com.mux/mcp

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• code-tool-worker.js:26mcp-js-dynamic-code-execution (critical/medium)

  Caller-influenced input reaches an evaluator. eval, the Function constructor and vm.runInNewContext all execute their argument; none of them sandbox anything by default, vm least of all despite the name.

      try {
          let run_ = async (client) => { };
          eval(`
        ${code}
        run_ = run;

• code-tool-worker.mjs:21mcp-js-dynamic-code-execution (critical/medium)

  Caller-influenced input reaches an evaluator. eval, the Function constructor and vm.runInNewContext all execute their argument; none of them sandbox anything by default, vm least of all despite the name.

      try {
          let run_ = async (client) => { };
          eval(`
        ${code}
        run_ = run;

• src/code-tool-worker.ts:25mcp-js-dynamic-code-execution (critical/medium)

  Caller-influenced input reaches an evaluator. eval, the Function constructor and vm.runInNewContext all execute their argument; none of them sandbox anything by default, vm least of all despite the name.

    try {
      let run_ = async (client: any) => {};
      eval(`
        ${code}
        run_ = run;

• compat.js:247mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

              }
              else {
                  result[key] = processed;
              }
          }

• compat.js:279mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

              for (const key in firstVariant) {
                  if (key !== 'properties') {
                      result[key] = firstVariant[key];
                  }
              }

• compat.js:287mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

      for (const key in result) {
          if (result[key] && typeof result[key] === 'object') {
              result[key] = removeAnyOf(result[key]);
          }
      }

• compat.js:318mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

      for (const key in result) {
          if (result[key] && typeof result[key] === 'object') {
              result[key] = removeFormats(result[key], formatsCapability);
          }
      }

• compat.mjs:238mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

              }
              else {
                  result[key] = processed;
              }
          }

• compat.mjs:270mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

              for (const key in firstVariant) {
                  if (key !== 'properties') {
                      result[key] = firstVariant[key];
                  }
              }

• compat.mjs:278mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

      for (const key in result) {
          if (result[key] && typeof result[key] === 'object') {
              result[key] = removeAnyOf(result[key]);
          }
      }

• compat.mjs:309mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

      for (const key in result) {
          if (result[key] && typeof result[key] === 'object') {
              result[key] = removeFormats(result[key], formatsCapability);
          }
      }

• src/compat.ts:311mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

          delete result[key];
        } else {
          result[key] = processed;
        }
      }

• src/compat.ts:349mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

        for (const key in firstVariant) {
          if (key !== 'properties') {
            result[key] = firstVariant[key];
          }
        }

• src/compat.ts:359mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

    for (const key in result) {
      if (result[key] && typeof result[key] === 'object') {
        result[key] = removeAnyOf(result[key] as JSONSchema);
      }
    }

• src/compat.ts:398mcp-js-prototype-pollution-merge-loop (medium/medium)

  Keys from a caller-supplied object are copied onto a target without excluding __proto__ / constructor / prototype. A tool argument carrying __proto__ then mutates Object.prototype for the whole process, which can turn an unrelated later property read into attacker-controlled data.

    for (const key in result) {
      if (result[key] && typeof result[key] === 'object') {
        result[key] = removeFormats(result[key] as JSONSchema, formatsCapability);
      }
    }

Auth Posture

• authentication_model

  registry declares credential header(s) Authorization that are not required on every declared endpoint, and the source we fetched shows no enforcement — `03` §4's "authentication present but optional" band; 1 of 1 declared remote endpoint(s) require no credential header: https://mcp.mux.com

• transport_security

  declared endpoint(s) are HTTPS: https://mcp.mux.com; scored 80, not 100: `03` §4 reserves 100 for HTTPS *with HSTS*, and an HSTS header can only be seen by connecting, which `04` §9 does not do. This is an unverifiable band, not an observed absence.

• secret_handling

  detect-secrets matched 3 credential-shaped string(s), every one from a keyword or entropy heuristic (Secret Keyword). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Secret Keyword at README.md:21; Secret Keyword at README.md:22; Secret Keyword at README.md:24

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Maintenance

• recency

  last commit 11 day(s) before 2026-10-16

• issue_responsiveness

  only 2 issue(s) from outside the project fall inside `03` §5's 6-month window, which is under §5's floor of 3, and §5's lifetime-median fallback needs this repository's whole issue history — more of it than `04` §7's bounded fetch reads. A limit of ours, not a finding about the server.

• release_cadence

  released 11 day(s) ago (by releases), inside `03` §5's 30-day window

• bus_factor

  sole maintainer

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'Apache-2.0' from its text

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)

• declared_scopes

  neither the README nor the MCP manifest documents what the server accesses or what side effects it has

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately