thelastsaasCAUTION
An open-source MCP server, API, and CLI for records, files, permissions, and reminders. Single binary, self-hosted.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
The Last SaaS is a TypeScript backend for records, files, team permissions, notifications, and audit logs, accessed through an HTTP API, MCP, or CLI. It runs on Bun and supports SQLite(mostly for dev and evaluation) and PostgreSQL(preferred).
Local development
Requires Bun 1.2 or later. From the repository root:
bun install cd packages/server cp .env.example .env mkdir -p data DATABASE_URL=file:../data/lastsaas.db bunx prisma migrate deploy bun run prisma:generate bun run dev
The server runs with file watching at http://localhost:8787. Sign up at /auth/signup; the MCP endpoint is /v1/mcp. On subsequent runs, start it from the repository root with bun run dev.
Bun loads packages/server/.env when starting the server. The example uses SQLite, local file storage, and console output for email. See the configuration reference for environment variables. The migration command uses a path relative to the Prisma schema directory; the runtime SQLite path is relative to packages/server.
Disable password authentication
Set PASSWORD_AUTH_ENABLED=false in the server environment and restart to disable password signup, login, reset, and password changes. Password forms are hidden; Google (when configured) and magic-link authentication remain available. Existing accounts, passwords, sessions, and API keys are retained. The default is true; set it back to true and restart to re-enable password authentication.
Repository layout
packages/server/— HTTP API, MCP, authentication, storage, and background jobs.packages/client/— thesaasCLI.packages/shared/— shared types, validation, and errors.packages/server/prisma/— database schema and SQLite migrations.scripts/— build, generation, and backend test scripts.skills/lastsaas/— operator guide embedded in the CLI.agent_docs/anddocs/— implementation and behavior references.
Checks
Run from th
75daf643799cOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add shared -- npx -y @lastsaas/[email protected]
{
"mcpServers": {
"shared": {
"command": "npx",
"args": [
"-y",
"@lastsaas/[email protected]"
]
}
}
}Exposed tools (64)
38 read · 18 write · 8 destructive. Blast radius: 8 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
audit_log | read | |
collections_create | write | |
collections_delete | destructive | |
collections_describe | read | |
collections_list | read | |
collections_update_schema | write | |
contacts | read | CRM contacts |
entries | read | Filtered entries |
field_filter_delete | destructive | |
field_filter_list | read | |
field_filter_set | write | |
files_complete_upload | write | |
files_delete | destructive | |
files_download | read | |
files_download_link | read | |
files_get | read | |
files_list | read | |
files_prepare_upload | write | |
files_upload | write | |
files_upload_link | write | |
files_upload_status | write | |
getting_started | read | |
invitations_accept | read | |
invitations_cancel | read | |
invitations_create | write | |
invitations_list | read | |
mcp_events | read | Created by the MCP walkthrough |
members_change_role | read | |
members_list | read | |
members_remove | destructive | |
notification_preferences_set | write | |
notification_preferences_show | read | |
notification_schedules_cancel | read | |
notification_schedules_create_once | write | |
notification_schedules_create_recurring | write | |
notification_schedules_list | read | |
notifications_delete | destructive | |
notifications_list | read | |
notifications_queue | read | |
org_export | read | |
org_import | write | |
organizations_create | write | |
organizations_list | read | |
organizations_select | read | |
permissions_assign_role | read | |
permissions_check | read | |
permissions_grant | read | |
permissions_list | read | |
permissions_revoke | destructive | |
permissions_unassign_role | read | |
records_aggregate | read | |
records_batch | read | |
records_count | read | |
records_delete | destructive | |
records_get | read | |
records_insert | write | |
records_query | read | |
records_update | write | |
row_filter_delete | destructive | |
row_filter_list | read | |
row_filter_set | write | |
server_info | read | |
service_accounts_create | write | |
stats | read |
Trust audit
CAUTIONgrade D · trust 66/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (6 observation(s))
- Network
- declared (9 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (19)
TEST_POSTGRES_URL: postgresql://postgres:test_password@localhost:5432/lastsaas_test
body: JSON.stringify({ email, password: "walkthrough-password", name }),body: JSON.stringify({ email, password: "walkthrough-password" }),password: "organization-password",
password: "organization-password",
password: "converted-bot-password",
collections_delete, field_filter_delete, files_delete, members_remove, notifications_delete, permissions_revoke, records_delete, row_filter_delete
streamable-http
.prettierignore
CLAUDE.md
import { version as BUNDLED_CLI_VERSION } from "../../client/package.json";import { invitationPermissionsSchema } from "../../invitation-permissions";import { addAuditLog } from "../../db/audit";import { log } from "../../logger";} from "../../db/casbin";
@types/bun, eslint, prettier, typescript, typescript-eslint
commander, hono
@hono/mcp, @modelcontextprotocol/sdk, @prisma/client, busboy, casbin, croner, hono, kysely
zod
Gates applied: no_behavioural_pass.
75daf643799cfull audit observations/trust-audit/mcp-server/mkly__thelastsaas.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 75daf643799c | CAUTION | D | 66 | first audit |
Questions
What is the thelastsaas MCP server?
An open-source MCP server, API, and CLI for records, files, permissions, and reminders. Single binary, self-hosted.
What tools does thelastsaas expose?
64 in total: 38 read-only, 18 that write, and 8 that can delete or overwrite (collections_delete, field_filter_delete, files_delete, members_remove, notifications_delete). Every one is listed on this page with its risk.
Is thelastsaas safe to connect to an agent?
With care. The audit graded it D (66/100) and found 19 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 8 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does thelastsaas need?
No credential environment variables were found in its source, so it appears to need none.
How does thelastsaas run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @lastsaas/shared at 0.0.0.
How current is this page?
The grade is for one exact copy of the source (75daf643799c), read on 2026-10-11. The repository is watched and re-audited when it changes.