← Back to search

mcp4openapi

GitHub Actions Scanned 19d ago

Universal MCP server that generates tools from any OpenAPI specification

npm ↗
C
60.4 / 100

Versions

0.5.6latest
Mar 2, 2026
0.5.5
Mar 2, 2026
0.5.4
Feb 27, 2026
0.5.3
Feb 25, 2026
0.5.0
Feb 22, 2026
+ show 19 moreshow less
0.4.0
Feb 15, 2026
0.3.8
Feb 10, 2026
0.3.7
Feb 8, 2026
0.3.6
Feb 8, 2026
0.3.5
Feb 8, 2026
0.3.4
Feb 5, 2026
0.3.3
Feb 4, 2026
0.3.1
Feb 3, 2026
0.3.0
Jan 31, 2026
0.2.8
Dec 20, 2025
0.2.7
Dec 17, 2025
0.2.6
Dec 16, 2025
0.2.5
Dec 15, 2025
0.2.4
Dec 5, 2025
0.2.3
Dec 1, 2025
0.2.2
Nov 30, 2025
0.2.1
Nov 30, 2025
0.2.0
Nov 27, 2025
0.1.0
Nov 8, 2025
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 6

get_item
annotations: none low

Get item

valid_tool
annotations: none low

safe

deep_tool
annotations: none low

boundary_tool
annotations: none low

safe

t
annotations: none low

<b>bad</b>

manage_project_badges
annotations: none low

Permissions 4

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, fs.promises, fs/promises
shell high
Server uses shell capabilities via: child_process, execSync(), spawn()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 62

low
Tool 'get_item' has no annotations annotation_checker · 100%
low
Tool 'valid_tool' has no annotations annotation_checker · 100%
low
Tool 'deep_tool' has no annotations annotation_checker · 100%
low
Tool 'boundary_tool' has no annotations annotation_checker · 100%
low
Tool 't' has no annotations annotation_checker · 100%
low
Tool 'manage_project_badges' has no annotations annotation_checker · 100%
high
Hardcoded OAuth client secret in davidruzicka-mcp4openapi-eb10bf9/tests/e2e/branches-idempotency.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in davidruzicka-mcp4openapi-eb10bf9/tests/e2e/auth-oauth.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in davidruzicka-mcp4openapi-eb10bf9/tests/e2e/transport-http.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in davidruzicka-mcp4openapi-eb10bf9/src/transport/http-transport.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in davidruzicka-mcp4openapi-eb10bf9/src/transport/http-transport-security.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in davidruzicka-mcp4openapi-eb10bf9/src/transport/http-tenant-config.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in davidruzicka-mcp4openapi-eb10bf9/src/transport/http-transport-payload.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in davidruzicka-mcp4openapi-eb10bf9/src/transport/http-transport-oauth-toctou.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in davidruzicka-mcp4openapi-eb10bf9/src/auth/multi-auth.test.ts auth_checker · 95%
medium
Vulnerable dependency: vite@6.0.5 (GHSA-g4jq-h2w9-997c) dependency_analyzer · 95%
high
Hardcoded OAuth client secret in davidruzicka-mcp4openapi-eb10bf9/src/auth/oauth-provider.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in davidruzicka-mcp4openapi-eb10bf9/src/auth/oauth-pkce-security.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in davidruzicka-mcp4openapi-eb10bf9/src/testing/oauth-initialization.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in davidruzicka-mcp4openapi-eb10bf9/src/testing/oauth-security-issues.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in davidruzicka-mcp4openapi-eb10bf9/src/testing/http-multiauth-integration.test.ts auth_checker · 95%
high
Hardcoded OAuth client secret in davidruzicka-mcp4openapi-eb10bf9/src/testing/vscode-oauth.test.ts auth_checker · 95%
high
Hardcoded OAuth client ID in davidruzicka-mcp4openapi-eb10bf9/src/auth/client-store/policy.test.ts auth_checker · 85%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: qs@6.14.1 (GHSA-q8mj-m7cp-5q26) dependency_analyzer · 95%
medium
Vulnerable dependency: qs@6.14.1 (GHSA-w7fw-mjwx-w883) dependency_analyzer · 95%
medium
Vulnerable dependency: yaml@2.6.1 (GHSA-48c2-rrv3-qjmp) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.5 (GHSA-356w-63v5-8wf4) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.5 (GHSA-4r4m-qw57-chr8) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.5 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.5 (GHSA-859w-5945-r5v3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.5 (GHSA-93m4-6634-74q7) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.5 (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.5 (GHSA-jqfw-vq24-v9c3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.5 (GHSA-p9ff-h696-f583) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.5 (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.5 (GHSA-vg6x-rcgg-rjx6) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.5 (GHSA-x574-m823-4x7w) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@6.0.5 (GHSA-xcj6-pq6g-qj4x) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@4.0.18 (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
medium
Hex string literal (>50 chars) in davidruzicka-mcp4openapi-eb10bf9/scripts/workflow-security.test.ts:197 entropy_analyzer · 70%
medium
Buffer.from base64 in davidruzicka-mcp4openapi-eb10bf9/src/tooling/proxy-executor.ts:531 entropy_analyzer · 75%
medium
Buffer.from base64 in davidruzicka-mcp4openapi-eb10bf9/src/transport/http-transport.ts:2172 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: get_item manifest_parser · 90%
info
Tool: valid_tool manifest_parser · 90%
info
Tool: deep_tool manifest_parser · 90%
info
Tool: boundary_tool manifest_parser · 90%
info
Tool: t manifest_parser · 90%
info
Tool: manage_project_badges manifest_parser · 75%
info
Transport: streamable-http manifest_parser · 80%
high
Authorization Bearer Token found in davidruzicka-mcp4openapi-eb10bf9/.planning/milestones/v1.0-phases/01-upstream-session-foundation/01-05-PLAN.md secret_scanner · 70%
info
Required env vars (142) manifest_parser · 80%
medium
Hardcoded OAuth client ID in davidruzicka-mcp4openapi-eb10bf9/src/auth/client-store/policy.test.ts oauth_scope_analyzer · 80%
high
High-risk OAuth scope: admin oauth_scope_analyzer · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 479 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%