← Back to search

vantage-mcp-server

GitHub Actions Scanned 20d ago

Self-hosted (local) MCP server that runs the same tools as the [hosted Vantage MCP](https://mcp.vantage.sh/mcp). Use this package when you need API-token auth without OAuth, or when you cannot reach the hosted endpoint.

npm ↗
? Not scanned yet

Versions

2.20.0latest
Jul 28, 2026
2.19.0
Jul 22, 2026
2.18.0
Jul 21, 2026
2.17.0
Jul 14, 2026
2.16.0
Jul 10, 2026
+ show 23 moreshow less
2.15.0
Jul 7, 2026
2.14.0
Jul 1, 2026
2.13.0
Jun 3, 2026
2.12.0
Jun 1, 2026
2.11.0
May 11, 2026
2.10.0
May 6, 2026
2.9.1
May 1, 2026
2.9.0
Apr 29, 2026
2.8.0
Apr 16, 2026
2.7.0
Apr 15, 2026
2.6.7
Apr 13, 2026
2.6.6
Apr 8, 2026
2.6.4
Apr 2, 2026
2.6.3
Mar 17, 2026
2.6.2
Mar 16, 2026
2.6.1
Mar 12, 2026
2.6.0
Mar 12, 2026
2.5.0
Feb 20, 2026
2.4.0
Feb 10, 2026
2.3.0
Feb 6, 2026
2.2.0
Jan 14, 2026
2.0.0
Dec 11, 2025
0.1.0
Dec 11, 2025

Tools 0

No tools indexed yet.

Permissions 3

network medium
Server uses network capabilities via: fetch()
shell high
Server uses shell capabilities via: child_process, spawn(), spawnSync()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 13

high
Hardcoded OAuth client secret in vantage-sh-vantage-mcp-server-1a21e5f/worker-configuration.d.ts auth_checker · 95%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
info
OSV.dev API query failed dependency_analyzer · 100%
info
package.json metadata manifest_parser · 100%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (5) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 1257 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%