← All scanned servers

Trust Card · Static snapshot

upstash__context7 D

40/100 · 12 findings (6 critical) · scope excessive · Ranked #46 of 53 scanned.

Scanned 2026-09-09 · engine v0.1.0 (8 regex rules, OWASP-mapped) · upstream upstash/context7 @ 9ab8554 (2026-09-09)

Score breakdown

Score constrained by 6 critical and 6 high-severity findings.

Fix first (12 critical/high)

Severity	Rule	Finding	Remediation
CRITICAL	AT-SEC-003 (ASI02)	Unbounded Dynamic Shell Execution packages/cli/src/commands/upgrade.ts:35 Evidence: const child = spawn(command, args, {	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret packages/mcp/test/integration.test.ts:278 Evidence: const apiKey = "ctx7sk-advertised-header-test";	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-003 (ASI02)	Unbounded Dynamic Shell Execution packages/sdk/src/commands/get-context/index.test.ts:48 Evidence: await expect(command.exec(requesterWith("documentation text"))).resolves.toBe(	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	AT-SEC-003 (ASI02)	Unbounded Dynamic Shell Execution packages/sdk/src/commands/search-library/index.test.ts:24 Evidence: await expect(command.exec(requesterWith(apiResult))).resolves.toEqual([	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	AT-SEC-003 (ASI02)	Unbounded Dynamic Shell Execution packages/sdk/src/commands/search-library/index.test.ts:42 Evidence: const result = await command.exec(requesterWith(apiResult));	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
CRITICAL	AT-SEC-003 (ASI02)	Unbounded Dynamic Shell Execution packages/sdk/src/commands/search-library/index.test.ts:51 Evidence: const error = await command.exec(requesterWith(undefined)).catch((e) => e);	Strictly restrict shell execution to an immutable allowlist of binary commands with explicit argument arrays, or execute inside microVM sandboxes.
HIGH	AT-SEC-006 (LLM06)	Unfiltered SSRF / Arbitrary Network Egress packages/cli/src/utils/auth.ts:215 Evidence: return await fetch(url, {	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	AT-SEC-006 (LLM06)	Unfiltered SSRF / Arbitrary Network Egress packages/mcp/src/lib/api.ts:130 Evidence: const response = await fetch(url, { headers, signal: AbortSignal.timeout(API_TIMEOUT_MS) });	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	AT-SEC-006 (LLM06)	Unfiltered SSRF / Arbitrary Network Egress packages/mcp/src/lib/api.ts:163 Evidence: const response = await fetch(url, { headers, signal: AbortSignal.timeout(API_TIMEOUT_MS) });	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	AT-SEC-006 (LLM06)	Unfiltered SSRF / Arbitrary Network Egress packages/pi/lib/api.ts:43 Evidence: const response = await fetch(url, { headers: authHeaders() });	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	AT-SEC-006 (LLM06)	Unfiltered SSRF / Arbitrary Network Egress packages/pi/lib/api.ts:55 Evidence: const response = await fetch(url, { headers: authHeaders() });	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).
HIGH	AT-SEC-006 (LLM06)	Unfiltered SSRF / Arbitrary Network Egress packages/sdk/src/http/index.ts:132 Evidence: response = await this.fetch(url, { ...init, headers });	Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254).

Permissions

Scope: excessive · Shell: enabled · Network egress: yes · File deletion: enabled · Human approval: none

Provenance

License: MIT · Lockfile: yes · Security policy: yes · Signals: present (documentary, not a safety verdict)