 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/src/lib/list-files.spec.ts:135 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/src/lib/paths-info.spec.ts:23 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/src/lib/file-download-info.spec.ts:16 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in packages/hub/src/lib/file-download-info.spec.ts:57 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in e2e/svelte/src/test.spec.ts:16 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in e2e/svelte/src/test.spec.ts:23 entropy_analyzer · 70%
info
SLSA Build Level 3 detected slsa_assessor · 85%
info
Could not connect to MCP server for output poisoning scan output_poisoning · 100%
info
Could not connect to MCP server for behavioral verification behavioral_verifier · 100%
info
SBOM generated: 63 components sbom_generator · 100%
info
MITRE ATLAS technique coverage summary atlas_annotator · 100%
info
ATLAS: Adversarial ML Supply Chain (AML.T0043) atlas_annotator · 100%
info
ATLAS: Poison Training Data (AML.T0020) atlas_annotator · 100%
info
package.json metadata manifest_parser · 100%