JSON ServerBLOCK
JSON handling and processing mcp server
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A JSON Model Context Protocol (MCP) server implementation for querying and manipulating JSON data. This server enables LLMs to interact with JSON data through a set of standardized tools.
Installation & Usage
# Using npx with specific version (recommended) npx @gongrzhe/[email protected] # Install specific version globally npm install -g @gongrzhe/[email protected] # Run after global installation server-json-mcp
Components
Tools
- query
- Query JSON data using JSONPath syntax with extended operations
- Input:
url(string): URL of the JSON data sourcejsonPath(string): JSONPath expression with optional operations
- filter
- Filter JSON data using conditions
- Input:
url(string): URL of the JSON data sourcejsonPath(string): Base JSONPath expressioncondition(string): Filter condition
Supported Operations
Array Operations
- Slicing:
$[0:5],$[-3:],$[1:4] - Sorting:
$.sort(price),$.sort(-price) - Distinct:
$.distinct() - Transformations:
- Map:
$.map(fieldName) - Flatten:
$.flatten() - Union:
$.union([1,2,3]) - Intersection:
$.intersection([1,2,3])
String Operations
- Case:
$.toLowerCase(),$.toUpperCase() - Tests:
$.startsWith('test'),$.endsWith('test') - Search:
$.contains('test'),$.matches('pattern')
Numeric Operations
- Math:
$.math(+10),$.pow2() - Rounding:
$.round(),$.floor(),$.ceil() - Functions:
$.abs(),$.sqrt()
Date Operations
- Format:
$.format('YYYY-MM-DD') - Check:
$.isToday() - Modify:
$.add(1, 'days')
Aggregation Operations
- Group:
$.groupBy(category) - Stats: `$.sum(price)
31f573e2f349OBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add server-json-mcp -- npx -y @gongrzhe/[email protected]
{
"mcpServers": {
"server-json-mcp": {
"command": "npx",
"args": [
"-y",
"@gongrzhe/[email protected]"
]
}
}
}Exposed tools (2)
2 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
filter | read | Filter JSON data using conditions |
query | read | Query JSON data using JSONPath syntax |
Trust audit
BLOCKgrade F · trust 44/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (5 observation(s))
- Shell
- declared (10 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
var deprecatedfn = new Function('fn', 'log', 'deprecate', 'message', 'site','return function (' + args + ') {' +exec(string: string): RegExpExecArray | null;
Function('return this')() ||render = new Function(argument, '_', source);
request ~ requests
node_modules/.bin/escodegen
node_modules/.bin/esgenerate
node_modules/.bin/esparse
node_modules/.bin/esvalidate
node_modules/.bin/tsc
* console.log(myURL.password);
"chars": "€پ‚ƒ„...†‡ˆ‰ٹ‹Œچژڈگ‘’“”•–—کTMڑ›œں ،¢£¤¥¦§ ̈©ھ«¬® ̄°±23 ́μ¶· ̧1؛»1⁄41⁄23⁄4؟ہءآأؤإئابةتثجحخدذرزسشصض×طظعغـفقكàلâمنهوçèéêëىيîïًٌٍَôُِ÷ّùْûüے"
"chars": "«»...“”�•‘’� กขฃคฅฆงจฉชซฌญฎฏฐฑฒณดตถทธนบปผฝพฟภมยรฤลฦวศษสหฬอฮฯะัาําิีึืฺุู–—฿เแโใไๅๆ็่้๊๋์ํTM๏๐๑๒๓๔๕๖๗๘๙®©����"
.package-lock.json
.travis.yml
.jshintrc
.jscsrc
.jshintrc
function atob(data: string): string;
atob(data: string): string;
declare function atob(data: string): string;
const decoded = JSON.parse(atob(base64));
const decoded = JSON.parse(atob(base64));
content-type, raw-body, zod, @eslint/js, @types/content-type, @types/eslint__js, @types/eventsource, @types/express
Gates applied: no_behavioural_pass.
31f573e2f349full audit observations/trust-audit/mcp-server/gongrzhe__json-server.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | 31f573e2f349 | BLOCK | F | 44 | first audit |
Questions
What is the JSON Server MCP server?
JSON handling and processing mcp server
What tools does JSON Server expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is JSON Server safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (44/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does JSON Server need?
No credential environment variables were found in its source, so it appears to need none.
How does JSON Server run?
It speaks sse and stdio, so it runs as a local process your client starts. It is published on npm as @gongrzhe/server-json-mcp at 1.0.3.
How current is this page?
The grade is for one exact copy of the source (31f573e2f349), read on 2026-10-07. The repository is watched and re-audited when it changes.