MCP server · Org-owned · Audited from source
Genkit MCP server
by firebase/genkitApache-2.0 licenceAudited 21 Sep 2026 · source c32a365159ab
npm test_js_app 1.0.0ssestdiostreamable-http★ 6,452
Is it safe? No — BLOCK, grade F (28/100). It exposes 150 tools: 135 read, 14 write and 1 destructive. The audit recorded 59 findings (0 critical, 5 high, 10 medium, 39 low). Maintainer's description: Open-source framework for building agentic apps in JavaScript, Go, Dart, and Python, built and used in production by Google
Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
Cite
Cite this page
ModelsAtlas. “Genkit MCP server (firebase/genkit)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/firebase/genkit
Why this is BLOCK. The audit found 0 critical and 5 high findings; the most severe is Code injection at js/core/src/tracing.ts:56. Each finding is listed below with its file and line.
Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.
2 MCP servers are called Genkit. You are viewing firebase/genkit. Compare all 2 →
- genkit-ai/genkit Org-owned★ 6,509✕BLOCK
- firebase/genkit Org-owned★ 6,452✕BLOCK
Trust audit
Audit 0.4.1 · full source read 21 Sep 2026
Trust score28/100✕BLOCK F
0 critical5 high10 medium39 low5 info
59 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.
What the source does
- FilesystemDeclared3 observations
- NetworkDeclared6 observations
- ShellDeclared4 observations
- DependenciesNot pinnedSome ranges float
- SecretsFoundSee the findings
Findings (59)
Sorted by severity · the 25 most severe of 59 are listed
HIGHCode injectioncode.eval_exec · js/core/src/tracing.ts:56
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
const importModule = new Function(
- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
HIGHFilesystem / pathfs.credential_store · py/packages/genkit-amazon-bedrock/src/genkit_amazon_bedrock/transport.py:51
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
'AWS_DEFAULT_REGION, or a region in ~/.aws/config'
- Why
- touches a credential store
- Fix
- —
HIGHPrompt injectionprompt.override · js/testapps/model-armor/README.md:5
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
prompt injection, jailbreak attempts, and sensitive data before sending
- Why
- asks the agent to drop prior instructions or safety
- Fix
- remove the instruction
HIGHPrompt injectionprompt.override · js/testapps/model-armor/README.md:12
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
| Content Filtering | `modelArmorFlow` | Generation with Model Armor middleware for PI/jailbreak and SDP filters |
- Why
- asks the agent to drop prior instructions or safety
- Fix
- remove the instruction
HIGHPrompt injectionprompt.override · js/testapps/model-armor/README.md:65
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- Error details include the specific filter that triggered (PI/jailbreak, SDP)
- Why
- asks the agent to drop prior instructions or safety
- Fix
- remove the instruction
MEDIUMObfuscation / stealthobf.base64_blob · genkit-tools/cli/src/commands/dev-test-model.ts:69
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
'iVBORw0KGgoAAAANSUhEUgAAByIAAAGdCAYAAABel7RVAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAADv9SURBVHgB7d1bchPn9jfgF58qdx97BH9xquIuMIKYEQRGgBkBZgSYEQAjwIwAMgKcEcS5SxXY1h7BZt+lbGy
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMObfuscation / stealthobf.base64_blob · js/ai/src/testing/model-tester.ts:47
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
url: 'data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAIAAACQkWg2AAABhGlDQ1BJQ0MgcHJvZmlsZQAAKJF9kT1Iw0AcxV9TpSoVETOIOGSoulgQFXHUKhShQqgVWnUwufRDaNKQtLg4Cq4FBz8Wqw4uzro6uAqC4AeIs4OToouU+L+k0CL
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · go/plugins/googlegenai/README.md:76
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · js/plugins/google-genai/tests/vertexai/gemini_test.ts:65
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · js/plugins/google-genai/tests/vertexai/index_test.ts:65
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.private_key · js/plugins/google-cloud/tests/logs_no_input_output_test.ts:51
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.private_key · js/plugins/google-cloud/tests/logs_test.ts:54
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.private_key · js/plugins/google-cloud/tests/metrics_test.ts:59
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.private_key · js/plugins/google-cloud/tests/traces_test.ts:52
