ModelsAtlas
Explore
Atlas / MCP servers / n24q02m / mcp-core

mcp-coreCAUTION

mcp/n24q02m/mcp-core
MCP server by n24q02m · ai · mcp · model context protocol · Audited 2026-10-12
⚑ Report / re-scanSource ↗

Shared foundation for building MCP servers -- Streamable HTTP transport, OAuth 2.1, browser-based credential setup, and a shared embedding daemon.

Verdict
CAUTION
Grade
D
Trust score
63 /100
Exposed tools
2 2r · 0w · 0d
Transport
streamable-http
License
Apache-2.0
Stars
1
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Shared foundation for building MCP servers -- Streamable HTTP transport, OAuth 2.1, browser-based credential setup, and a shared embedding daemon.

[](https://github.com/n24q02m/mcp-core/actions/workflows/ci.yml) [](https://codecov.io/gh/n24q02m/mcp-core) [](https://pypi.org/project/n24q02m-mcp-core/) [](https://www.npmjs.com/package/@n24q02m/mcp-core) [](LICENSE)

[](#) [](#) [](https://github.com/python-semantic-release/python-semantic-release) [](https://developer.mend.io/)

Sister projects from n24q02m (click to expand)

Read from source at commit d545ba741633OBSERVED · 2026-10-12
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add mcp-core --env CREDENTIAL_SECRET=${CREDENTIAL_SECRET} --env MCP_AUTH_DISABLE=${MCP_AUTH_DISABLE} --env MCP_D1_TOKEN=${MCP_D1_TOKEN} --env MCP_JWT_SIGNING_SECRET=${MCP_JWT_SIGNING_SECRET} -- npx -y @n24q02m/[email protected]
claude-desktop
{
  "mcpServers": {
    "mcp-core": {
      "command": "npx",
      "args": [
        "-y",
        "@n24q02m/[email protected]"
      ],
      "env": {
        "CREDENTIAL_SECRET": "${CREDENTIAL_SECRET}",
        "MCP_AUTH_DISABLE": "${MCP_AUTH_DISABLE}",
        "MCP_D1_TOKEN": "${MCP_D1_TOKEN}",
        "MCP_JWT_SIGNING_SECRET": "${MCP_JWT_SIGNING_SECRET}"
      }
    }
  }
}
03

Exposed tools (2)

2 read · 0 write · 0 destructive.

ToolRiskDescription
config__open_relayreadtry:
helloreadreturn
04

Trust audit

CAUTIONgrade D · trust 63/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (3 observation(s))
Network
declared (6 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
found

Findings (25)

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/core-py/src/mcp_core/relay/transient.py:279
url = f"http://127.0.0.1:{port}/setup?token={token}"
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
packages/core-py/tests/crypto/test_jwt_signing_seed.py:43
secret = "test-credential-secret-value"
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
packages/core-py/tests/oauth/test_jwt_issuer.py:288
SECRET = "test-credential-secret-value"
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
packages/core-ts/tests/auth/local-oauth-app.test.ts:328
const SECRET = 'stable-sub-test-secret'
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
packages/core-ts/tests/auth/oauth-app-credential-secret.test.ts:14
const SECRET = 'test-credential-secret-value'
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
packages/core-ts/tests/oauth/jwt-issuer.test.ts:219
const SECRET = 'test-credential-secret-value'
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
scripts/e2e/tests/test_oauth_client_hardening.py:388
"CI_APP_KEY": "-----BEGIN RSA PRIVATE KEY-----\nfoo\n-----END",
LOWInventory / provenance · inv.hidden_file · CWE-1104
.coderabbit.yaml
.coderabbit.yaml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.gitleaks.toml
.gitleaks.toml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.infisical.json
.infisical.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.mise.toml
.mise.toml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.pre-commit-config.yaml
.pre-commit-config.yaml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
.github/workflows/cd.yml:223
cp ../../README.md .
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
.github/workflows/cd.yml:263
cp ../../README.md .
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/core-py/tests/storage/test_per_plugin_store.py:49
_cred_path("plugin", "../../evil")
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/core-py/tests/storage/test_per_plugin_token_key.py:39
b.put("wet/subs/u1/tokens/../../escape", b"x")
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
packages/core-py/tests/transport/test_cache.py:170
malicious_name = "../../etc/passwd"
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
packages/core-py/tests/http/test_ssrf.py:52
"169.254.169.254",  # link-local (cloud metadata)
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:188
middleware = [OAuthMiddleware(issuer=issuer, resource_metadata_url="http://127.0.0.1:9876/.well-known/oauth-protected-resource")]
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
README.md:206
resourceMetadataUrl: 'http://127.0.0.1:9876/.well-known/oauth-protected-resource'
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/core-py/tests/auth/test_delegated_oauth_relay_gate.py:59
"redirect_uri": "http://127.0.0.1:5555/callback",
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
packages/core-py/tests/auth/test_well_known.py:10
meta = authorization_server_metadata("http://127.0.0.1:9876")
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
packages/core-py/src/mcp_core/relay/client.py:194
ciphertext = base64.b64decode(result["ciphertext"])
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
packages/core-py/src/mcp_core/relay/client.py:195
iv = base64.b64decode(result["iv"])
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
packages/core-py/src/mcp_core/relay/client.py:196
tag = base64.b64decode(result["tag"])

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha d545ba741633full audit observations/trust-audit/mcp-server/n24q02m__mcp-core.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-12d545ba741633CAUTIOND63first audit
06

Questions

What is the @n24q02m/mcp-core MCP server?

Shared foundation for building MCP servers -- Streamable HTTP transport, OAuth 2.1, browser-based credential setup, and a shared embedding daemon.

What tools does @n24q02m/mcp-core expose?

2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is @n24q02m/mcp-core safe to connect to an agent?

With care. The audit graded it D (63/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does @n24q02m/mcp-core need?

It reads CREDENTIAL_SECRET, MCP_AUTH_DISABLE, MCP_D1_TOKEN, MCP_JWT_SIGNING_SECRET, MCP_KV_TOKEN, MCP_MY_SERVER_API_KEY, MCP_RELAY_PASSWORD, MCP_TELEGRAM_BOT_TOKEN and MCP_VECTORIZE_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does @n24q02m/mcp-core run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @n24q02m/mcp-core at 0.1.0.

How current is this page?

The grade is for one exact copy of the source (d545ba741633), read on 2026-10-12. The repository is watched and re-audited when it changes.

Advertisement