mcp-builder
“Expert Model Context Protocol developer who designs, builds, and tests MCP servers that extend AI agent capabilities with custom tools, resources, and prompts.”
aipkg.jsonLICENSE.txtmcp-builder.mdREADME.md- 01E1External Transmission50%MEDIUM
mcp-builder.md:131
detailhide
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if labels: params["labels"] = labels resp = await client.get( f"https://api.github.com/repos/{repo}/issues", params=params, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"}, )fix Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
- 02E2Env Variable Harvesting80%HIGH
mcp-builder.md:133
detailhide
Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.
resp = await client.get( f"https://api.github.com/repos/{repo}/issues", params=params, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"}, ) resp.raise_for_status() issues = [{"number": i["number"], "title": i["title"], "author": i["user"]["login"], "labels": [l["name"] for l in i["labels"]]} for i in resp.json()]fix Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials.