hn-mcp-serverBLOCK
Browse Hacker News feeds, threads, and user profiles with full-text search via MCP. STDIO or Streamable HTTP.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
@cyanheads/hn-mcp-server Browse Hacker News feeds, threads, and user profiles with full-text search via MCP. STDIO or Streamable HTTP. 4 Tools
[](./CHANGELOG.md) [](./LICENSE) [](https://github.com/users/cyanheads/packages/container/package/hn-mcp-server) [](https://modelcontextprotocol.io/) [](https://www.npmjs.com/package/@cyanheads/hn-mcp-server) [](https://www.typescriptlang.org/) [](https://bun.sh/)
[](https://github.com/cyanheads/hn-mcp-server/releases/latest/download/hn-mcp-server.mcpb) [](https://cursor.com/en/install-mcp?name=hn-mcp-server&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsIkBjeWFuaGVhZHMvaG4tbWNwLXNlcnZlciJdfQ==) [](https://vscode.dev/redirect?url=vscode:mcp/install?%7B%22name%22%3A%22hn-mcp-server%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22%40cyanheads%2Fhn-mcp-server%22%5D%7D)
[ | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (1 observation(s))
- Shell
- declared (8 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (16)
**Seed orientation context when the next moves are predictable.** Piggybacking a compact snapshot alongside the primary result — recent activity, tracked state, a few reference items — does two things
- **Mirror a bulk upstream instead of paginating it live.** When the server wraps a large or slow API whose corpus is queried far more than it changes, sync it once into a persistent local index and q
const tsc = await exec([join(ROOT_DIR, 'node_modules', '.bin', 'tsc'), '-p', project], 'tsc');
const alias = await exec(
exec(cmd: string[], options: { cwd: string }): Promise<ShellResult> {':(glob)**/.netrc',
| **Server credential** | The server's own upstream key is missing, or the upstream rejects it (401/403) | `ConfigurationError` — translated in the service, since the automatic status mapping yields `
Prereq: a GitHub PAT with `read:org` + `read:user` scopes stored in Keychain under the service name `mcp-publisher-github-pat`:
2. **No `git stash`, no `git reset --hard`, no `git restore .`, no `git clean -f`, no `git checkout -- .`.** These bypass safety and risk silent data loss. Read-only git (`status`, `diff`, `log`, `sho
.mcpbignore
import { httpStatus, rejectUnmockedFetch, stubHnApi } from '../../helpers/hn-api-stub.js';@cyanheads/mcp-ts-core, pino-pretty, zod, @biomejs/biome, @socketsecurity/bun-security-scanner, @types/node, @vitest/coverage-istanbul, depcheck
- [ ] `.codex-plugin/mcp.json` updated — server name key is the unscoped repo name; every user-supplied variable (API key, contact email, instance URL) is listed in `env_vars` so Codex forwards it fro
- [ ] `.codex-plugin/mcp.json` updated — server name key is the unscoped repo name; every user-supplied variable (API key, contact email, instance URL) is listed in `env_vars` so Codex forwards it fro
Maintenance + capability release. Adopts the MCP spec's server-level `instructions` field on `createApp()` so spec-compliant clients forward orientation text (HN item types, ID reuse across tools, cas
Gates applied: critical_finding, instruction_override, no_behavioural_pass, undeclared_transfer.
c61cbf343270full audit observations/trust-audit/mcp-server/cyanheads__hn-mcp-server.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | c61cbf343270 | BLOCK | F | 46 | first audit |
Questions
What is the hn-mcp-server MCP server?
Browse Hacker News feeds, threads, and user profiles with full-text search via MCP. STDIO or Streamable HTTP.
Is hn-mcp-server safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (46/100) and found 9 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does hn-mcp-server need?
No credential environment variables were found in its source, so it appears to need none.
How does hn-mcp-server run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @cyanheads/hn-mcp-server at 0.5.21.
How current is this page?
The grade is for one exact copy of the source (c61cbf343270), read on 2026-10-11. The repository is watched and re-audited when it changes.