Trust Card · Static snapshot

mongodb-js__mongodb-mcp-server F

39/100 · 12 findings (7 critical) · scope excessive · Ranked #49 of 53 scanned.

Scanned 2026-09-09 · engine v0.1.0 (8 regex rules, OWASP-mapped) · upstream mongodb-js/mongodb-mcp-server @ 7d32cc4 (2026-09-08)

Score breakdown

security 0

permissions 20

provenance 80

reliability 85

stability 90

Score constrained by 7 critical and 4 high-severity findings.

Fix first (11 critical/high)

Severity	Rule	Finding	Remediation
CRITICAL	`AT-SEC-003` (ASI02)	Unbounded Dynamic Shell Execution `packages/eval-tests/src/scripts/reportCi.ts:82` Evidence: `const child = spawn(cmd, args, { stdio: ["inherit", "pipe", "inherit"], env });`	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	`AT-SEC-004` (ASI05)	eval() / Function Constructor Invocation `packages/eval-tests/src/scripts/reportCi.ts:129` Evidence: `/** Fetch branch history, then run eval (with optional baseline from history), render markdown, write report. */`	Eliminate eval(). Use safe AST parsers or isolated sandboxes (e.g. E2B Firecracker microVMs).
CRITICAL	`AT-SEC-003` (ASI02)	Unbounded Dynamic Shell Execution `packages/mongodb-mcp-server/scripts/createMcpb.ts:16` Evidence: `const child = spawn(cmd, args, { cwd, stdio: "inherit", shell: process.platform === "win32" });`	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	`AT-SEC-003` (ASI02)	Unbounded Dynamic Shell Execution `packages/setup/src/aiTool.ts:258` Evidence: `exec(cmd, (error) => {`	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	`AT-SEC-003` (ASI02)	Unbounded Dynamic Shell Execution `packages/tools-atlas/src/tools/create/createCluster.test.ts:501` Evidence: `const result = await exec(args);`	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	`AT-SEC-003` (ASI02)	Unbounded Dynamic Shell Execution `packages/tools-atlas/src/tools/update/pauseResumeCluster.test.ts:207` Evidence: `const result = await exec(args);`	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	`AT-SEC-004` (ASI05)	eval() / Function Constructor Invocation `packages/ui/src/lib/tools/list-databases.ts:7` Evidence: `export const ListDatabasesHtml = "<!doctype html>\n<html lang=\"en\">\n <head>\n <meta charset=\"UTF-8\" />\n <meta name=\"`	Eliminate eval(). Use safe AST parsers or isolated sandboxes (e.g. E2B Firecracker microVMs).
HIGH	`AT-SEC-005` (ASI02)	Unrestricted Recursive File Deletion / Modification `packages/accuracy-tests/src/sdk/accuracyResultStorage/diskStorage.ts:57` Evidence: `await fs.unlink(latestResultFilePath);`	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `packages/atlas-api-client/src/apiClient.ts:214` Evidence: `const response = await fetch(url, {`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `packages/mongodb-atlas-mcp-remote/src/cli.ts:182` Evidence: `const res = await baseFetch(url, init);`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	`AT-SEC-005` (ASI02)	Unrestricted Recursive File Deletion / Modification `packages/tools-mongodb/src/common/exportsManager.ts:348` Evidence: `await fs.unlink(exportPath);`	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.
MEDIUM	`AT-SEC-007` (LLM02)	Raw Secret Leakage in Debug Logging `packages/scripts/src/generate-release-notes.ts:120` Evidence: `console.log("GROVE_API_KEY is not set, skipping AI summary generation");`	Implement PII/secret redaction masks before writing to log streams.

Permissions

Scope: excessive · Shell: enabled · Network egress: yes · File deletion: enabled · Human approval: none

Provenance

License: Apache-2.0 · Lockfile: yes · Security policy: no · Signals: unverified origin

Independently scanned by the AgentTrust registry (not self-reported by the project). Static analysis only — no code executed, findings need human triage, counts may include test/example code. Static snapshot; re-scan before relying on it: npx @eulogik/agenttrust scan https://github.com/mongodb-js/mongodb-mcp-server. Scores move with every upstream commit; pages refresh weekly. How scoring works.