← Back to search

mcp-secure-server

aself101 Scanned 29d ago

Secure-by-default MCP server with 5-layer validation for defense-in-depth protection

C
63.9 / 100

Versions

0.0.19-securitylatest
Jul 18, 2026
0.0.18-security
Jun 22, 2026
0.0.17-security
Jun 12, 2026
0.0.16-security
Jun 11, 2026
0.0.15-security
Jun 8, 2026
+ show 10 moreshow less
0.0.14-security
Apr 29, 2026
0.0.13-security
Apr 15, 2026
0.0.12-security
Apr 15, 2026
0.0.11-security
Apr 15, 2026
0.0.10-security
Apr 8, 2026
0.0.9-security
Apr 5, 2026
0.0.8-security
Mar 4, 2026
0.0.7-security
Jan 28, 2026
0.0.6-security
Jan 22, 2026
0.0.1-security
Jan 2, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 92

no-handler-tool
annotations: none low

just a description

pii-tool
annotations: none low

desc

safe-tool
annotations: none low

desc

crashing-tool
annotations: none low

desc

crashing-registered-tool
annotations: none low

test

sensitive-tool
annotations: none low

test

graceful-tool
annotations: none low

test

test-tool
annotations: none low

test

sync-crash-tool
annotations: none low

desc

args-test
annotations: none low

desc

test-server
annotations: none low

echo
annotations: none low

Echo input

text string
http-server
annotations: none low

secure-server
annotations: none low

debug-calculator
annotations: none low

Simple calculator for testing

expression string
debug-file-reader
annotations: none low

File reader for testing

path string
debug-echo
annotations: none low

Echo tool for testing

text string
debug-database
annotations: none low

Mock database operations using safe predefined queries

debug-http
annotations: none low

Mock HTTP request with URL validation (whitelist pattern)

url string
debug-parser
annotations: none low

JSON/XML parser with size limits

data string
debug-image
annotations: none low

Mock image processing with directory restrictions

params string filename string
calculator
annotations: none low

Perform basic arithmetic operations (add, subtract, multiply, divide)

connect-session
annotations: none low

Initialize a secure financial session. Must be called first.

list-accounts
annotations: none low

List available accounts. Requires: active session.

select-account
annotations: none low

Select an account for transactions. Requires: accounts listed.

prepare-transaction
annotations: none low

Prepare a transaction for review. Requires: account selected.

confirm-transaction
annotations: none low

Confirm a prepared transaction. Requires: transaction prepared.

execute-transaction
annotations: none low

Execute a confirmed transaction. Requires: transaction confirmed.

check-status
annotations: none low

Check session status, balances, and history. Allowed anytime when connected.

disconnect-session
annotations: none low

End the current session. Allowed anytime when connected.

read-file
annotations: none low

Read a file from the allowed directories (data/, documents/). Blocks sensitive files and enforces size limits.

list-directory
annotations: none low

List contents of a directory within allowed directories. Returns file names, types, sizes, and modification times.

search-files
annotations: none low

Search for text patterns within files in the allowed directories. Case-insensitive search with file scan limits.

write-log
annotations: none low

Append a log message to the application log file. Only writes to the logs/ directory.

get-ratings
annotations: none low

Get KenPom team efficiency ratings for a season

get-program-ratings
annotations: none low

Get all-time KenPom program rankings

get-efficiency
annotations: none low

Get offensive and defensive efficiency stats

get-four-factors
annotations: none low

Get four factors stats (shooting, turnovers, rebounding, free throws)

get-team-stats
annotations: none low

Get 20+ team statistics for a season

get-schedule
annotations: none low

Get a team\

get-scouting-report
annotations: none low

Get detailed scouting report with 70+ stats for a team

get-player-stats
annotations: none low

Get individual player statistics and metrics

get-conference-standings
annotations: none low

Get conference standings for a specific conference

get-fan-match
annotations: none low

Get daily game predictions and fan match data

generate-image
annotations: none low

Generate images from text prompts using various AI providers (BFL, Google, Ideogram, OpenAI, Stability)

edit-image
annotations: none low

Edit an image using inpainting with an optional mask

upscale-image
annotations: none low

Upscale an image to higher resolution

create-variation
annotations: none low

Create variations of an existing image (OpenAI DALL-E 2 only)

