Trust Card · Static snapshot

mcp-use__mcp-use F

37/100 · 52 findings (22 critical) · scope excessive · Ranked #51 of 53 scanned.

Scanned 2026-09-09 · engine v0.1.0 (8 regex rules, OWASP-mapped) · upstream mcp-use/mcp-use @ 2ef6367 (2026-09-08)

Score breakdown

security 0

permissions 20

provenance 75

reliability 85

stability 75

Score constrained by 22 critical and 23 high-severity findings.

Fix first (45 critical/high)

Severity	Rule	Finding	Remediation
CRITICAL	`AT-SEC-002` (LLM02)	Hardcoded Credential or API Secret `libraries/python/mcp_use/telemetry/telemetry.py:131` Evidence: `PROJECT_API_KEY = "phc_lyTtbYwvkdSbrcMQNPiKiiRWrrM1seyKIMjycSvItEI"`	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	`AT-SEC-004` (ASI05)	eval() / Function Constructor Invocation `libraries/python/tests/unit/test_code_executor.py:153` Evidence: `code = "eval('1 + 1')"`	Eliminate eval(). Use safe AST parsers or isolated sandboxes (e.g. E2B Firecracker microVMs).
CRITICAL	`AT-SEC-003` (ASI02)	Unbounded Dynamic Shell Execution `libraries/typescript/packages/cli/src/commands/load-client.ts:241` Evidence: `const child = spawn(command, args, {`	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	`AT-SEC-003` (ASI02)	Unbounded Dynamic Shell Execution `libraries/typescript/packages/client/src/auth/node.ts:602` Evidence: `const child = spawn(cmd, args, { stdio: "ignore", detached: true });`	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	`AT-SEC-002` (LLM02)	Hardcoded Credential or API Secret `libraries/typescript/packages/client/src/telemetry/telemetry.ts:50` Evidence: `const PROJECT_API_KEY = "phc_lyTtbYwvkdSbrcMQNPiKiiRWrrM1seyKIMjycSvItEI";`	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	`AT-SEC-004` (ASI05)	eval() / Function Constructor Invocation `libraries/typescript/packages/client/tests/unit/client/executor-e2b-shim.test.ts:28` Evidence: `const run = new Function("global", "console", shim);`	Eliminate eval(). Use safe AST parsers or isolated sandboxes (e.g. E2B Firecracker microVMs).
CRITICAL	`AT-SEC-004` (ASI05)	eval() / Function Constructor Invocation `libraries/typescript/packages/client/tests/unit/client/executor-e2b-shim.test.ts:47` Evidence: `expect(() => new Function(shim)).not.toThrow();`	Eliminate eval(). Use safe AST parsers or isolated sandboxes (e.g. E2B Firecracker microVMs).
CRITICAL	`AT-SEC-004` (ASI05)	eval() / Function Constructor Invocation `libraries/typescript/packages/client/tests/unit/client/executor-e2b-shim.test.ts:62` Evidence: `expect(() => new Function(shim)).not.toThrow();`	Eliminate eval(). Use safe AST parsers or isolated sandboxes (e.g. E2B Firecracker microVMs).
CRITICAL	`AT-SEC-004` (ASI05)	eval() / Function Constructor Invocation `libraries/typescript/packages/client/tests/unit/client/executor-e2b-shim.test.ts:78` Evidence: `expect(() => new Function(shim)).not.toThrow();`	Eliminate eval(). Use safe AST parsers or isolated sandboxes (e.g. E2B Firecracker microVMs).
CRITICAL	`AT-SEC-004` (ASI05)	eval() / Function Constructor Invocation `libraries/typescript/packages/client/tests/unit/inject-openai-file-apis.test.ts:18` Evidence: `new Function(script!.textContent!)();`	Eliminate eval(). Use safe AST parsers or isolated sandboxes (e.g. E2B Firecracker microVMs).
CRITICAL	`AT-SEC-002` (LLM02)	Hardcoded Credential or API Secret `libraries/typescript/packages/client/tests/unit/transport/stdio-env.test.ts:5` Evidence: `const SECRET_KEY = "MCP_USE_STDIO_ENV_LEAK_PROBE";`	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	`AT-SEC-002` (LLM02)	Hardcoded Credential or API Secret `libraries/typescript/packages/inspector/tests/e2e/fixtures/google-emulate-server.ts:16` Evidence: `const STATIC_CLIENT_SECRET = "GOCSPX-mcp-emulate-test-secret";`	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	`AT-SEC-003` (ASI02)	Unbounded Dynamic Shell Execution `libraries/typescript/packages/inspector/tests/e2e/scripts/run-python-e2e.mjs:55` Evidence: `const proc = spawn(command, args, {`	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	`AT-SEC-003` (ASI02)	Unbounded Dynamic Shell Execution `libraries/typescript/packages/inspector/tests/e2e/scripts/run-python-e2e.mjs:81` Evidence: `const proc = spawn(command, args, {`	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	`AT-SEC-003` (ASI02)	Unbounded Dynamic Shell Execution `libraries/typescript/packages/inspector/tests/e2e/scripts/run-test-matrix.mjs:77` Evidence: `const proc = spawn(command, args, {`	