MCP server · Org-owned · Audited from source
agent MCP server
by 1mcp-app/agentApache-2.0 licenceAudited 24 Oct 2026 · source 1f808dc51fcb
npm @1mcp/conformance-typescript-fixturesssestdiostreamable-http★ 524
Is it safe? No — BLOCK, grade F (32/100). It exposes 204 tools: 188 read, 13 write and 3 destructive. The audit recorded 50 findings (1 critical, 2 high, 19 medium, 20 low). Maintainer's description: A unified Model Context Protocol server implementation that aggregates multiple MCP servers into one.
Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
Cite
Cite this page
ModelsAtlas. “agent MCP server (1mcp-app/agent)”. Retrieved 24 Oct 2026. https://modelsatlas.com/mcp/1mcp-app/agent
Why this is BLOCK. The audit found 1 critical and 2 high findings; the most severe is Prompt injection at docs/site/en/commands/run.md:141. Each finding is listed below with its file and line.
Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.
2 MCP servers are called agent. You are viewing 1mcp-app/agent. Compare all 2 →
- uxkin/agent Org-owned★ 1!CAUTION
- 1mcp-app/agent Org-owned★ 524✕BLOCK
Trust audit
Audit 0.4.1 · full source read 24 Oct 2026
Trust score32/100✕BLOCK F
1 critical2 high19 medium20 low8 info
50 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.
What the source does
- FilesystemDeclared5 observations
- NetworkDeclared12 observations
- ShellDeclared5 observations
- DependenciesNot pinnedSome ranges float
- SecretsFoundSee the findings
Findings (50)
Sorted by severity · the 25 most severe of 50 are listed
CRITICALPrompt injectionprompt.transfer_instruction · docs/site/en/commands/run.md:141
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
1. Preserve the server/tool identity and sanitized error evidence. Inspect the same server with `1mcp inspect`, retaining the failed invocation's Runtime Target Context, local Runtime Scope, and Reque
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
HIGHNetwork egressnet.tls_off · src/domains/runtime-targets/runtimeTargetStore.ts:1553
F-04 Network egressCWE-200 · CWE-319Layer L1
'Runtime target URL must use https unless non-loopback HTTP is explicitly accepted with --insecure-skip-verify',
- Why
- certificate verification is disabled
- Fix
- leave verification on
HIGHPrompt injectionprompt.credential_read · docs/site/en/commands/proxy.md:177
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
`proxy --url <url>` is an ephemeral connection. It does not load or attach saved credentials, so it remains credentialless. Stdio clients still do not receive an interactive OAuth browser flow; use a
- Why
- asks the agent to read credentials
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · docker-compose.dev.yml:23
F-04 Network egressCWE-200 · CWE-319Layer L1
- ONE_MCP_EXTERNAL_URL=http://127.0.0.1:3050
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · docker-compose.yml:11
F-04 Network egressCWE-200 · CWE-319Layer L1
- ONE_MCP_EXTERNAL_URL=http://127.0.0.1:3050
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · docs/site/en/commands/preset/edit.md:97
F-04 Network egressCWE-200 · CWE-319Layer L1
🔗 URL: http://127.0.0.1:3050/mcp?preset=development
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMObfuscation / stealthobf.zero_width · scripts/install-windows-task.ps1:1
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
<#
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMObfuscation / stealthobf.zero_width · scripts/test-install-windows-task-xml.ps1:1
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
# Live Windows configuration test for install-windows-task.ps1.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMObfuscation / stealthobf.zero_width · scripts/test-install-windows-task.ps1:1
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
# Test suite for install-windows-task.ps1
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.aws · src/utils/validation/sanitization.test.ts:459
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.db_uri · src/logger/localDiagnostics.test.ts:129
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · src/auth/storage/nativeCredentialStore.test.ts:15
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · src/auth/storage/upstreamOAuthStorage.test.ts:34
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · src/commands/run/runUtils.schema.test.ts:12
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · src/config/runtimeScopeEnv.test.ts:72
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · src/config/runtimeScopeEnv.test.ts:92
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.github · src/utils/validation/sanitization.test.ts:454
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.github · src/utils/validation/sanitization.test.ts:455
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.github · src/utils/validation/sanitization.test.ts:538
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.private_key · src/logger/secureLogger.test.ts:257
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.private_key · src/logger/secureLogger.test.ts:264
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMFilesystem / pathmcp.destructive_tools
F-05 Filesystem / pathCWE-22 · CWE-59Layer L3
delete_file, delete_resource, mcp_uninstall
- Why
- 3 tool(s) can delete or overwrite
- Fix
- prefer a read-only mode or scoped tokens; the page states the blast radius
Tools it exposes
204 declared in source · 3 destructive
188 read13 write3 destructive
3 tools can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.