remove-background
annotations: none low

Remove the background from an image (Stability AI)

replace-background
annotations: none low

Replace the background of an image with a new one

describe-image
annotations: none low

Get a text description of an image (Ideogram)

list-models
annotations: none low

List available models for image generation

financial-query
annotations: none low

Query financial data (demonstrates PII detection in responses)

batch-process
annotations: none low

Run batch operations (restricted to business hours)

export-data
annotations: none low

Export datasets (demonstrates cumulative egress tracking)

api-call
annotations: none low

Make API calls (demonstrates geofencing restrictions)

save-note
annotations: none low

Save a documentation note. Content can include code examples that would normally trigger security warnings.

title string content string category string
search-notes
annotations: none low

Search saved notes by title or content.

query string category string
execute-command
annotations: none low

Demo command tool with full security validation. Does not actually execute commands.

command string
query-data
annotations: none low

Query data with SQL/NoSQL injection protection.

limit number filter string
get-policy-info
annotations: none low

Get information about tool security policies.

toolName string
Alice
annotations: none low

query-users
annotations: none low

Search for users by name or email. Uses parameterized queries for SQL injection protection.

create-order
annotations: none low

Create a new order for a user. Validates user and total amount. Transaction-safe.

generate-report
annotations: none low

Generate sales analytics report. Supports grouping by day, week, month, department, or status.

health-check
annotations: none low

Check database connection status and get basic statistics.

get-player-game-log
annotations: none low

Get game-by-game stats for an NBA player

get-player-info
annotations: none low

Get biographical info for an NBA player

find-player
annotations: none low

Search for NBA players by name

get-team-roster
annotations: none low

Get the current roster for an NBA team

get-team-game-log
annotations: none low

Get game-by-game results for an NBA team

get-league-leaders
annotations: none low

Get league leaders in various statistical categories

get-standings
annotations: none low

Get NBA conference standings

get-box-score
annotations: none low

Get the box score for an NBA game

get-play-by-play
annotations: none low

Get play-by-play data for an NBA game

get-live-scoreboard
annotations: none low

Get today\

get-live-box-score
annotations: none low

Get real-time box score for an in-progress game

health
annotations: none low

Check if the service is healthy

status
annotations: none low

Get service status and version information

list-users
annotations: none low

List all users in the system (admin only)

system-stats
annotations: none low

Get system statistics and health metrics

git-status
annotations: none low

Execute safe git commands (status, branch, log, diff, show) on a repository.

image-resize
annotations: none low

Resize images using ImageMagick. Supports PNG, JPG, GIF, WebP.

pdf-metadata
annotations: none low

Extract metadata from PDF files (title, author, pages, etc.).

encode-video
annotations: none low

Encode videos using FFmpeg with safe codec and preset options.

weather-forecast
annotations: none low

Get weather forecast for a city. Supports major world cities with 5-day forecasts including temperature, humidity, and conditions.

currency-convert
annotations: none low

Convert between currencies using real-time exchange rates. Supports major world currencies with ISO 4217 codes.

news-headlines
annotations: none low

Get tech news headlines from Hacker News. Supports categories: front_page, ask_hn, show_hn, jobs. Optional search query.

get-security-metrics
annotations: none low

Get real-time security metrics including violations, layer performance, and tool statistics.

get-audit-log
annotations: none low

Query audit log entries with filtering by time, type, level, tool, and more.

configure-alerts
annotations: none low

Manage alert rules: list, add, update, delete rules, or view alert history.

export-metrics
annotations: none low

Export metrics in Prometheus, JSON, or human-readable summary format.

Permissions 4

network medium
Server uses network capabilities via: fetch(), https
filesystem low
Server uses filesystem capabilities via: fs sync ops, fs.promises
shell high
Server uses shell capabilities via: child_process, execSync(), spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 214

low
Tool 'debug-calculator' has no annotations annotation_checker · 100%
low
Tool 'debug-file-reader' has no annotations annotation_checker · 100%
low
Tool 'debug-echo' has no annotations annotation_checker · 100%
low
Tool 'debug-database' has no annotations annotation_checker · 100%
low
Tool 'debug-http' has no annotations annotation_checker · 100%
low
Tool 'debug-parser' has no annotations annotation_checker · 100%
low
Tool 'debug-image' has no annotations annotation_checker · 100%
low
Tool 'calculator' has no annotations annotation_checker · 100%
low
Tool 'connect-session' has no annotations annotation_checker · 100%
low
Tool 'list-accounts' has no annotations annotation_checker · 100%
low
Tool 'select-account' has no annotations annotation_checker · 100%
low
Tool 'prepare-transaction' has no annotations annotation_checker · 100%
low
Tool 'confirm-transaction' has no annotations annotation_checker · 100%
low
Tool 'execute-transaction' has no annotations annotation_checker · 100%
low
Tool 'check-status' has no annotations annotation_checker · 100%
low
Tool 'disconnect-session' has no annotations annotation_checker · 100%
low
Tool 'read-file' has no annotations annotation_checker · 100%
low
Tool 'list-directory' has no annotations annotation_checker · 100%
low
Tool 'search-files' has no annotations annotation_checker · 100%
low
Tool 'write-log' has no annotations annotation_checker · 100%
low
Tool 'get-ratings' has no annotations annotation_checker · 100%
low
Tool 'get-program-ratings' has no annotations annotation_checker · 100%
low
Tool 'get-efficiency' has no annotations annotation_checker · 100%
low
Tool 'get-four-factors' has no annotations annotation_checker · 100%
low
Tool 'get-team-stats' has no annotations annotation_checker · 100%
low
Tool 'get-schedule' has no annotations annotation_checker · 100%
low
Tool 'get-scouting-report' has no annotations annotation_checker · 100%
low
Tool 'get-player-stats' has no annotations annotation_checker · 100%
low
Tool 'get-conference-standings' has no annotations annotation_checker · 100%
low
Tool 'get-fan-match' has no annotations annotation_checker · 100%
low
Tool 'generate-image' has no annotations annotation_checker · 100%
low
Tool 'edit-image' has no annotations annotation_checker · 100%
low
Tool 'upscale-image' has no annotations annotation_checker · 100%
low
Tool 'create-variation' has no annotations annotation_checker · 100%
low
Tool 'remove-background' has no annotations annotation_checker · 100%
low
Tool 'replace-background' has no annotations annotation_checker · 100%
low
Tool 'describe-image' has no annotations annotation_checker · 100%
low
Tool 'list-models' has no annotations annotation_checker · 100%
low
Tool 'financial-query' has no annotations annotation_checker · 100%
low
Tool 'batch-process' has no annotations annotation_checker · 100%
low
Tool 'export-data' has no annotations annotation_checker · 100%
low
Tool 'api-call' has no annotations annotation_checker · 100%
low
Tool 'save-note' has no annotations annotation_checker · 100%
low
Tool 'search-notes' has no annotations annotation_checker · 100%
low
Tool 'execute-command' has no annotations annotation_checker · 100%
low
Tool 'query-data' has no annotations annotation_checker · 100%
low
Tool 'get-policy-info' has no annotations annotation_checker · 100%
low
Tool 'Alice' has no annotations annotation_checker · 100%
low
Tool 'query-users' has no annotations annotation_checker · 100%
low
Tool 'create-order' has no annotations annotation_checker · 100%
low
Tool 'generate-report' has no annotations annotation_checker · 100%
low
Tool 'health-check' has no annotations annotation_checker · 100%
low
Tool 'get-player-game-log' has no annotations annotation_checker · 100%
low
Tool 'get-player-info' has no annotations annotation_checker · 100%
low
Tool 'find-player' has no annotations annotation_checker · 100%
low
Tool 'get-team-roster' has no annotations annotation_checker · 100%
low
Tool 'get-team-game-log' has no annotations annotation_checker · 100%
low
Tool 'get-league-leaders' has no annotations annotation_checker · 100%
low
Tool 'get-standings' has no annotations annotation_checker · 100%
low
Tool 'get-box-score' has no annotations annotation_checker · 100%
