Atlas / MCP servers / hanlulong / Stata

StataBLOCK

Name: Stata
Author: hanlulong

mcp/hanlulong/stata

MCP server by hanlulong · Audited 2026-09-30

⚑ Report / re-scan Source ↗

Stata MCP Extension for VS Code, Cursor, and Antigravity IDE

Verdict

BLOCK

Grade

Trust score

58 /100

Exposed tools

1 0r · 1w · 0d

Transport

streamable-http

License

MIT

Stars

500

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](./README.md) [](./README.zh-CN.md) [](https://marketplace.visualstudio.com/items?itemName=DeepEcon.stata-mcp) [](https://marketplace.visualstudio.com/items?itemName=DeepEcon.stata-mcp) [](https://open-vsx.org/extension/DeepEcon/stata-mcp) [](https://open-vsx.org/extension/DeepEcon/stata-mcp) [](https://github.com/hanlulong/stata-mcp/releases) [](https://github.com/hanlulong/stata-mcp/blob/main/LICENSE)

This extension provides Stata integration for Visual Studio Code, Cursor, and Antigravity IDE using the Model Context Protocol (MCP). It enables AI-powered Stata development with GitHub Copilot, Cursor, Antigravity, Cline, Claude Code, or Codex.

Features

Run Stata Commands: Execute selections or entire .do files directly from your editor
Real-time Output: See Stata results instantly in your editor
Syntax Highlighting: Full syntax support for Stata .do, .ado, .mata, and .doh files
AI Assistant Integration: Contextual help and code suggest

Read from source at commit 265c09938fbbOBSERVED · 2026-09-30

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add stata-mcp -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "stata-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}

Exposed tools (1)

0 read · 1 write · 0 destructive.

Tool	Risk	Description
`stata_run_selection`	write	Stata Run Selection Endpoint\n\nRun selected Stata code and return the output\n\n### Responses:\n\n200: Successful Response (Success Response)

Trust audit

BLOCKgrade F · trust 58/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	WARN
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (3 observation(s))
Network: declared (9 observation(s))
Shell: declared (10 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (24)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/check-python.js:32

exec(command, { maxBuffer: 1024 * 1024 * 10 }, (error, stdout, stderr) => {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/start-server.js:264

serverProcess = exec(cmdString, {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250

src/check-python.js:66

console.log('Option 1 (may require sudo): curl -LsSf https://astral.sh/uv/install.sh | sudo sh');

Why it matters. asks for elevated privileges

MEDIUMFilesystem / path · fs.system_paths · CWE-22, CWE-59

src/check-python.js:160

'/usr/local/bin/uv',

MEDIUMPrompt injection · prompt.hidden_style · CWE-94, CWE-1427

docs/incidents/GRAPH_VIEWER_BLANK_PANEL.md:172

<div class="error" style="display:none;">Failed to load graph: graph1 (path: /Users/.../graph1.png)</div>

MEDIUMPrompt injection · prompt.hidden_style · CWE-94, CWE-1427

docs/incidents/GRAPH_VIEWER_BLANK_PANEL.md:322

return '<!DOCTYPE html><html><body style="background:red;color:white;padding:20px"><h1>TEST</h1><p>graphs: ' + graphCount + '</p></body></html>';

MEDIUMPrompt injection · scope.undeclared_system · CWE-94, CWE-1427

system use found in code, not declared in the description

Why it matters. the description does not admit a capability the code has

Fix. declare system use in the description, or remove it

MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862

streamable-http

Why it matters. a network transport with no auth environment variable found

Fix. require a token

LOWInventory / provenance · inv.hidden_file · CWE-1104

.vscodeignore

.vscodeignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/session_manager.py:97

digest = hashlib.sha1(raw_session_id.encode("utf-8", errors="replace")).hexdigest()[:10]

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/stata_mcp_server.py:251

digest = hashlib.sha1(raw_session_id.encode("utf-8", errors="replace")).hexdigest()[:10]

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/stata_worker.py:113

digest = hashlib.sha1(raw_value.encode("utf-8", errors="replace")).hexdigest()[:10]

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/stata_worker.py:487

seed_hash = int(hashlib.md5(seed_input.encode()).hexdigest()[:8], 16)

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/stata_worker.py:538

seed_hash = int(hashlib.md5(seed_input.encode()).hexdigest()[:8], 16) % 2147483647

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

package.json

adm-zip, axios, resolve, @types/glob, @types/mocha, @types/vscode, @typescript-eslint/eslint-plugin, @typescript-eslint/parser

Why it matters. 15 dependency range(s) float

Fix. pin exact versions or ship a lockfile

LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427

docs/incidents/STREAMING_IMPLEMENTATION_GUIDE.md:182

- Get full access to `ServerSession`