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMFilesystem / pathmcp.destructive_tools
F-05 Filesystem / pathCWE-22 · CWE-59Layer L3
removeTask
- Why
- 1 tool(s) can delete or overwrite
- Fix
- prefer a read-only mode or scoped tokens; the page states the blast radius
LOWCode injectioncode.dynamic_import · .github/workflows/python-samples.yml:110
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
importlib.import_module(mod)
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWCode injectioncode.dynamic_import · .github/workflows/python-samples.yml:166
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
importlib.import_module(mod)
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWCode injectioncode.dynamic_import · py/packages/genkit/tests/genkit/ai/model_ref_test.py:24
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
return getattr(importlib.import_module(module), name)
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWCode injectioncode.dynamic_import · py/packages/genkit/tests/genkit/core/part_test.py:80
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
return getattr(importlib.import_module(module), name)
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWCode injectioncode.eval_exec · py/tests/floor_shim_guard_test.py:48
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(compile(SHIM_SETUP.read_text(), str(SHIM_SETUP), 'exec'), {'__name__': '__main__'}) # noqa: S102- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
LOWFilesystem / pathfs.traversal · .github/workflows/scripts/check-generated-go.sh:34
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
if ! gen_output=$(go run ../internal/cmd/jsonschemagen -outdir .. -config schemas.config ../../genkit-tools/genkit-schema.json ai 2>&1); then
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · .github/workflows/scripts/check-generated-go.sh:58
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
echo "::error::cd go/core && go run ../internal/cmd/jsonschemagen -outdir .. -config schemas.config ../../genkit-tools/genkit-schema.json ai"
- Why
- No further detail recorded for this rule.
- Fix
- —
Tools it exposes
150 declared in source · 1 destructive
135 read14 write1 destructive
1 tool can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.
| Tool | What it does | Risk |
|---|---|---|
removeTask | Remove a task from the list by its ID. | destructive |
Text | Displays a run of text. For headings/titles set the | write |
add | add two numbers together | write |
addTask | Add a new task to the task list. Returns the newly created task. | write |
codingAgent | An expert AI coding assistant that can read, create, edit files, | write |
getExchangeRate | Look up the current exchange rate for an international transfer. | write |
processPayment | Process a payment for an order | write |
retry | Retries a request a specified number of times when a specific set of errors occurs | write |
riskyAction | Performs an action that must be confirmed via restart | write |
run_flow | No description in the source | write |
run_shell | Execute a shell command in the workspace directory. Use for running | write |
start_runtime | No description in the source | write |
transferMoney | Transfer money to a specified account. | write |
transferToAgent | Call this to transfer conversation control to a different specialist agent. | write |
write_artifact | Creates or updates a named artifact in the session. | write |
Bulbasaur | A Grass/Poison-type Pokemon that grows into a powerful Venusaur. | read |
Button | A clickable button that fires an action back to the agent. | read |
Card | A visually-contained card wrapping a single child. | read |
Charmander | A Fire-type Pokemon that evolves into the powerful Charizard. | read |
CheckBox | A labeled checkbox. | read |
Column | Lays out children vertically. | read |
Divider | A horizontal or vertical separator line. | read |
Icon | Displays a named material icon. | read |
Image | Displays an image from a URL. | read |
Jigglypuff | A Normal/Fairy-type Pokemon with a hypnotic singing ability. | read |
List | A list of children. | read |
Pikachu | An Electric-type Pokemon known for its strong electric attacks. | read |
Row | Lays out children horizontally. | read |
Slider | A numeric slider. | read |
Squirtle | A Water-type Pokemon known for its water-based attacks and high defense. | read |
TextField | A single- or multi-line text input. | read |
