Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a real MCP-to-HTTP bridge, but it exposes powerful tool calls and restarts without authentication and handles secrets too loosely.
Review before installing. Use this only on a tightly controlled machine, keep it bound to localhost or protected behind real authentication, restrict CORS, avoid exposing it to a network, pin and review all MCP server packages, and do not store API keys in config.json. Run it under a low-privilege account with minimal environment variables.
bridge.js:143Unauthenticated MCP Tool Invocation and Server Restart
bridge.js:177Unbounded HTTP Request Body Permits Memory Exhaustion
bridge.js:52MCP Child Processes Inherit the Entire Parent Environment
cli.js:19Secrets Are Persisted and Displayed in Plaintext
SKILL.md:31Documentation Recommends Unpinned Runtime Package Execution Through npx
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
console.log(`[${this.name}] Starting: ${command} ${args.join(' ')}`);
this.process = spawn(command, args, {
env: { ...process.env, ...env },
stdio: ['pipe', 'pipe', 'pipe']
});
This finding reflects credential handling behavior: the code accepts env values—likely secrets—and persists them to disk in plaintext under the server configuration. In the context of an HTTP bridge for MCP tools, those credentials may grant access to external APIs, repositories, or internal systems, so disclosure can have significant downstream impact.
}
const config = load();
if (!config.servers[server]) return console.log(`✗ Server '${server}' not found`);
config.servers[server].env = config.servers[server].env || {};
config.servers[server].env[key] = value;
save(config);
console.log(`✓ Set ${key} for '${server}'`);
The skill advertises network and environment-related capabilities but does not declare any explicit tool scope or permissions boundaries. In an agent ecosystem, this weakens reviewability and least-privilege guarantees, making it easier for the skill to access sensitive env data or perform network actions without clear operator consent.
Using npx @anthropic/mcp-github without pinning an exact version makes the deployed MCP server supply-chain mutable at runtime. A future malicious or compromised package release could be fetched and executed automatically, which is especially risky here because the bridge persists child processes and can pass through environment secrets such as API tokens.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# List servers
curl http://localhost:3456/
# List tools
curl http://localhost:3456/<server>/tools
The bridge launches configured commands as child processes, inheriting the host environment and allowing custom environment overrides. While starting MCP servers is part of the bridge's implementation, arbitrary command execution is a powerful capability that is broader than a simple REST exposure layer unless explicitly declared in the skill scope.
The POST /:server/call endpoint allows remote invocation of any MCP tool without authentication, authorization, or meaningful user confirmation. Because MCP tools may perform sensitive local or network actions, this bridge effectively turns them into remotely callable capabilities, which is especially dangerous combined with permissive CORS and optional IP filtering.
The bridge exposes an unauthenticated POST /:server/restart endpoint that allows any reachable client to stop and restart managed subprocesses. In this skill’s context, the bridge is intended to keep MCP servers alive and expose tools via HTTP, so exposing lifecycle control over REST materially expands the attack surface and enables denial of service or operational disruption.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The CLI stores arbitrary environment-variable values directly into config.json on disk, which will commonly include API keys, tokens, or other secrets for MCP servers. If file permissions are weak, backups are exposed, or the config is accidentally committed or shared, attackers can recover credentials and pivot into connected services.
show-config prints the entire configuration object, including per-server env values, directly to stdout. This can leak secrets into terminal scrollback, logs, shell history captures, CI output, or remote support sessions, making credential disclosure easy even without filesystem access.
The manifest describes a bridge that keeps MCP servers alive and exposes them over REST, but this CLI also invokes a host process manager command to restart a named service. Managing local system processes through pm2 is a privileged operational capability that goes beyond simple bridge configuration and is not explicitly stated in the manifest description.
The restart endpoint performs process control over managed MCP servers without any user-facing disclosure or access control. While the absence of disclosure alone is not the core issue, in practice this exposes administrative functionality to any reachable client and can be used to interrupt service or force repeated reinitialization.
The remove-server command deletes a configured server entry from config.json immediately after invocation. Although successful deletion is logged afterward, there is no prior confirmation prompt or warning for this destructive action, and the help text does not call out that the change is immediate.
Detected: suspicious.dangerous_exec