← Back to search

@lightfastai/mcp

GitHub Actions Scanned 7d ago

Lightfast Platform MCP Server - MCP for the Lightfast Platform API

npm
? Not scanned yet

Versions

0.3.0latest
May 29, 2026
1.0.0-alpha.7
May 29, 2026
1.0.0-alpha.6
May 29, 2026
0.1.0-alpha.5
Feb 9, 2026
0.1.0-alpha.4
Feb 9, 2026
+ show 3 moreshow less
0.1.0-alpha.3
Feb 9, 2026
0.1.0-alpha.2
Feb 9, 2026
0.1.0-alpha.1
Feb 9, 2026

Tools 0

No tools indexed yet.

Permissions 4

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, path
shell high
Server uses shell capabilities via: child_process, execSync(), spawn()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 113

high
Hardcoded OAuth client secret in lightfastai-lightfast-5e1ff6b/emulators/linear/src/__tests__/server.test.ts auth_checker · 95%
high
Hardcoded OAuth client ID in lightfastai-lightfast-5e1ff6b/emulators/granola/src/__tests__/server.test.ts auth_checker · 85%
high
Hardcoded OAuth client ID in lightfastai-lightfast-5e1ff6b/e2e/src/decisions/real-clerk-smoke.ts auth_checker · 85%
high
Hardcoded OAuth client secret in lightfastai-lightfast-5e1ff6b/e2e/src/decisions/real-clerk-smoke.ts auth_checker · 95%
high
Hardcoded OAuth client ID in lightfastai-lightfast-5e1ff6b/e2e/src/decisions/real-clerk-smoke.test.ts auth_checker · 85%
high
Hardcoded OAuth client ID in lightfastai-lightfast-5e1ff6b/e2e/src/provider-routine-proxy/real-cli-smoke.ts auth_checker · 85%
high
Hardcoded OAuth client secret in lightfastai-lightfast-5e1ff6b/e2e/src/provider-routine-proxy/real-cli-smoke.ts auth_checker · 95%
high
Hardcoded OAuth client secret in lightfastai-lightfast-5e1ff6b/api/app/src/__tests__/org-source-control-domain-commands.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in lightfastai-lightfast-5e1ff6b/api/app/src/__tests__/connectors-x-mcp-bridge.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in lightfastai-lightfast-5e1ff6b/api/app/src/__tests__/github-setup-flow.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in lightfastai-lightfast-5e1ff6b/api/app/src/__tests__/connectors-flow.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in lightfastai-lightfast-5e1ff6b/api/app/src/__tests__/github-user-account-refresh.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in lightfastai-lightfast-5e1ff6b/api/app/src/__tests__/github-installation-token-cache.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in lightfastai-lightfast-5e1ff6b/api/app/src/__tests__/github-user-account-flow.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in lightfastai-lightfast-5e1ff6b/api/app/src/__tests__/signal-entity-enrichment-fetchers.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in lightfastai-lightfast-5e1ff6b/api/app/src/__tests__/github-config.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in lightfastai-lightfast-5e1ff6b/api/app/src/__tests__/connectors-runtime.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in lightfastai-lightfast-5e1ff6b/api/app/src/__tests__/user-connectors-flow.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in lightfastai-lightfast-5e1ff6b/api/app/src/__tests__/skills-index-workflows.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in lightfastai-lightfast-5e1ff6b/connectors/linear/src/__tests__/oauth.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in lightfastai-lightfast-5e1ff6b/connectors/x/src/__tests__/oauth.test.ts auth_checker · 95%
high
Hardcoded OAuth client ID in lightfastai-lightfast-5e1ff6b/connectors/granola/src/__tests__/oauth-provider.test.ts auth_checker · 85%
high
Hardcoded OAuth client secret in lightfastai-lightfast-5e1ff6b/connectors/granola/src/__tests__/oauth-provider.test.ts auth_checker · 95%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Excessive dependency count: 400 direct dependencies dependency_analyzer · 90%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Suspicious package name: react-email dependency_analyzer · 60%
medium
Suspicious package name: lodash.merge dependency_analyzer · 60%
medium
