← All scanned servers

Trust Card · Static snapshot

modelcontextprotocol__inspector D

40/100 · 58 findings (29 critical) · scope excessive · Ranked #48 of 53 scanned.

Scanned 2026-09-09 · engine v0.1.0 (8 regex rules, OWASP-mapped) · upstream modelcontextprotocol/inspector @ 793d103 (2026-09-02)

Score breakdown

Score constrained by 29 critical and 28 high-severity findings.

Fix first (57 critical/high)

Severity	Rule	Finding	Remediation
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret clients/web/src/test/integration/auth/revocation-e2e.test.ts:41 Evidence: const OTHER_CLIENT_SECRET = "test-2144-other-secret";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret clients/web/src/test/integration/mcp/ema-mock-servers.ts:23 Evidence: export const EMA_MOCK_RESOURCE_CLIENT_SECRET = "ema-mock-resource-secret";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret clients/web/src/test/integration/mcp/inspectorClient-modern-era-oauth.test.ts:54 Evidence: const staticClientSecret = "test-secret-modern-era-oauth";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret clients/web/src/test/integration/mcp/inspectorClient-oauth-direct-mid-session-e2e.test.ts:69 Evidence: const staticClientSecret = "test-secret-direct-mid-session";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret clients/web/src/test/integration/mcp/inspectorClient-oauth-direct-mid-session-e2e.test.ts:146 Evidence: const staticClientSecret = "test-secret-direct-step-up";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret clients/web/src/test/integration/mcp/inspectorClient-oauth-e2e.test.ts:206 Evidence: const staticClientSecret = "test-static-secret-2";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret clients/web/src/test/integration/mcp/inspectorClient-oauth-e2e.test.ts:723 Evidence: const staticClientSecret = "test-secret-connect-no-nav";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret clients/web/src/test/integration/mcp/inspectorClient-oauth-e2e.test.ts:786 Evidence: const staticClientSecret = "test-secret-connect-retry-no-disconnect";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret clients/web/src/test/integration/mcp/inspectorClient-oauth-e2e.test.ts:1331 Evidence: const staticClientSecret = "test-offline-access-secret";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret clients/web/src/test/integration/mcp/inspectorClient-oauth-e2e.test.ts:1401 Evidence: const staticClientSecret = "test-no-offline-access-secret";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret clients/web/src/test/integration/mcp/inspectorClient-oauth-e2e.test.ts:1472 Evidence: const staticClientSecret = "test-inherited-offline-secret";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret clients/web/src/test/integration/mcp/inspectorClient-oauth-e2e.test.ts:1545 Evidence: const staticClientSecret = "test-as-migrate-secret";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret clients/web/src/test/integration/mcp/inspectorClient-oauth-remote-mid-session-e2e.test.ts:130 Evidence: const staticClientSecret = "test-secret-mid-session";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret clients/web/src/test/integration/mcp/inspectorClient-oauth-remote-mid-session-e2e.test.ts:215 Evidence: const staticClientSecret = "test-secret-reconnect-mid-session";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret clients/web/src/test/integration/mcp/inspectorClient-oauth-remote-mid-session-e2e.test.ts:455 Evidence: const staticClientSecret = "test-secret-resume-fallback";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret clients/web/src/test/integration/mcp/inspectorClient-oauth-remote-mid-session-e2e.test.ts:558 Evidence: const staticClientSecret = "test-secret-ambient-interactive";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret clients/web/src/test/integration/mcp/inspectorClient-oauth-remote-mid-session-e2e.test.ts:649 Evidence: const staticClientSecret = "test-secret-ambient-auth";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret clients/web/src/test/integration/mcp/inspectorClient-oauth-remote-storage-e2e.test.ts:270 Evidence: const staticClientSecret = "test-static-secret-reload";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret clients/web/src/test/integration/mcp/inspectorClient-oauth.test.ts:204 Evidence: const staticClientSecret = "test-auth-fetch-secret";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret clients/web/src/test/integration/mcp/inspectorClient-oauth.test.ts:437 Evidence: const staticClientSecret = "test-token-injection-secret";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret core/auth/node/file-secret-store.ts:109 Evidence: export const SECRET_KEY_ENV = "MCP_INSPECTOR_SECRET_KEY";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret core/auth/node/secret-store-selection.ts:76 Evidence: export const SECRET_STORE_ENV = "MCP_INSPECTOR_SECRET_STORE";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret core/auth/node/secret-store-selection.ts:79 Evidence: export const SECRET_FILE_ENV = "MCP_INSPECTOR_SECRET_FILE";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret core/mcp/remote/constants.ts:6 Evidence: export const LEGACY_AUTH_TOKEN_ENV = "MCP_PROXY_AUTH_TOKEN";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-003 (ASI02)	Unbounded Dynamic Shell Execution scripts/lib/announced-child.mjs:51 Evidence: const child = spawn(command, args, {	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	AT-SEC-003 (ASI02)	Unbounded Dynamic Shell Execution scripts/lib/claude-cli.mjs:65 Evidence: const res = spawn(command, args, options);	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	AT-SEC-003 (ASI02)	Unbounded Dynamic Shell Execution scripts/lib/npm-scripts.mjs:17 Evidence: while ((m = re.exec(command)) !== null) {	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	AT-SEC-003 (ASI02)	Unbounded Dynamic Shell Execution scripts/lib/render-smoke.mjs:143 Evidence: const child = spawn(command, args, {	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	AT-SEC-003 (ASI02)	Unbounded Dynamic Shell Execution scripts/verify-skills-cli.mjs:104 Evidence: const res = spawn(command, winShellArgs(args, platform), {	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
HIGH	AT-SEC-005 (ASI02)	Unrestricted Recursive File Deletion / Modification clients/cli/__tests__/relogin-revocation.test.ts:172 Evidence: fs.rmSync(path.dirname(catalogPath), { recursive: true, force: true });	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	AT-SEC-005 (ASI02)	Unrestricted Recursive File Deletion / Modification clients/cli/__tests__/relogin-revocation.test.ts:192 Evidence: fs.rmSync(path.dirname(catalogPath), { recursive: true, force: true });	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	AT-SEC-005 (ASI02)	Unrestricted Recursive File Deletion / Modification clients/web/src/test/integration/auth/node/file-lock.test.ts:451 Evidence: fs.rmSync(lockPath, { recursive: true, force: true });	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	AT-SEC-005 (ASI02)	Unrestricted Recursive File Deletion / Modification clients/web/src/test/integration/auth/node/storage.test.ts:26 Evidence: await fs.unlink(stateFilePath);	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	AT-SEC-005 (ASI02)	Unrestricted Recursive File Deletion / Modification clients/web/src/test/integration/auth/node/storage.test.ts:464 Evidence: await fs.unlink(persistTestPath);	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	AT-SEC-005 (ASI02)	Unrestricted Recursive File Deletion / Modification clients/web/src/test/integration/auth/node/storage.test.ts:483 Evidence: await fs.unlink(testStatePath);	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	AT-SEC-005 (ASI02)	Unrestricted Recursive File Deletion / Modification clients/web/src/test/integration/auth/node/storage.test.ts:544 Evidence: await fs.unlink(customPath);	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	AT-SEC-005 (ASI02)	Unrestricted Recursive File Deletion / Modification clients/web/src/test/integration/auth/node/storage.test.ts:587 Evidence: await fs.unlink(filePath).catch(() => {});	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	AT-SEC-005 (ASI02)	Unrestricted Recursive File Deletion / Modification clients/web/src/test/integration/auth/node/storage.test.ts:624 Evidence: await fs.unlink(customPath);	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	AT-SEC-005 (ASI02)	Unrestricted Recursive File Deletion / Modification clients/web/src/test/integration/mcp/inspectorClient-ema-e2e.test.ts:79 Evidence: await fs.unlink(oauthTestStatePath);	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	AT-SEC-006 (LLM06)	Unfiltered SSRF / Arbitrary Network Egress clients/web/src/test/integration/mcp/inspectorClient-ema-e2e.test.ts:61 Evidence: const res = await fetch(url);	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	AT-SEC-005 (ASI02)	Unrestricted Recursive File Deletion / Modification clients/web/src/test/integration/mcp/inspectorClient-oauth-e2e.test.ts:89 Evidence: await fs.unlink(oauthTestStatePath);	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	AT-SEC-005 (ASI02)	Unrestricted Recursive File Deletion / Modification clients/web/src/test/integration/mcp/inspectorClient-oauth-e2e.test.ts:1114 Evidence: await fs.unlink(customPath);	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	AT-SEC-006 (LLM06)	Unfiltered SSRF / Arbitrary Network Egress clients/web/src/test/integration/mcp/inspectorClient-oauth-e2e.test.ts:1133 Evidence: return fetch(input, init);	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	AT-SEC-005 (ASI02)	Unrestricted Recursive File Deletion / Modification clients/web/src/test/integration/mcp/inspectorClient-oauth-fetchFn.test.ts:52 Evidence: await fs.unlink(oauthTestStatePath);	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	AT-SEC-005 (ASI02)	Unrestricted Recursive File Deletion / Modification clients/web/src/test/integration/mcp/inspectorClient-oauth.test.ts:50 Evidence: await fs.unlink(oauthTestStatePath);	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	AT-SEC-006 (LLM06)	Unfiltered SSRF / Arbitrary Network Egress clients/web/src/test/integration/mcp/inspectorClient-xmcpheader-mirroring.test.ts:66 Evidence: return fetch(input, init);	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	AT-SEC-006 (LLM06)	Unfiltered SSRF / Arbitrary Network Egress clients/web/src/test/integration/mcp/inspectorClient.test.ts:3989 Evidence: await fetch(url!, {	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	AT-SEC-006 (LLM06)	Unfiltered SSRF / Arbitrary Network Egress clients/web/src/test/integration/mcp/oauth-resource-metadata-challenge.test.ts:135 Evidence: return fetch(input, init);	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	AT-SEC-006 (LLM06)	Unfiltered SSRF / Arbitrary Network Egress clients/web/src/test/integration/mcp/oauth-resource-metadata-challenge.test.ts:202 Evidence: fetch(input, init),	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	AT-SEC-005 (ASI02)	Unrestricted Recursive File Deletion / Modification clients/web/src/test/integration/mcp/test-server-protected-resource.test.ts:57 Evidence: fs.unlinkSync(invalidPath);	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	AT-SEC-006 (LLM06)	Unfiltered SSRF / Arbitrary Network Egress clients/web/src/test/integration/server/sandbox-controller.test.ts:154 Evidence: const res = await fetch(url);	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	AT-SEC-006 (LLM06)	Unfiltered SSRF / Arbitrary Network Egress clients/web/src/test/integration/server/sandbox-controller.test.ts:191 Evidence: const res = await fetch(url);	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	AT-SEC-006 (LLM06)	Unfiltered SSRF / Arbitrary Network Egress core/mcp/fetchTracking.ts:316 Evidence: response = await baseFetch(input, init);	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	AT-SEC-006 (LLM06)	Unfiltered SSRF / Arbitrary Network Egress core/mcp/node/authChallengeFetch.ts:15 Evidence: const response = await baseFetch(input, init);	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	AT-SEC-006 (LLM06)	Unfiltered SSRF / Arbitrary Network Egress core/mcp/node/authChallengeFetch.ts:60 Evidence: const response = await baseFetch(input, init);	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	AT-SEC-005 (ASI02)	Unrestricted Recursive File Deletion / Modification core/storage/store-io.ts:119 Evidence: await fs.unlink(filePath);	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	AT-SEC-006 (LLM06)	Unfiltered SSRF / Arbitrary Network Egress test-servers/src/test-helpers.ts:185 Evidence: const res = await fetch(url, { headers, signal: controller.signal });	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
MEDIUM	AT-SEC-007 (LLM02)	Raw Secret Leakage in Debug Logging clients/web/server/web-server-config.ts:217 Evidence: console.log(` Auth token: ${resolvedToken}\n`);	Implement PII/secret redaction masks before writing to log streams.

Permissions

Scope: excessive · Shell: enabled · Network egress: yes · File deletion: enabled · Human approval: none

Provenance

License: MIT · Lockfile: yes · Security policy: yes · Signals: present (documentary, not a safety verdict)