Sefaria MCP Server

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:25 AM UTC
• Version: 1.0.1

Overview

The skill appears to do what it claims, but its install and run instructions can execute an unpinned npm package that may differ from the reviewed artifact.

Review this before installing because the skill's current behavior is coherent, but the documented install path can fetch the latest npm package at run time. Prefer a pinned exact version or integrity-checked install, update dependencies, and run the MCP server with limited filesystem and environment access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: smithery.yaml:13

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:6-10
• SKILL.md:38-43
• smithery.yaml:13-15
• README.md:23-35

Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

SKILL.md:6-10:

yaml

install:
  - id: node
    kind: node
    package: sefaria-mcp-server
    bins:
      - sefaria-mcp

SKILL.md:38-43:

json

{
  "mcpServers": {
    "sefaria": {
      "command": "npx",
      "args": ["-y", "sefaria-mcp-server"]
    }
  }
}

smithery.yaml:13-15:

yaml

commandFunction:
  |-
  config => ({command: 'npx', args: ['-y', 'sefaria-mcp-server']})

README.md:23-35:

bash

npm install -g sefaria-mcp-server

Or run directly with npx:

bash

npx sefaria-mcp-server

The installed CLI binary is also available as sefaria-mcp:

bash

npx -y -p sefaria-mcp-server sefaria-mcp

Technical Analysis

The installation metadata and documented launch configurations identify the npm package only by name and do not pin an exact version or integrity digest. In particular, npx -y permits npm to download and immediately execute the version currently selected by the npm registry without interactive confirmation.

Consequently, reviewing the source code in this project does not guarantee that the same code will be executed by future installations. A newer package release can replace the audited implementation while retaining the same package name. This creates a supply-chain trust boundary around the npm publisher account, registry metadata, and latest published release.

The repository's package-lock.json provides integrity information for local dependency installation, but it does not protect the unversioned top-level package fetched through the documented npx and Smithery commands.

Attack Path

1. An attacker compromises the npm publisher account, publishing ...[truncated 1344 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every installation and execution command to an audited exact version, for example:

   json

   {
     "command": "npx",
     "args": ["-y", "sefaria-mcp-server@1.0.1"]
   }
   

2. Update SKILL.md, README.md, and smithery.yaml consistently so no supported installation path silently resolves the latest release.

3. Where the platform supports it, pin the package artifact by cryptographic integrity digest rather than relying only on a version number.

4. For source-based deployments, use npm ci with the committed lockfile instead of an unconstrained installation. Review lockfile changes before upgrading.

5. Adopt a controlled upgrade process that verifies npm provenance, release signatures or attestations, repository tags, package contents, and integrity hashes before changing the pinned version.

6. Run the MCP server under a least-privileged account with restricted filesystem access, limited environment variables, and constrained outbound network access to reduce the impact of a future supply-chain compromise.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Known Vulnerable Dependency: fast-uri==3.1.3 — 6 advisory(ies): CVE-2026-75931 (fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +3 more

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

fast-uri 3.1.3 is reported with multiple high-severity URI parsing flaws including host confusion and possible SSRF-relevant normalization issues. In an MCP/server context, URI parsing bugs can become dangerous if the service validates, rewrites, proxies, or fetches user-supplied URLs, so the dependency should be treated as a real vulnerability even though the lockfile does not prove active use of every affected feature.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.2.0 — 3 advisory(ies): CVE-2026-54272 (ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSR); CVE-2026-69198 (ip-address: a CIDR suffix on the parsed address suppresses special-use classific); CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco)

High

• Category: Supply Chain
• Confidence: 85% confidence

Finding

ip-address 10.2.0 is associated with parsing and classification flaws that can enable SSRF or network policy bypass when special-use or mapped addresses are mishandled. Since it is pulled in through express-rate-limit, this is a real dependency risk if the service makes security decisions based on parsed client/network addresses, particularly in internet-exposed deployments.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The announcement instructs users to run npx sefaria-mcp-server without pinning an exact package version. Because npx resolves the latest published package at execution time, users may unknowingly install and run a newly published malicious or compromised version, turning documentation into a software supply-chain risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This documentation again recommends npx sefaria-mcp-server without a pinned version, causing execution of whatever package version is current on npm. If the npm package is later compromised, typosquatted, or ownership is abused, readers following the instructions could execute attacker-controlled code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The README instructs users to run the MCP server via npx sefaria-mcp-server without pinning a specific version. This causes clients to fetch and execute whatever package version is current at install time, which creates a supply-chain risk if a malicious or compromised update is published or if an unexpected breaking version is released. In the MCP context, users are being told to execute this package locally as a server process, which increases the blast radius compared with a passive library dependency.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The command npx -y -p sefaria-mcp-server sefaria-mcp installs and executes an unpinned package version from the registry. If the package, maintainer account, dependency chain, or registry resolution path is compromised, users may run attacker-controlled code directly on their machine. Because this is presented as a one-line execution path for an MCP server, the risk is practical and more dangerous than a normal documentation typo: it encourages immediate code execution from the network.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill installs and runs an MCP server package that inherently performs outbound network access to Sefaria's public API, but the skill declares no explicit tool scope such as permissions or allowed-tools. This creates an overbroad trust boundary: consumers cannot easily tell that network access is required, and a compromised or updated package could make unexpected outbound requests beyond the documented API usage.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @hono/node-server==1.19.14 — 1 advisory(ies): GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode)

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

The lockfile pins @hono/node-server 1.19.14, which is reported as affected by a Windows path traversal issue in Hono's static file serving path handling. Even though a lockfile alone does not prove the vulnerable code path is used, this package is present as a runtime dependency of the MCP SDK, so the dependency risk is real if the skill exposes HTTP static serving on Windows.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: body-parser==2.2.2 — 1 advisory(ies): CVE-2026-12590 (body-parser vulnerable to denial of service when invalid limit value silently di)

Low

• Category: Supply Chain
• Confidence: 78% confidence

Finding

body-parser 2.2.2 is flagged for a denial-of-service condition tied to invalid limit handling. As a transitive dependency of Express in the MCP SDK stack, it represents a genuine supply-chain weakness, though exploitability depends on whether this skill accepts attacker-controlled HTTP request bodies through the affected parser path.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.27 — 7 advisory(ies): CVE-2026-71848 (Hono: Algorithmic Complexity DoS in Language Middleware); CVE-2026-71849 (Hono: Proxy Helper does not remove response headers listed in the `Connection` h); CVE-2026-69207 (Hono: ReDoS in CORS middleware via Access-Control-Request-Headers) +4 more

Low

• Category: Supply Chain
• Confidence: 75% confidence

Finding

hono 4.12.27 is flagged for several low-severity issues including middleware DoS and header handling weaknesses. Because this is brought in by the MCP SDK and may power HTTP transport features, the package-level risk is legitimate, but the actual impact for this skill depends on whether those middleware/helpers are enabled in deployment.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: qs==6.15.3 — 2 advisory(ies): CVE-2026-82417 (qs: Denial of Service via Attacker Controlled isBuffer); CVE-2026-82562 (qs array-limit bypass via bracket-key comma parsing)

Low

• Category: Supply Chain
• Confidence: 80% confidence

Finding

qs 6.15.3 is flagged for low-severity denial-of-service and parser limit bypass issues. As a common querystring parser used by Express/body-parser, this is a real transitive vulnerability, though it matters primarily if the skill exposes HTTP endpoints that parse attacker-controlled query strings or form bodies.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 40)May include surrounding context.

json

"url": "git+https://github.com/abeperl/sefaria-mcp-server.git"
  },
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.29.0",
    "zod": "^4.4.3"
  },
  "devDependencies": {

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 41)May include surrounding context.

json

},
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.29.0",
    "zod": "^4.4.3"
  },
  "devDependencies": {
    "@types/node": "^22.19.13",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 44)May include surrounding context.

json

"zod": "^4.4.3"
  },
  "devDependencies": {
    "@types/node": "^22.19.13",
    "typescript": "^5.9.3"
  },
  "engines": {

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 45)May include surrounding context.

json

},
  "devDependencies": {
    "@types/node": "^22.19.13",
    "typescript": "^5.9.3"
  },
  "engines": {
    "node": ">=18.0.0"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill description states that text is returned in Hebrew and English, and the search tool similarly limits supported queries to English and Hebrew. This is a natural-language locale constraint presented as a fixed behavior, with no user opt-in or explanation that the skill is intentionally language-limited.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The natural-language descriptions for the search tool say it supports English and Hebrew queries and label the query as 'English or Hebrew'. This creates a locale/language restriction in user-facing behavior without giving users a choice or documenting why the limitation exists.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.