MCP server · Audited from source
Jsondiffpatch MCP server
by benjamine/jsondiffpatchMIT licenceAudited 21 Sep 2026 · source 19ee573ece35
Is it safe? No — BLOCK, grade D (69/100). It exposes 1 tool: 1 read, 0 write and 0 destructive. The audit recorded 12 findings (0 critical, 2 high, 0 medium, 10 low). Maintainer's description: Diff & patch JavaScript objects
Cite
Cite this page
ModelsAtlas. “Jsondiffpatch MCP server (benjamine/jsondiffpatch)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/benjamine/jsondiffpatch
Why this is BLOCK. The audit found 0 critical and 2 high findings; the most severe is Code injection at packages/diff-mcp/src/server.ts:142. Each finding is listed below with its file and line.
Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.
Trust audit
Audit 0.4.1 · full source read 21 Sep 2026
12 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.
What the source does
- FilesystemNone observedNothing seen in the source
- NetworkDeclared2 observations
- ShellDeclared2 observations
- DependenciesNot pinnedSome ranges float
- SecretsNone foundNo keys in source
Findings (12)
Sorted by severity
HIGHCode injectioncode.deserialize · packages/diff-mcp/src/server.ts:142
return yaml.load(data);
- Why
- deserialises untrusted bytes into live objects
- Fix
- use json or yaml.safe_load
HIGHCode injectioncode.eval_exec · demos/html-demo/demo.ts:357
eval(s.innerHTML);
- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
LOWFilesystem / pathfs.traversal · packages/jsondiffpatch/test/examples/diffpatch.ts:2
import type { Delta, Options } from "../../src/index.js";- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · packages/jsondiffpatch/test/formatters/annotated.spec.ts:2
import * as annotatedFormatter from "../../src/formatters/annotated.js";
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · packages/jsondiffpatch/test/formatters/annotated.spec.ts:3
import * as jsondiffpatch from "../../src/index.js";
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · packages/jsondiffpatch/test/formatters/html.spec.ts:3
import * as htmlFormatter from "../../src/formatters/html.js";
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · packages/jsondiffpatch/test/formatters/html.spec.ts:4
import * as jsondiffpatch from "../../src/index.js";
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWSupply chainsupply.unpinned · demos/console-demo/package.json
jsondiffpatch, typescript
- Why
- 2 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · demos/html-demo/package.json
json5, jsondiffpatch, esbuild, typescript
- Why
- 4 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · demos/numeric-plugin-demo/package.json
jsondiffpatch, typescript
- Why
- 2 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · package.json
@biomejs/biome, typescript
- Why
- 2 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · packages/diff-mcp/package.json
@dmsnell/diff-match-patch, @modelcontextprotocol/sdk, fast-xml-parser, js-yaml, json5, jsondiffpatch, smol-toml, zod
- Why
- 13 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
Tools it exposes
1 declared in source · 0 destructive
| Tool | What it does | Risk |
|---|---|---|
diff | compare text or data and get a readable diff | read |
Safer alternatives
SEOSiri-Official/content-schema-mcp
An open-source, local-first (MCP) server for Automated Schema org JSON-LD Generation, GA4 Metric Validation, llm.txt Auditing
kehvinbehvin/json-mcp-filter
JSON MCP server to filter only relevant data for your LLM
Audit history
- ✕BLOCK D 69 / 100
Source changed, verdict held ·
19ee573ece35
README badge
Badges show the current verdict, BLOCK included
A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.
Questions about Jsondiffpatch MCP server
What is the Jsondiffpatch MCP server?
What tools does Jsondiffpatch expose?
Is Jsondiffpatch safe to connect to an agent?
What credentials does Jsondiffpatch need?
How does Jsondiffpatch run?
How current is this page?
I already installed Jsondiffpatch. What should I do?
Can the verdict change?
Sources
- benjamine/jsondiffpatch on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
- ModelsAtlas trust audit — BLOCK verdict for commit 19ee573ece35Observed · 21 Sep 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What is the Jsondiffpatch MCP server?
- What tools does Jsondiffpatch expose?
- Is Jsondiffpatch safe to connect to an agent?