Trust Card · Static snapshot

neondatabase__mcp-server-neon D

50/100 · 11 findings (8 critical) · scope excessive · Ranked #39 of 53 scanned.

Scanned 2026-09-09 · engine v0.1.0 (8 regex rules, OWASP-mapped) · upstream neondatabase/mcp-server-neon @ be54e78 (2026-09-07)

Score breakdown

security 0

permissions 55

provenance 90

reliability 85

stability 100

Score constrained by 8 critical and 3 high-severity findings.

Fix first (11 critical/high)

Severity	Rule	Finding	Remediation
CRITICAL	`AT-SEC-002` (LLM02)	Hardcoded Credential or API Secret `mcp/__tests__/transport-dynamic-tools.integration.test.ts:239` Evidence: `const oauthToken = 'oauth-client-application';`	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	`AT-SEC-002` (LLM02)	Hardcoded Credential or API Secret `mcp/__tests__/transport-dynamic-tools.integration.test.ts:317` Evidence: `const oauthToken = 'oauth-unclassified-dcr';`	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	`AT-SEC-002` (LLM02)	Hardcoded Credential or API Secret `mcp/__tests__/transport-dynamic-tools.integration.test.ts:397` Evidence: `const oauthToken = 'oauth-handshake-wins';`	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	`AT-SEC-002` (LLM02)	Hardcoded Credential or API Secret `mcp/__tests__/transport-dynamic-tools.integration.test.ts:543` Evidence: `const oauthToken = 'oauth-unscoped-with-query';`	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	`AT-SEC-004` (ASI05)	eval() / Function Constructor Invocation `mcp/oauth/refresh-lock.ts:216` Evidence: `redis.eval(HEARTBEAT_LUA, {`	Eliminate eval(). Use safe AST parsers or isolated sandboxes (e.g. E2B Firecracker microVMs).
CRITICAL	`AT-SEC-004` (ASI05)	eval() / Function Constructor Invocation `mcp/oauth/refresh-lock.ts:238` Evidence: `redis.eval(RELEASE_WITH_TRANSIENT_LUA, {`	Eliminate eval(). Use safe AST parsers or isolated sandboxes (e.g. E2B Firecracker microVMs).
CRITICAL	`AT-SEC-004` (ASI05)	eval() / Function Constructor Invocation `mcp/oauth/refresh-lock.ts:246` Evidence: `redis.eval(RELEASE_LUA, { keys: [lkey], arguments: [owner] }),`	Eliminate eval(). Use safe AST parsers or isolated sandboxes (e.g. E2B Firecracker microVMs).
CRITICAL	`AT-SEC-004` (ASI05)	eval() / Function Constructor Invocation `mcp/oauth/refresh-lock.ts:338` Evidence: `redis.eval(RELEASE_LUA, { keys: [key], arguments: [owner] }),`	Eliminate eval(). Use safe AST parsers or isolated sandboxes (e.g. E2B Firecracker microVMs).
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `lib/oauth/client.ts:191` Evidence: `return globalThis.fetch(input, init);`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `lib/oauth/client.ts:193` Evidence: `return globalThis.fetch(input, {`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	`AT-SEC-006` (LLM06)	Unfiltered SSRF / Arbitrary Network Egress `mcp/tools/handlers/docs.ts:52` Evidence: `const response = await fetch(url, {`	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).

Permissions

Scope: excessive · Shell: disabled · Network egress: yes · File deletion: none · Human approval: none

Provenance

License: MIT · Lockfile: yes · Security policy: no · Signals: present (documentary, not a safety verdict)

Independently scanned by the AgentTrust registry (not self-reported by the project). Static analysis only — no code executed, findings need human triage, counts may include test/example code. Static snapshot; re-scan before relying on it: npx @eulogik/agenttrust scan https://github.com/neondatabase/mcp-server-neon. Scores move with every upstream commit; pages refresh weekly. How scoring works.