Widget | A widget. | read |
a2ui | Adds A2UI (Agent-to-UI) streaming UI support: injects catalog | read |
agents | Injects per-agent delegation tools for calling registered sub-agents. | read |
artifacts | Provides read_artifact and write_artifact tools for interacting | read |
askQuestion | use this to ask the user a clarifying question | read |
ask_user | Ask the user a question when you need clarification, a preference, | read |
badSchemaTool | A tool with an invalid schema type | read |
bad_tool | a tool | read |
bad_tool_approved | a tool | read |
catalogAgent | Catalog Agent can help customers browse and search products | read |
coder | Writes TypeScript code | read |
confirmAction | needs human confirmation | read |
confirmBooking | Confirm with the user before booking a dish. | read |
dailySpecial | Get today | read |
dangerousTool | A tool that requires confirmation | read |
dapJokeTool | DAP joke tool | read |
datePicker | user can use this UI tool to enter a date (prefer this over asking the user to enter the date manually) | read |
dynamic | dynamic interrupt | read |
dynamicInterrupt | description | read |
dynamic_preserve | test | read |
dynamic_restartable | test | read |
echoTool | echo | read |
fallback | Fallback to a different model on specific error statuses. | read |
fallbackTool | a tool with fallback output | read |
fetchCatalog | Fetches the complete product catalog with all available items | read |
fetchMostPopularItems | Fetches the most popular items in the catalog (top 3) | read |
filesystem | Injects tools for reading, writing, and searching files in a directory. | read |
foo | tool foo | read |
fooz | gets fooz | read |
gablorken | calculates a gablorken | read |
gablorkenTool | use when need to calculate a gablorken | read |
getAttractions | Get popular tourist attractions for a given city. | read |
getColor | gets a random color | read |
getFlightInfo | Get mock flight information between two cities on a given date. | read |
getProductDetails | Get detailed information about a specific product by ID | read |
getRecentGrades | retrieves recent grades for a specific student | read |
getSomeMarkdown | Gets some markdown formatted text to display on the UI. | read |
getSomePreformattedText | Gets some pre-formatted text to display on the UI. | read |
getStoreInfo | Get store information including hours, location, and contact details | read |
getTime | Get the current time | read |
getWeather | Get current weather | read |
get_current_weather | gets weather | read |
get_trace | No description in the source | read |
get_usage_guide | No description in the source | read |
get_weather | Returns the weather | read |
good_tool | a tool | read |
happy | everybody together now | read |
injectedTool | desc | read |
interruptTool | An interrupt tool | read |
interrupter | always interrupts | read |
interruptingTool | description | read |
jokeSubjectGenerator | can be called to generate a subject for a joke | read |
list_flows | No description in the source | read |
list_genkit_docs | No description in the source | read |
lookup | look something up | read |
lookupUsers | use this tool to list users | read |
main.rs | Primary application entry point | read |
menuLookupTool | use this tool to look up the menu for a given date | read |
middlewareTool | injected by middleware | read |
mockTool | A mock tool | read |
multiTool | a tool with multiple parts | read |
multipart | test | read |
mw1 | test mw1 | read |
myFunc | desc | read |
myInterrupt | Ask user | read |
my_tool | a tool | read |
myagent | Registry description (should be overridden). | read |
needs_approval | Requires human approval before proceeding. | read |
read_artifact | Reads the content of a named artifact from the session. | read |
read_genkit_docs | No description in the source | read |
realInterrupt | A real interrupt | read |
registered | registered interrupt | read |
regular | test | read |
regularAction | test | read |
reportAbsence | use this tool to mark a specific student as absent on one or more days | read |
reportTardy | use this tool to mark a specific student tardy for a given date | read |
researcher | A thorough research assistant that searches the web and provides well-sourced answers. | read |
reservationTool | use this tool to try to book a reservation | read |
restartTool | A tool that requires confirmation before executing | read |
