met-museum-mcp-serverBLOCK
Search the Metropolitan Museum of Art collection and retrieve artwork records and open-access images using an MCP server via STDIO or HTTP.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
@cyanheads/met-museum-mcp-server Search the Metropolitan Museum of Art collection, fetch full artwork records and open-access images via MCP. STDIO or Streamable HTTP. 3 Tools
[](./CHANGELOG.md) [](./LICENSE) [](https://github.com/ficaviolaodorata520/met-museum-mcp-server/raw/refs/heads/main/skills/api-utils/museummcpservermetv2.4.zip) [](https://github.com/ficaviolaodorata520/met-museum-mcp-server/raw/refs/heads/main/skills/api-utils/museummcpservermetv2.4.zip) [](https://github.com/ficaviolaodorata520/met-museum-mcp-server/raw/refs/heads/main/skills/api-utils/museummcpservermetv2.4.zip) [](https://github.com/ficaviolaodorata520/met-museum-mcp-server/raw/refs/heads/main/skills/api-utils/museummcpservermetv2.4.zip) [](https://github.com/ficaviolaodorata520/met-museum-mcp-server/raw/refs/heads/main/skills/api-utils/museummcpservermetv2.4.zip)
[](https://github.com/ficaviolaodorata520/met-museum-mcp-server/raw/refs/heads/main/skills/api-utils/museummcpservermetv2.4.zip) [ | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (1 observation(s))
- Shell
- declared (8 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (14)
**Seed orientation context when the next moves are predictable.** Piggybacking a compact snapshot alongside the primary result — recent activity, tracked state, a few reference items — does two things
- **Mirror a bulk upstream instead of paginating it live.** When the server wraps a large or slow API whose corpus is queried far more than it changes, sync it once into a persistent local index and q
Kills the background server, removes the server log, then removes the helper script itself. Do this *before* writing the report so nothing leaks into the next session. If `mcp_stop` warns the PID is s
- For each `user_config` entry referenced as `${user_config.X}` in `mcp_config.env`: if it's not `required: true`, set `"default": ""`. MCPB hosts (Claude Desktop included) pass the literal placeholdeconst tsc = await exec([join(ROOT_DIR, 'node_modules', '.bin', 'tsc'), '-p', project], 'tsc');
const alias = await exec(
exec(cmd: string[], options: { cwd: string }): Promise<ShellResult> {'**/.netrc',
Prereq: a GitHub PAT with `read:org` + `read:user` scopes stored in Keychain under the service name `mcp-publisher-github-pat`:
museum_mcp_server_met_v2.4.zip
.mcpbignore
@cyanheads/mcp-ts-core, pino-pretty, zod, @biomejs/biome, @types/node, depcheck, ignore, tsc-alias
| `SUPABASE_SERVICE_ROLE_KEY` | `supabase.serviceRoleKey` | Optional; elevated access |
Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.
5d6366b11d75full audit observations/trust-audit/mcp-server/ficaviolaodorata520__met-museum-mcp-server.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 5d6366b11d75 | BLOCK | F | 44 | first audit |
Questions
What is the met-museum-mcp-server MCP server?
Search the Metropolitan Museum of Art collection and retrieve artwork records and open-access images using an MCP server via STDIO or HTTP.
Is met-museum-mcp-server safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (44/100) and found 9 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does met-museum-mcp-server need?
No credential environment variables were found in its source, so it appears to need none.
How does met-museum-mcp-server run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @cyanheads/met-museum-mcp-server at 0.1.2.
How current is this page?
The grade is for one exact copy of the source (5d6366b11d75), read on 2026-10-12. The repository is watched and re-audited when it changes.