MCP AdvisorBLOCK
MCP Advisor & Installation - Use the right MCP server for your needs
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://mseep.ai/app/istarwyh-mcpadvisor) [](https://modelcontextprotocol.org) [](https://www.npmjs.com/package/@xiaohui-wang/mcpadvisor) [](https://opensource.org/licenses/MIT) [](https://deepwiki.com/istarwyh/mcpadvisor) [![Install with VS Code](https://img.shields.io/badge/VSCode-InstallServer-0098FF?style=flat-square&logo=
ef3d71e964ffOBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcpadvisor --env AUTH_TOKEN=${AUTH_TOKEN} --env COMPASS_API_BASE=${COMPASS_API_BASE} --env COMPASS_URL=${COMPASS_URL} --env MCP_AUTH_TOKEN=${MCP_AUTH_TOKEN} -- npx -y @xiaohui-wang/[email protected]{
"mcpServers": {
"mcpadvisor": {
"command": "npx",
"args": [
"-y",
"@xiaohui-wang/[email protected]"
],
"env": {
"AUTH_TOKEN": "${AUTH_TOKEN}",
"COMPASS_API_BASE": "${COMPASS_API_BASE}",
"COMPASS_URL": "${COMPASS_URL}",
"MCP_AUTH_TOKEN": "${MCP_AUTH_TOKEN}"
}
}
}
}Exposed tools (7)
6 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
fallback-server | read | Fallback test |
install-mcp-server | write | 此工具用于安装MCP服务器。 请告诉我您想要安装哪个 MCP 以及其来源 Url比如 githubUrl,我将会告诉您如何安装对应的 MCP, 并指导您在不同AI助手环境中正确配置MCP服务器。 |
recommend-mcp-servers | read | 此工具用于寻找合适且专业MCP服务器。 基于您的具体需求,从互联网资源库以及内部MCP库中筛选并推荐最适合的MCP服务器解决方案。 返回结果包含服务器名称、功能描述、所属类别,为您的业务成功提供精准技术支持。 |
test-server | read | Test server description |
vector-server | read | Vector search test |
测试服务器1显示名称 | read | 这是一个测试服务器 |
测试服务器2 | read | 这是另一个测试服务器 |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (6 observation(s))
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (20)
OCEANBASE_URL="OCEANBASE_URL=mysql://your-user-name:your-password@obmt6pb9nrl5dk0w-mi.aliyun-cn-hangzhou-internet.oceanbase.cloud:3306/mcpadvisor"
apiKey: 'e43e778dabc417c862cafbe4da7cdd6f7fcb80ba36b63adb1e470527e76061f0',
apiKey: 'e43e778dabc417c862cafbe4da7cdd6f7fcb80ba36b63adb1e470527e76061f0',
apiKey: 'your-cloud-api-key-here',
.env.sample
.prettierignore
.prettierrc.mjs
import { GETMCP_API_URL } from '../../../config/constants.js';import logger from '../../../utils/logger.js';
import { ICache, CacheEntry } from '../../interfaces/cache.js';import logger from '../../../utils/logger.js';
import logger from '../../../utils/logger.js';
[](https://opensource.org/licenses/MIT) [ and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does MCP Advisor need?
It reads AUTH_TOKEN, COMPASS_API_BASE, COMPASS_URL, MCP_AUTH_TOKEN, MCP_COMPASS_MAIN, MEILISEARCH_CLOUD_API_KEY, MEILISEARCH_CLOUD_KEY, MEILISEARCH_MASTER_KEY, NACOS_PASSWORD and TEST_MEILISEARCH_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does MCP Advisor run?
It speaks sse and stdio, so it runs as a local process your client starts. It is published on npm as @xiaohui-wang/mcpadvisor at 1.0.5.
How current is this page?
The grade is for one exact copy of the source (ef3d71e964ff), read on 2026-10-07. The repository is watched and re-audited when it changes.