low
Tool 'get-play-by-play' has no annotations annotation_checker · 100%
low
Tool 'get-live-scoreboard' has no annotations annotation_checker · 100%
low
Tool 'get-live-box-score' has no annotations annotation_checker · 100%
low
Tool 'health' has no annotations annotation_checker · 100%
low
Tool 'status' has no annotations annotation_checker · 100%
low
Tool 'list-users' has no annotations annotation_checker · 100%
low
Tool 'system-stats' has no annotations annotation_checker · 100%
low
Tool 'git-status' has no annotations annotation_checker · 100%
low
Tool 'image-resize' has no annotations annotation_checker · 100%
low
Tool 'pdf-metadata' has no annotations annotation_checker · 100%
low
Tool 'encode-video' has no annotations annotation_checker · 100%
low
Tool 'weather-forecast' has no annotations annotation_checker · 100%
low
Tool 'currency-convert' has no annotations annotation_checker · 100%
low
Tool 'news-headlines' has no annotations annotation_checker · 100%
low
Tool 'get-security-metrics' has no annotations annotation_checker · 100%
low
Tool 'get-audit-log' has no annotations annotation_checker · 100%
low
Tool 'configure-alerts' has no annotations annotation_checker · 100%
low
Tool 'export-metrics' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Excessive dependency count: 52 direct dependencies dependency_analyzer · 90%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.0.0 (GHSA-w48q-cv73-mx4w) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.24.0 (GHSA-345p-7cg4-v4c7) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.24.0 (GHSA-8r9q-7v3j-jr4g) dependency_analyzer · 95%
medium
Vulnerable dependency: zod@3.22.0 (GHSA-m95q-7qp3-xv42) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@3.0.0 (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@3.0.0 (GHSA-82fw-gwwq-j7x9) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@3.0.0 (GHSA-9crc-q9x8-hgqq) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@2.1.8 (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@2.1.8 (GHSA-82fw-gwwq-j7x9) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@2.1.8 (GHSA-9crc-q9x8-hgqq) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@1.0.0 (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@1.0.0 (GHSA-9crc-q9x8-hgqq) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@2.0.0 (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@2.0.0 (GHSA-9crc-q9x8-hgqq) dependency_analyzer · 95%
info
Tool: debug-echo manifest_parser · 70%
info
Tool: debug-database manifest_parser · 70%
info
Tool: get-efficiency manifest_parser · 70%
info
Tool: get-four-factors manifest_parser · 70%
info
Tool: get-team-stats manifest_parser · 70%
info
Tool: get-schedule manifest_parser · 70%
info
Tool: get-scouting-report manifest_parser · 70%
info
Tool: get-player-stats manifest_parser · 70%
info
Tool: get-conference-standings manifest_parser · 70%
info
Tool: get-fan-match manifest_parser · 70%
info
Tool: query-users manifest_parser · 70%
info
Tool: create-order manifest_parser · 70%
info
Tool: generate-report manifest_parser · 70%
info
Tool: health-check manifest_parser · 70%
info
Tool: get-player-game-log manifest_parser · 70%
info
Tool: get-player-info manifest_parser · 70%
info
Tool: find-player manifest_parser · 70%
info
Tool: get-team-roster manifest_parser · 70%
info
Tool: get-team-game-log manifest_parser · 70%
info
Tool: get-league-leaders manifest_parser · 70%
info
Tool: get-standings manifest_parser · 70%
info
Tool: get-box-score manifest_parser · 70%
info
Tool: get-play-by-play manifest_parser · 70%
info
Tool: get-live-scoreboard manifest_parser · 70%
info
Tool: get-live-box-score manifest_parser · 70%
info
Tool: health manifest_parser · 70%
info
Tool: status manifest_parser · 70%
info
Tool: list-users manifest_parser · 70%
info
Tool: system-stats manifest_parser · 70%
info
Tool: git-status manifest_parser · 70%
info
Tool: image-resize manifest_parser · 70%
info
Tool: pdf-metadata manifest_parser · 70%
info
Tool: encode-video manifest_parser · 70%
low
Tool 'crashing-registered-tool' has no annotations annotation_checker · 100%
low
Tool 'sensitive-tool' has no annotations annotation_checker · 100%
low
Tool 'graceful-tool' has no annotations annotation_checker · 100%
