Back to search
B
76.5 /100

@llmindset/hf-mcp-server

Author evalstate
Scanned 28d ago

Official Hugging Face MCP Server

npm

Versions

0.4.4
Jul 30, 2026
0.4.3
Jul 30, 2026
0.4.2
Jul 28, 2026
0.4.1
Jul 27, 2026
0.4.0
Jul 27, 2026
+ show 106 moreshow less
0.3.36
Jul 27, 2026
0.3.35scored
Jul 21, 2026
0.3.34
Jul 18, 2026
0.3.33
Jul 16, 2026
0.3.32
Jul 15, 2026
0.3.31
Jul 13, 2026
0.3.30
Jul 12, 2026
0.3.29
Jul 10, 2026
0.3.28
Jul 7, 2026
0.3.27
Jul 7, 2026
0.3.26
Jul 3, 2026
0.3.25
Jul 2, 2026
0.3.24
Jul 2, 2026
0.3.23
Jun 30, 2026
0.3.22
Jun 25, 2026
0.3.21
Jun 19, 2026
0.3.20
Jun 14, 2026
0.3.19
Jun 4, 2026
0.3.18
Jun 4, 2026
0.3.17
Jun 2, 2026
0.3.16
Jun 2, 2026
0.3.15
May 31, 2026
0.3.13
May 16, 2026
0.3.12
May 6, 2026
0.3.11
Apr 29, 2026
0.3.10
Apr 29, 2026
0.3.9
Apr 27, 2026
0.3.5
Feb 24, 2026
0.3.4
Feb 23, 2026
0.3.3
Feb 23, 2026
0.3.2
Feb 17, 2026
0.3.1
Jan 28, 2026
0.3.0
Jan 28, 2026
0.2.74
Dec 18, 2025
0.2.57
Dec 5, 2025
0.2.56
Dec 1, 2025
0.2.55
Nov 28, 2025
0.2.54
Nov 27, 2025
0.2.53
Nov 25, 2025
0.2.52
Nov 24, 2025
0.2.51
Nov 21, 2025
0.2.50
Nov 20, 2025
0.2.49
Nov 20, 2025
0.2.48
Nov 20, 2025
0.2.47
Nov 19, 2025
0.2.46
Nov 14, 2025
0.2.45
Nov 13, 2025
0.2.44
Nov 13, 2025
0.2.43
Nov 11, 2025
0.2.42
Nov 10, 2025
0.2.41
Nov 10, 2025
0.2.40
Nov 7, 2025
0.2.39
Nov 2, 2025
0.2.38
Oct 30, 2025
0.2.37
Oct 28, 2025
0.2.36
Oct 27, 2025
0.2.35
Oct 27, 2025
0.2.34
Oct 23, 2025
0.2.33
Oct 21, 2025
0.2.32
Oct 16, 2025
0.2.31
Oct 15, 2025
0.2.30
Oct 9, 2025
0.2.29
Oct 7, 2025
0.2.28
Sep 26, 2025
0.2.27
Sep 17, 2025
0.2.26
Sep 16, 2025
0.2.25
Sep 12, 2025
0.2.24
Sep 11, 2025
0.2.23
Sep 11, 2025
0.2.22
Sep 5, 2025
0.2.21
Sep 4, 2025
0.2.20
Sep 4, 2025
0.2.19
Sep 2, 2025
0.2.18
Aug 25, 2025
0.2.17
Aug 21, 2025
0.2.16
Aug 20, 2025
0.2.15
Aug 19, 2025
0.2.14
Aug 15, 2025
0.2.13
Aug 12, 2025
0.2.12
Aug 12, 2025
0.2.11
Aug 12, 2025
0.2.10
Aug 11, 2025
0.2.9
Aug 7, 2025
0.2.8
Aug 5, 2025
0.2.7
Aug 4, 2025
0.2.6
Aug 1, 2025
0.2.5
Jul 30, 2025
0.2.4
Jul 24, 2025
0.2.3
Jul 23, 2025
0.2.2
Jul 23, 2025
0.2.1
Jul 23, 2025
0.2.0
Jul 23, 2025
0.1.29
Jul 23, 2025
0.1.28
Jul 21, 2025
0.1.27
Jul 16, 2025
0.1.26
Jul 16, 2025
0.1.25
Jul 7, 2025
0.1.24
Jul 1, 2025
0.1.23
Jul 1, 2025
0.1.22
Jun 30, 2025
0.1.21
Jun 26, 2025
0.1.20
Jun 26, 2025
0.1.19
Jun 26, 2025
0.1.18
Jun 25, 2025
0.1.17
Jun 24, 2025
0.1.16
Jun 24, 2025

Trust breakdown

PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 6

a
annotations: none low

hf_whoami
annotations: none low

extra
annotations: none low

large_${isError}
annotations: verified low

Emits progress for modern transport testing.

readOnlyHint true openWorldHint false idempotentHint false destructiveHint false
progress_test
annotations: verified low

Emits progress for modern transport testing.

readOnlyHint true openWorldHint false idempotentHint false destructiveHint false
run
annotations: none low

Permissions 4

network Server uses network capabilities via: fetch(), http, urllib
medium
filesystem Server uses filesystem capabilities via: fs/promises, open(), os, pathlib, shutil, tempfile
low
shell Server uses shell capabilities via: child_process, spawn(), subprocess
high
env_vars Server uses env_vars capabilities via: os.environ, process.env
low

Scan Findings 31

low
Tool 'a' has no annotations annotation_checker · 100%
low
Tool 'hf_whoami' has no annotations annotation_checker · 100%
low
Tool 'extra' has no annotations annotation_checker · 100%
info
Tool 'large_${isError}' annotations are consistent annotation_checker · 80%
info
Tool 'progress_test' annotations are consistent annotation_checker · 80%
info
Tool 'hf_whoami' annotations are consistent annotation_checker · 80%
low
Tool 'run' has no annotations annotation_checker · 100%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Vulnerable dependency: pytest@7.0.0 (GHSA-6w46-j5rx-g56g) dependency_analyzer · 95%
medium
Vulnerable dependency: pytest@7.0.0 (PYSEC-2026-1845) dependency_analyzer · 95%
medium
Buffer.from base64 in huggingface-hf-mcp-server-1011f57/packages/mcp/src/hf-fs-write.ts:250 entropy_analyzer · 75%
medium
Buffer.from base64 in huggingface-hf-mcp-server-1011f57/packages/mcp/src/sandbox-tool.ts:1539 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
pyproject.toml metadata manifest_parser · 100%
info
Tool: a manifest_parser · 85%
info
Tool: hf_whoami manifest_parser · 85%
info
Tool: extra manifest_parser · 85%
info
Tool: large_${isError} manifest_parser · 85%
info
Tool: progress_test manifest_parser · 85%
info
Tool: run manifest_parser · 90%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (62) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 80%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 54 components sbom_generator · 100%
high
Hardcoded Password found in huggingface-hf-mcp-server-1011f57/README.md secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%