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	`AT-SEC-003` (ASI02)	Unbounded Dynamic Shell Execution `libraries/typescript/packages/inspector/tests/e2e/scripts/run-test-matrix.mjs:104` Evidence: `const proc = spawn(command, args, {`	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	`AT-SEC-003` (ASI02)	Unbounded Dynamic Shell Execution `libraries/typescript/packages/inspector/tests/e2e/scripts/run-tunnel-test.mjs:72` Evidence: `const proc = spawn(command, args, {`	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	`AT-SEC-003` (ASI02)	Unbounded Dynamic Shell Execution `libraries/typescript/packages/inspector/tests/e2e/scripts/run-tunnel-test.mjs:101` Evidence: `const proc = spawn(command, args, {`	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	`AT-SEC-003` (ASI02)	Unbounded Dynamic Shell Execution `libraries/typescript/packages/server/examples/verify-examples.mjs:617` Evidence: `const child = spawn(command, args, {`	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	`AT-SEC-002` (LLM02)	Hardcoded Credential or API Secret `libraries/typescript/packages/server/tests/oauth-direct-providers.test.ts:422` Evidence: `const secret = "0123456789abcdef0123456789abcdef";`	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	`AT-SEC-002` (LLM02)	Hardcoded Credential or API Secret `libraries/typescript/packages/server/tests/oauth-direct-providers.test.ts:505` Evidence: `const secret = "0123456789abcdef0123456789abcdef";`	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	`AT-SEC-002` (LLM02)	Hardcoded Credential or API Secret `libraries/typescript/packages/server/tests/oauth-direct-providers.test.ts:523` Evidence: `const secret = "0123456789abcdef0123456789abcdef";`	Move credentials to secure environment variables or a key vault. Never commit API keys.
HIGH	`AT-SEC-005` (ASI02)	Unrestricted Recursive File Deletion / Modification `examples/typescript/excalidraw/src/checkpoint-store.ts:82` Evidence: `fs.promises.unlink(path.join(this.dir, f.name)).catch(() => {})`	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	`AT-SEC-005` (ASI02)	Unrestricted Recursive File Deletion / Modification `libraries/python/tests/unit/test_client.py:64` Evidence: `os.unlink(temp_path)`	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	`AT-SEC-005` (ASI02)	Unrestricted Recursive File Deletion / Modification `libraries/python/tests/unit/test_client.py:84` Evidence: `os.unlink(temp_path)`	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	`AT-SEC-005` (ASI02)	Unrestricted Recursive File Deletion / Modification `libraries/python/tests/unit/test_client.py:196` Evidence: `os.unlink(temp_path)`	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	`AT-SEC-005` (ASI02)	Unrestricted Recursive File Deletion / Modification `libraries/python/tests/unit/test_config.py:35` Evidence: `os.unlink(temp_path)`	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `libraries/typescript/packages/agent/src/llm/providers/google.ts:202` Evidence: `const res = await fetch(url, {`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `libraries/typescript/packages/agent/src/llm/providers/google.ts:278` Evidence: `const res = await fetch(url, {`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `libraries/typescript/packages/cli/src/commands/screenshot.ts:732` Evidence: `const response = await fetch(url);`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `libraries/typescript/packages/client/examples/conformance/src/oauth-retry-fetch.ts:142` Evidence: `let response = await innerFetch(input, init);`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `libraries/typescript/packages/client/examples/conformance/src/oauth-retry-fetch.ts:230` Evidence: `response = await innerFetch(url, newInit);`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	`AT-SEC-005` (ASI02)	Unrestricted Recursive File Deletion / Modification `libraries/typescript/packages/client/src/code-mode/executor-e2b.ts:88` Evidence: `fs.unlinkSync(resultPath); // Clean up`	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `libraries/typescript/packages/client/src/telemetry/tel-fetch.ts:5` Evidence: `export async function telFetch(url: string, init?: RequestInit): Promise<void> {`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `libraries/typescript/packages/client/src/telemetry/tel-fetch.ts:7` Evidence: `await fetch(url, init);`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `libraries/typescript/packages/client/src/transport/http.ts:176` Evidence: `return baseFetch(input, { ...init, signal: deadlineSignal });`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `libraries/typescript/packages/client/src/transport/http.ts:194` Evidence: `return await baseFetch(input, { ...init, signal: controller.signal });`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `libraries/typescript/packages/client/src/transport/http.ts:658` Evidence: `const response = await baseFetch(input, init);`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `libraries/typescript/packages/inspector/src/client/auth/manufact-auth.ts:247` Evidence: `const res = await fetch(url.toString(), {`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `libraries/typescript/packages/inspector/src/server/proxy/oauth-proxy.ts:728` Evidence: `async function safeFetch(url: URL, init: RequestInit): Promise<Response> {`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `libraries/typescript/packages/inspector/src/server/proxy/oauth-proxy.ts:729` Evidence: `return fetch(url, init);`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `libraries/typescript/packages/inspector/tests/e2e/connection.test.ts:1047` Evidence: `const response = await fetch(url, {`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	`AT-SEC-005` (ASI02)	Unrestricted Recursive File Deletion / Modification `libraries/typescript/packages/server/examples/views/excalidraw/src/checkpoint-store.ts:82` Evidence: `fs.promises.unlink(path.join(this.dir, f.name)).catch(() => {})`	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `libraries/typescript/packages/server/tests/oauth-introspection.test.ts:338` Evidence: `return fetch(url, {`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `libraries/typescript/scripts/release-channel.mjs:281` Evidence: `const response = await fetch(url, {`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
MEDIUM	`AT-SEC-007` (LLM02)	Raw Secret Leakage in Debug Logging `libraries/typescript/packages/client/examples/node/auth/oauth-flow.ts:96` Evidence: `console.log("authorization URL:", url);`	Implement PII/secret redaction masks before writing to log streams.
MEDIUM	`AT-SEC-007` (LLM02)	Raw Secret Leakage in Debug Logging `libraries/typescript/packages/client/examples/node/auth/oauth-flow.ts:122` Evidence: `console.log("OAuth flow complete:", tokens.token_type, tokens.expires_in);`	Implement PII/secret redaction masks before writing to log streams.
MEDIUM	`AT-SEC-007` (LLM02)	Raw Secret Leakage in Debug Logging `libraries/typescript/packages/inspector/src/client/components/OAuthCallback.tsx:18` Evidence: `console.log("[OAuthCallback] Component mounted, handling authorization...");`	Implement PII/secret redaction masks before writing to log streams.
MEDIUM	`AT-SEC-007` (LLM02)	Raw Secret Leakage in Debug Logging `libraries/typescript/packages/inspector/src/client/components/OAuthCallback.tsx:24` Evidence: `console.log("[OAuthCallback] Authorization successful");`	Implement PII/secret redaction masks before writing to log streams.
MEDIUM	`AT-SEC-007` (LLM02)	Raw Secret Leakage in Debug Logging `libraries/typescript/packages/inspector/src/client/hooks/useAutoConnect.ts:389` Evidence: console.log(`[useAutoConnect] Pre-stored OAuth tokens for ${url}`);	Implement PII/secret redaction masks before writing to log streams.
MEDIUM	`AT-SEC-007` (LLM02)	Raw Secret Leakage in Debug Logging `libraries/typescript/packages/inspector/start-auth-servers.ts:34` Evidence: `console.log(" API Key: Authorization: Bearer test-api-key-12345");`	Implement PII/secret redaction masks before writing to log streams.
MEDIUM	`AT-SEC-007` (LLM02)	Raw Secret Leakage in Debug Logging `libraries/typescript/packages/inspector/start-auth-servers.ts:35` Evidence: `console.log(" Custom Header: X-Custom-Auth: custom-auth-token-xyz");`	Implement PII/secret redaction masks before writing to log streams.

Permissions

Scope: excessive · Shell: enabled · Network egress: yes · File deletion: enabled · Human approval: none

Provenance

License: MIT · Lockfile: no · Security policy: yes · Signals: unverified origin

Independently scanned by the AgentTrust registry (not self-reported by the project). Static analysis only — no code executed, findings need human triage, counts may include test/example code. Static snapshot; re-scan before relying on it: npx @eulogik/agenttrust scan https://github.com/mcp-use/mcp-use. Scores move with every upstream commit; pages refresh weekly. How scoring works.