Suspicious package name: react-markdown dependency_analyzer · 60%
medium
Vulnerable dependency: drizzle-orm@catalog: (GHSA-gpj5-g38j-94v9) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@catalog: (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@catalog: (GHSA-9crc-q9x8-hgqq) dependency_analyzer · 95%
medium
Vulnerable dependency: zod@catalog: (GHSA-m95q-7qp3-xv42) dependency_analyzer · 95%
medium
Vulnerable dependency: jose@catalog: (GHSA-hhhv-q57g-882q) dependency_analyzer · 95%
medium
Vulnerable dependency: nanoid@catalog: (GHSA-28wg-ghj8-5hjv) dependency_analyzer · 95%
medium
Vulnerable dependency: nanoid@catalog: (GHSA-2v37-7h3g-55p8) dependency_analyzer · 95%
medium
Vulnerable dependency: nanoid@catalog: (GHSA-mwcw-c2x4-8c55) dependency_analyzer · 95%
medium
Vulnerable dependency: ai@catalog: (GHSA-rwvc-j5jr-mgvh) dependency_analyzer · 95%
medium
Vulnerable dependency: @sentry/browser@catalog: (GHSA-593m-55hh-j8gv) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@catalog: (GHSA-w48q-cv73-mx4w) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp-handler@catalog: (GHSA-w2fm-25vw-vh7f) dependency_analyzer · 95%
medium
Vulnerable dependency: electron@41.3.0 (GHSA-9f4c-93c8-jc8g) dependency_analyzer · 95%
medium
Vulnerable dependency: electron@41.3.0 (GHSA-r4w5-6pfg-jxp5) dependency_analyzer · 95%
medium
Vulnerable dependency: electron@41.3.0 (GHSA-v3j7-r9gq-3gjw) dependency_analyzer · 95%
medium
Vulnerable dependency: effect@catalog: (GHSA-38f7-945m-qr2g) dependency_analyzer · 95%
medium
Vulnerable dependency: import-in-the-middle@catalog: (GHSA-5r27-rw8r-7967) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@catalog:tailwind4 (GHSA-566m-qj78-rww5) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@catalog:tailwind4 (GHSA-6g55-p6wh-862q) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@catalog:tailwind4 (GHSA-7fh5-64p2-3v2j) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@catalog:tailwind4 (GHSA-fxqj-rqcc-2cmp) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@catalog:tailwind4 (GHSA-qx2v-qp2m-jg93) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@catalog:tailwind4 (GHSA-r28c-9q8g-f849) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@catalog: (GHSA-353f-5xf4-qw67) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@catalog: (GHSA-356w-63v5-8wf4) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@catalog: (GHSA-4r4m-qw57-chr8) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@catalog: (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@catalog: (GHSA-64vr-g452-qvp3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@catalog: (GHSA-859w-5945-r5v3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@catalog: (GHSA-9cwx-2883-4wfx) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@catalog: (GHSA-c27g-q93r-2cwf) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@catalog: (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@catalog: (GHSA-g4jq-h2w9-997c) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@catalog: (GHSA-jqfw-vq24-v9c3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@catalog: (GHSA-mv48-hcvh-8jj8) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@catalog: (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@catalog: (GHSA-vg6x-rcgg-rjx6) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@catalog: (GHSA-x574-m823-4x7w) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@catalog: (GHSA-xcj6-pq6g-qj4x) dependency_analyzer · 95%
medium
Vulnerable dependency: superjson@catalog: (GHSA-5888-ffcr-r425) dependency_analyzer · 95%
medium
Vulnerable dependency: happy-dom@catalog: (GHSA-37j7-fg3j-429f) dependency_analyzer · 95%
medium
Vulnerable dependency: happy-dom@catalog: (GHSA-96g7-g7g9-jxw8) dependency_analyzer · 95%
medium
Vulnerable dependency: happy-dom@catalog: (GHSA-w4gp-fjgq-3q4g) dependency_analyzer · 95%
medium
Vulnerable dependency: nitro@catalog: (GHSA-5w89-w975-hf9q) dependency_analyzer · 95%
medium
Vulnerable dependency: nitro@catalog: (GHSA-9phm-9p8f-hw5m) dependency_analyzer · 95%