low
Tool 'test-tool' has no annotations annotation_checker · 100%
low
Tool 'no-handler-tool' has no annotations annotation_checker · 100%
low
Tool 'pii-tool' has no annotations annotation_checker · 100%
low
Tool 'safe-tool' has no annotations annotation_checker · 100%
low
Tool 'crashing-tool' has no annotations annotation_checker · 100%
low
Tool 'sync-crash-tool' has no annotations annotation_checker · 100%
low
Tool 'args-test' has no annotations annotation_checker · 100%
low
Tool 'test-server' has no annotations annotation_checker · 100%
low
Tool 'echo' has no annotations annotation_checker · 100%
low
Tool 'http-server' has no annotations annotation_checker · 100%
low
Tool 'secure-server' has no annotations annotation_checker · 100%
medium
Buffer.from base64 in aself101-mcp-secure-server-5348b3e/src/security/layers/layer2-validators/base64-css.ts:85 entropy_analyzer · 75%
medium
Buffer.from base64 in aself101-mcp-secure-server-5348b3e/cookbook/image-gen-server/src/utils.ts:62 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: crashing-registered-tool manifest_parser · 85%
info
Tool: sensitive-tool manifest_parser · 85%
info
Tool: graceful-tool manifest_parser · 85%
info
Tool: test-tool manifest_parser · 85%
info
Tool: no-handler-tool manifest_parser · 70%
info
Tool: pii-tool manifest_parser · 70%
info
Tool: safe-tool manifest_parser · 70%
info
Tool: crashing-tool manifest_parser · 70%
info
Tool: sync-crash-tool manifest_parser · 70%
info
Tool: args-test manifest_parser · 70%
info
Tool: test-server manifest_parser · 75%
info
Tool: echo manifest_parser · 70%
info
Tool: http-server manifest_parser · 75%
info
Tool: secure-server manifest_parser · 75%
info
Tool: debug-calculator manifest_parser · 70%
info
Tool: debug-file-reader manifest_parser · 70%
info
Tool: debug-http manifest_parser · 70%
info
Tool: debug-parser manifest_parser · 70%
info
Tool: debug-image manifest_parser · 70%
info
Tool: calculator manifest_parser · 70%
info
Tool: connect-session manifest_parser · 70%
info
Tool: list-accounts manifest_parser · 70%
info
Tool: select-account manifest_parser · 70%
info
Tool: prepare-transaction manifest_parser · 70%
info
Tool: confirm-transaction manifest_parser · 70%
info
Tool: execute-transaction manifest_parser · 70%
info
Tool: check-status manifest_parser · 70%
info
Tool: disconnect-session manifest_parser · 70%
info
Tool: read-file manifest_parser · 70%
info
Tool: list-directory manifest_parser · 70%
info
Tool: search-files manifest_parser · 70%
info
Tool: write-log manifest_parser · 70%
info
Tool: get-ratings manifest_parser · 70%
info
Tool: get-program-ratings manifest_parser · 70%
info
Tool: generate-image manifest_parser · 70%
info
Tool: edit-image manifest_parser · 70%
info
Tool: upscale-image manifest_parser · 70%
info
Tool: create-variation manifest_parser · 70%
info
Tool: remove-background manifest_parser · 70%
info
Tool: replace-background manifest_parser · 70%
info
Tool: describe-image manifest_parser · 70%
info
Tool: list-models manifest_parser · 70%
info
Tool: financial-query manifest_parser · 70%
info
Tool: batch-process manifest_parser · 70%
info
Tool: export-data manifest_parser · 70%
info
Tool: api-call manifest_parser · 70%
info
Tool: save-note manifest_parser · 70%
info
Tool: search-notes manifest_parser · 70%
info
Tool: execute-command manifest_parser · 70%
info
Tool: query-data manifest_parser · 70%
info
Tool: get-policy-info manifest_parser · 70%
info
Tool: Alice manifest_parser · 75%
info
Tool: weather-forecast manifest_parser · 70%
info
Tool: currency-convert manifest_parser · 70%
info
Tool: news-headlines manifest_parser · 70%
info
Tool: get-security-metrics manifest_parser · 70%
info
Tool: get-audit-log manifest_parser · 70%
info
Tool: configure-alerts manifest_parser · 70%
info
Tool: export-metrics manifest_parser · 70%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (27) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 80%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 802 components sbom_generator · 100%
high
Hardcoded Password found in aself101-mcp-secure-server-5348b3e/cookbook/database-server/examples/unsafe-query.ts.example secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%