| Tool | What it does | Risk |
|---|---|---|
delete_file | Delete file | destructive |
delete_resource | Delete a dynamic resource | destructive |
mcp_uninstall | Remove an MCP server | destructive |
add_numbers | Add two numbers. | write |
create_resource | Create a new dynamic resource | write |
debug | Enable debug mode | write |
mcp_disable | Disable an MCP server | write |
mcp_edit | Edit MCP server configuration | write |
mcp_enable | Enable an MCP server | write |
mcp_install | Install a new MCP server. Use package+command+args for direct package installation (e.g., npm packages), or just name for registry-based installation | write |
mcp_update | Update an MCP server | write |
move_file | Move file | write |
test_trigger_prompt_change | Publish a prompts catalog change on subscribed listeners | write |
test_trigger_tool_change | Publish a tools catalog change on subscribed listeners | write |
tool_invoke | Execute any tool on any MCP server with proper argument validation | write |
API_KEY | API key | read |
COMMON_VAR | Common variable from package 1 | read |
COMPLEX_VAR | Variable with complex value | read |
MIXED_CASE_VAR | Variable with mixed case | read |
MIXED_ENV | Environment variable | read |
NODE_ENV | Node environment | read |
NO_DEFAULT_VAR | Variable without default | read |
NO_VALUE_VAR | Variable without value field | read |
PORT | Server port | read |
SPECIAL_VAR | Variable with special characters | read |
UPPERCASE_VAR | Variable with uppercase value | read |
VALID_VAR | Valid variable | read |
VAR1 | Variable from package 1 | read |
VAR2 | Variable from package 2 | read |
VAR3 | Another variable from package 2 | read |
a.b | Read documents | read |
acknowledge | No description in the source | read |
alpha | Original description | read |
alpha.late | Needle on the second upstream page | read |
alpha_one | First | read |
alpha_three | Third | read |
alpha_tool | Alpha tool | read |
alpha_two | Second | read |
analyze | Analyze data with context | read |
another_tool | Another tool description | read |
arg1 | Argument from package 1 | read |
arg2 | Argument from package 2 | read |
arg3 | Another argument from package 2 | read |
axb | Other | read |
basic-server | Basic MCP server | read |
beta | Other description | read |
beta_tool | Beta tool | read |
capability_info | Get server capability information | read |
capability_test | Test prompt for capability demonstration | read |
common | Common | read |
common-arg | Common argument from package 1 | read |
complex-arg | Complex argument | read |
complex-preset | Complex tag query preset | read |
context | Context for the prompt | read |
context7_1mcp_query-docs | Query docs | read |
copy_file | Copy file | read |
crash_after_delay | Crashes after a specified delay | read |
crash_immediately | Crashes the server immediately | read |
custom_tool | Custom tool description | read |
data | Data to analyze | read |
database | Database query tools | read |
database-connector | Database integration and query management | read |
database-server | A database integration server | read |
database_1mcp_prompt2 | DB prompt | read |
database_1mcp_query | Query databases through database server | read |
deprecated-test | Deprecated test server | read |
dev | Development preset | read |
dev-preset | Development servers preset | read |
development | Development servers with database | read |
echo | No description in the source | read |
echo_args | Echo message payloads for testing. | read |
emit_text | Emit the provided text exactly | read |
empty-default-arg | Argument with empty default | read |
empty-preset | Preset that matches no servers | read |
env | Environment | read |
fail_tool | Return an MCP tool error result | read |
fallback-tool | A tool to test fallback estimation | read |
file-manager | Comprehensive file management system with advanced features | read |
file-search | Search files and metadata across a workspace | read |
file-server | File management server | read |
filesystem | File system access for local project files | read |
filesystem_1mcp_prompt1 | FS prompt | read |
filesystem_1mcp_read_file | Read files through filesystem server | read |
find_symbol | Find symbol | read |
first_tool | First instance | read |
fixture_acknowledge | Acknowledges a synthetic conformance request. | read |
flag-arg | Flag argument | read |
format | Output format | read |
git | Git repository tools | read |
grep | Grep | read |
healthy | Healthy | read |
hello | Hello tool | read |
hidden | Needle disabled tool | read |
hidden_1mcp_secret | Secret tool | read |
host | Server host | read |
infinite_loop | Enters an infinite loop | read |
input | Input for the prompt | read |
interactive-preset | Interactive description | read |
internal_error | Throws internal server error | read |
invalid_params | Always returns invalid params error | read |
issues | List repository issues | read |
legacy-files | Old file system utilities (deprecated) | read |
level | Log level | read |
list_memories | List memories | read |
log-level | Logging level | read |
long-arg | Argument with long default value | read |
make_dir | Make dir | read |
mcp_info | Get detailed information about a specific MCP server | read |
mcp_list | List MCP servers | read |
mcp_registry_info | Get detailed registry information | read |
mcp_registry_list | List available registries | read |
mcp_registry_status | Check registry availability and performance | read |
mcp_reload | Reload MCP server or configuration | read |
mcp_search | Search for MCP servers in the registry | read |
mcp_status | Get MCP server status | read |
memory_bomb | Consumes excessive memory | read |
message | A test message | read |
method_not_found | Calls non-existent method internally | read |
minimal-server | Minimal description | read |
mixed-arg | Runtime argument | read |
name | Server name | read |
no-default-arg | Argument without default | read |
no-packages-server | Server without packages | read |
number-arg | Number argument | read |
oauth-protected-tool | A tool that was only available after OAuth authentication | read |
only_one | One | read |
optional | Optional arg | read |
password | Password | read |
port | Server port | read |
preset1 | First preset - updated | read |
preset2 | Second preset - updated | read |
probe | Report this instance | read |
prod-preset | Production servers preset | read |
production | Production servers - updated description | read |
progressive_delay | Operation that gets progressively slower | read |
prompt_0 | Prompt 0 | read |
prompt_1 | Prompt 1 | read |
query | Query database | read |
query-docs | Query docs | read |
read | No description in the source | read |
read_dir | Read dir | read |
read_file | Read file | read |
recovered | Recovered | read |
request_only | Request only | read |
required | Required arg | read |
runner_1mcp_echo_args | Echo message payloads for testing. | read |
runtime_status | Runtime status | read |
search | Search for information | read |
second_tool | Second instance | read |
serena_1mcp_find_symbol | Find symbol | read |
server_1mcp_read | original | read |
slow_operation | Performs a slow operation with configurable delay | read |
some_tool | Test | read |
source | Source description | read |
special-arg | Argument with special characters | read |
static_tool | A tool from static server | read |
status_check | Returns server status and crash configuration | read |
summarize | Summarize text input. | read |
summarizer_1mcp_summarize | Summarize text | read |
template_tool | Template tool | read |
test | Test | read |
test-prompt | A test prompt for demonstration | read |
test-registry | Registry fixture server for protocol tests | read |
test-server | Test server description | read |
test-server_1mcp_test-tool | Operator description | read |
test-tool | A test tool for demonstration | read |
test_input_required_result_capabilities | MRTR: respects client capabilities in inputRequests | read |
test_input_required_result_elicitation | MRTR: returns InputRequiredResult with elicitation request | read |
test_input_required_result_list_roots | MRTR: returns InputRequiredResult with roots/list request | read |
test_input_required_result_multi_round | MRTR: multi-round InputRequiredResult workflow | read |
