io.github.pubnub/mcp-server

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• src/lib/docs/api.ts:37mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

    }
  
    const response = await fetch(baseUrl + path, {
      method: "GET",
      headers: {

• src/lib/portal/v1/api.ts:34mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

    const credentials = getV1Credentials();
  
    const response = await fetch(getUrl("/me"), {
      method: "POST",
      headers: {

• src/lib/portal/v1/api.ts:74mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

    };
  
    let response = await fetch(getUrl(path), requestOptions);
  
    if (response.status === 401 || response.status === 403) {

• src/lib/portal/v1/api.ts:79mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

      await authenticate();
      requestOptions.headers["X-Session-Token"] = sessionToken;
      response = await fetch(getUrl(path), requestOptions);
    }
  

• src/lib/portal/v2/api.ts:39mcp-js-ssrf-nonliteral-url (medium/low)

  An outbound request is made to a URL that is not a literal. If any part is caller-supplied the server can be aimed at internal hosts it can reach and the caller cannot.

    };
  
    const response = await fetch(getUrl(path), requestOptions);
  
    if (!response.ok) {

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  source was fetched but every file in it was oversized, unreadable or excluded, so no source text could be read, so there is nothing to scan for committed credentials

• authorization_granularity

  source was fetched but every file in it was oversized, unreadable or excluded, so no source text could be read, so neither the tool count nor any access-control logic can be read

Maintenance

• recency

  last commit 23 day(s) before 2026-10-16

• issue_responsiveness

  lifetime median (0 issue(s) in the last 6 months, under `03` §5's floor of 3): 242.7 day(s) to first maintainer comment

• release_cadence

  median release gap 14 days (by releases), last release 149 day(s) ago

• bus_factor

  5 authors with >= 5 commits in 12 months

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; text not matched against any license this build can identify (`04` §7's classifier is not wired; see module docstring)

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30), states what the server does in the first 200 words (+20)

• declared_scopes

  capabilities are described only in vague terms — `03` §7's 30 band, which needs no inference to establish

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately