Evaluation report
Warningsvulnerable-mcp-server-indirect-prompt-injection · mcp47b7f20· 3 months ago
Every check MetaHub ran on this artifact, grouped by area. Static checks run on the source at publish time; behavioral checks run the artifact in a sandbox and judge what it actually does.
Structural
5 passedRepository is reachable
https://github.com/appsecco/vulnerable-mcp-servers-lab @ 47b7f20 — ★ 264 · JavaScript · MIT · last push 7 months ago
Manifest detected
kind=mcp slug=vulnerable-mcp-server-indirect-prompt-injection · path=vulnerable-mcp-server-indirect-prompt-injection · source=package.json
Slug is URL-safe
"vulnerable-mcp-server-indirect-prompt-injection" matches /^[a-z0-9][a-z0-9-]{0,62}$/
Slug is unique within kind
No collision found for mcp/vulnerable-mcp-server-indirect-prompt-injection
Version is semver
1.0.0
Documentation
5 passedDescription quality
11 words · 90 chars — OK but more detail helps
README is present and substantial
5,166 chars · 7 sections
Tags / topics declared
16 total — mcp, server, tools, security, prompt-injection, vulnerability-demo (+10)
README has usage / example sections
found: Getting started
Homepage / docs URL declared
no homepage declared (registry will use the repo URL) — info-only, not blocking
Safety
2 passed1 warningDependencies: known vulnerabilitieswarn
2 high/critical advisories — @modelcontextprotocol/[email protected] (HIGH: GHSA-8r9q-7v3j-jr4g) · @modelcontextprotocol/[email protected] (HIGH: GHSA-w48q-cv73-mx4w)
Update the affected packages, then re-publish. (`npm audit` shows the same data locally.)
LICENSE file at repo root
LICENSE
No sensitive files in the repo
scanned for .env, credentials.json, *.pem, .ssh/, AWS / GCP configs — none found
Kind-specific
5 passedMCP: launch path
bin: vulnerable-mcp-server-indirect-prompt-injection · scripts.start
MCP: @modelcontextprotocol/sdk in dependencies
pinned at "^1.0.4"
MCP: SDK version pinned
pinned at "^1.0.4"
MCP: ESM package
"type": "module"
MCP: server surface
0 tools
Maintenance
3 warningsRecent activitywarn
last push 7 months ago — looks slowing down
Consumers prefer artifacts that are actively maintained (threshold: 90 days, configurable via EVAL_RECENCY_PASS_DAYS).
Tests detectedwarn
no test/tests/__tests__/spec/t/ dirs, no JVM src/test/, and no JS/TS/Python/Go/Ruby/Elixir test files
Add tests (even a smoke test). Consumers gauge maintenance quality by their presence.
CI configuration detectedwarn
no CI config found (looked for GitHub Actions, CircleCI, GitLab CI, etc.)
Add a simple workflow (lint + test on PR) — it tells consumers the artifact is built reproducibly.