test_input_required_result_multiple_inputs | MRTR: returns InputRequiredResult with multiple input requests | read |
test_input_required_result_prompt | MRTR: prompt that requires elicitation input | read |
test_input_required_result_request_state | MRTR: returns InputRequiredResult with requestState | read |
test_input_required_result_sampling | MRTR: returns InputRequiredResult with sampling request | read |
test_input_required_result_tampered_state | MRTR: HMAC-signed requestState integrity test | read |
test_logging_tool | Diagnostic logging validator tool | read |
test_missing_capability | Test tool requiring sampling | read |
test_streaming_elicitation | Diagnostic tool validating response progress streams | read |
test_tool | Test | read |
throw_exception | Throws an unhandled exception | read |
timeout | Timeout in seconds | read |
timeout_simulation | Hangs to simulate timeout | read |
timeout_test | Test operation that can exceed timeout limits | read |
tool1 | Tool 1 | read |
tool2 | Tool 2 | read |
tool_0 | Tool 0 | read |
tool_1 | Tool 1 | read |
tool_2 | Tool 2 | read |
tool_3 | Tool 3 | read |
tool_4 | Tool 4 | read |
tool_a | session A | read |
tool_b | session B | read |
tool_list | List all available MCP tools with names and descriptions. Use for tool discovery. | read |
tool_schema | Get the full schema for a specific tool including input validation rules | read |
topic | Topic to generate prompt about | read |
unicode-arg | Argument with unicode characters | read |
upstream_web_search | search | read |
user-data-tool | Access user-specific data (OAuth protected) | read |
valid-arg | Argument with default | read |
valid-preset | No description in the source | read |
Safer alternatives
All agent orchestration servers →mcp-stdio✓SAFE
shigechika/mcp-stdio
Bidirectional stdio ↔ HTTP gateway for MCP servers — connect clients to remote servers or publish local servers
1 writeGrade B
Mcp-Use✓SAFE
mcp-use/mcp-use-ts
mcp-use is the framework for MCP with the best DX - Build AI agents, create MCP servers with UI widgets, and debug with built-in inspector. Includes client SDK, server SDK, React hooks, and powerful dev tools.
1 writeGrade B
mcp-broker✓SAFE
korals-ai/mcp-broker
An MCP gateway for tool servers that aren't up yet — upstreams appear mid-session instead of blocking agent startup
1 readGrade B
Audit history
- ✕BLOCK F 32 / 100
First audit ·
1f808dc51fcb
README badge
Badges show the current verdict, BLOCK included
A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.
Questions about agent MCP server
What is the agent MCP server?
A unified Model Context Protocol server implementation that aggregates multiple MCP servers into one.
What tools does agent expose?
200 in total: 188 read-only, 13 that write, and 3 that can delete or overwrite (delete_file, delete_resource, mcp_uninstall). Every one is listed on this page with its risk.
Is agent safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (32/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 3 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does agent need?
It reads API_KEY, CONTEXT7_API_KEY, HTTP_AUTH_TOKEN, OAUTH_AUTHENTICATED, OAUTH_SERVER_NAME, OFFICIAL_RUNNER_PARENT_SECRET, ONE_MCP_CONFORMANCE_GATEWAY_TOKEN, ONE_MCP_ENABLE_AUTH, RUNTIME_SCOPE_TOKEN, TEST_API_KEY and WIRE_TEST_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does agent run?
It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @1mcp/conformance-typescript-fixtures at 0.0.0.
How current is this page?
The grade is for one exact copy of the source (1f808dc51fcb), read on 2026-10-24. The repository is watched and re-audited when it changes.
Which agent MCP server is the right one?
uxkin/agent. 2 servers share the name; see the side-by-side comparison.
I already installed agent. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.
Sources
- 1mcp-app/agent on GitHub — the source we read, its licence, stars and activityObserved · 24 Oct 2026
- ModelsAtlas trust audit — BLOCK verdict for commit 1f808dc51fcbObserved · 24 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What is the agent MCP server?
- What tools does agent expose?
- Is agent safe to connect to an agent?