medium
Vulnerable dependency: tsup@catalog: (GHSA-3mv9-4h5g-vhg3) dependency_analyzer · 95%
medium
Buffer.from base64 in lightfastai-lightfast-5e1ff6b/emulators/github/src/__tests__/server.test.ts:838 entropy_analyzer · 75%
medium
Buffer.from base64 in lightfastai-lightfast-5e1ff6b/emulators/github/src/plugin/compatible-routes.ts:107 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in lightfastai-lightfast-5e1ff6b/db/app/src/__tests__/mcp-oauth.test.ts:57 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in lightfastai-lightfast-5e1ff6b/db/app/src/__tests__/mcp-oauth.test.ts:84 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in lightfastai-lightfast-5e1ff6b/packages/app-encryption/src/__tests__/encryption.test.ts:10 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in lightfastai-lightfast-5e1ff6b/packages/app-encryption/src/__tests__/encryption.test.ts:66 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in lightfastai-lightfast-5e1ff6b/api/app/src/__tests__/connectors-x-mcp-bridge.test.ts:15 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in lightfastai-lightfast-5e1ff6b/api/app/src/__tests__/connectors-flow.test.ts:41 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in lightfastai-lightfast-5e1ff6b/api/app/src/__tests__/github-user-account-refresh.test.ts:15 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in lightfastai-lightfast-5e1ff6b/api/app/src/__tests__/github-user-account-flow.test.ts:20 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in lightfastai-lightfast-5e1ff6b/api/app/src/__tests__/connectors-mcp-auth.test.ts:7 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in lightfastai-lightfast-5e1ff6b/api/app/src/__tests__/connectors-runtime.test.ts:20 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in lightfastai-lightfast-5e1ff6b/api/app/src/__tests__/user-connectors-flow.test.ts:20 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in lightfastai-lightfast-5e1ff6b/api/app/src/__tests__/user-connectors-runtime.test.ts:20 entropy_analyzer · 70%
medium
Buffer.from base64 in lightfastai-lightfast-5e1ff6b/connectors/github/src/repositories.ts:92 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (98) manifest_parser · 80%
medium
Hardcoded OAuth client ID in lightfastai-lightfast-5e1ff6b/emulators/granola/src/__tests__/server.test.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in lightfastai-lightfast-5e1ff6b/e2e/src/decisions/real-clerk-smoke.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in lightfastai-lightfast-5e1ff6b/e2e/src/decisions/real-clerk-smoke.test.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in lightfastai-lightfast-5e1ff6b/e2e/src/provider-routine-proxy/real-cli-smoke.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in lightfastai-lightfast-5e1ff6b/connectors/granola/src/__tests__/oauth-provider.test.ts oauth_scope_analyzer · 80%
high
High-risk OAuth scope: admin:org oauth_scope_analyzer · 80%
high
High-risk OAuth scope: admin oauth_scope_analyzer · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 274 components sbom_generator · 100%
high
Authorization Bearer Token found in lightfastai-lightfast-5e1ff6b/docs/superpowers/plans/2026-06-03-app-tanstack.md secret_scanner · 70%
critical
RSA Private Key found in lightfastai-lightfast-5e1ff6b/docs/superpowers/plans/2026-05-28-github-org-binding-emulator.md secret_scanner · 95%
high
Hardcoded Password found in lightfastai-lightfast-5e1ff6b/.agents/skills/clerk-custom-ui/core-2/custom-sign-in.md secret_scanner · 65%
high
Hardcoded Password found in lightfastai-lightfast-5e1ff6b/.agents/skills/clerk-custom-ui/core-2/custom-sign-up.md secret_scanner · 65%
high
Hardcoded Password found in lightfastai-lightfast-5e1ff6b/.agents/skills/clerk-custom-ui/core-3/custom-sign-in.md secret_scanner · 65%
high
Hardcoded Password found in lightfastai-lightfast-5e1ff6b/.agents/skills/clerk-custom-ui/core-3/custom-sign-up.md secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%