resumable | interrupts unless resumed with {status: | read |
resumableTool | description | read |
routingAgent | This agent helps with answering inquiries and requests. | read |
searchCatalog | Search for products by name, category, or keyword | read |
searchEvents | use this when asked about any time/location for school events including extra curriculars like clubs | read |
search_genkit_docs | No description in the source | read |
sensitiveTool | Tool with sensitive inputs | read |
simple | simple interrupt | read |
simple2 | simple2 | read |
simpleTool | description | read |
skills | Injects system instructions and tools for using skills. | read |
smartagent | A very smart agent that knows everything. | read |
someListFilesTool | Lists files | read |
someTool | hello world | read |
summarize_weather | Summarizes a forecast | read |
tellAFunnyJoke | Tells jokes about an input topic. Use this tool whenever user asks you to tell a joke. | read |
tellAJoke | Tell a joke | read |
test | test | read |
testAction | A test action | read |
testMediaTool | A tool for testing audio and resource links | read |
testMultipartTool | A tool for testing multipart | read |
testStructuredTool | A tool for testing structured content | read |
testTool | A simple test tool | read |
test_http | No description in the source | read |
test_meta | test | read |
test_no_meta | test | read |
test_preserve | test | read |
test_restartable | test | read |
todaysMenu | Use this tool to retrieve all the items on today | read |
toggleTask | Toggle a task between done and not-done by its ID. Returns the updated task or an error message. | read |
toolA | toolA descr | read |
toolApproval | Interrupts tool execution unless the tool is in the approved list or approved via metadata. | read |
toolB | toolB it is | read |
triageAgent | Triage Agent | read |
truth | always returns true | read |
upcomingHolidays | can retrieve information about upcoming holidays | read |
use_skill | Use a skill by its name. | read |
userApproval | Ask the user for approval before proceeding with a sensitive action. | read |
weather | Get the weather for a city | read |
weatherTool | use this tool to display weather | read |
Safer alternatives
All memory & knowledge servers →Ragdocs✓SAFE
hannesrudolph/mcp-ragdocs
An MCP server implementation that provides tools for retrieving and processing documentation through vector search, enabling AI assistants to augment their responses with relevant documentation context.
2 destructiveGrade B
Memento✓SAFE
gannonh/memento-mcp
Memento MCP: A Knowledge Graph Memory System for LLMs
4 destructiveGrade B
Cowork Semantic Search✓SAFE
zhubit/cowork-semantic-search
1 readGrade B
Audit history
- ✕BLOCK F 28 / 100
Source changed, verdict held ·
c32a365159ab - ✕BLOCK F 28 / 100
First audit ·
825559c40957
README badge
Badges show the current verdict, BLOCK included
A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.
Questions about Genkit MCP server
What is the Genkit MCP server?
Open-source framework for building agentic apps in JavaScript, Go, Dart, and Python, built and used in production by Google
What tools does Genkit expose?
150 in total: 135 read-only, 14 that write, and 1 that can delete or overwrite (removeTask). Every one is listed on this page with its risk.
Is Genkit safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (28/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Genkit need?
It reads ANTHROPIC_API_KEY, CUSTOM_KEY, DB_PASSWORD, DEEPSEEK_API_KEY, DJANGO_SECRET_KEY, GEMINI_API_KEY, GOOGLE_API_KEY, GOOGLE_GENAI_API_KEY, OPENAI_API_KEY, PINECONE_API_KEY, VERTEX_API_KEY and XAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Genkit run?
It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as test_js_app at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (c32a365159ab), read on 2026-09-21. The repository is watched and re-audited when it changes.
Which Genkit MCP server is the right one?
2 unrelated servers share the name “Genkit”; compare them side by side before you install.
I already installed Genkit. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.
Sources
- firebase/genkit on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
- ModelsAtlas trust audit — BLOCK verdict for commit c32a365159abObserved · 21 Sep 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What is the Genkit MCP server?
- What tools does Genkit expose?
- Is Genkit safe to connect to an agent?