Atlas / MCP servers / netlify / Netlify Examples

Netlify ExamplesBLOCK

Name: Netlify Examples
Author: netlify

mcp/netlify/netlify-examples

MCP server by netlify · production · Audited 2026-10-07

⚑ Report / re-scan Source ↗

A collection of examples and demonstrations to help people building the web with Netlify

Verdict

BLOCK

Grade

Trust score

54 /100

Exposed tools

1 0r · 1w · 0d

Transport

streamable-http

License

—

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A collection of examples and demos for people building the web with Netlify

AI Executive Summaries - Site, Code
AI Form Analyzer - Code
AI RAG Application - Code
AI SEO Image Generator - Code
AI Speech to Content with Groq - Code
Astro platform starter - Site, Code
Astro Server Islands - Site, Code
Astro with Motion - Site, Code
Astro with Netlify Visual Editor - Site, Code
Astro with Qwik - Site, Code
Astro with Sanity - Site, Code
Block AI bots - Site, Code
Client side au

Read from source at commit d9ccb840995eOBSERVED · 2026-10-07

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add example-styles --env AUTH0_ISSUER_BASE_URL=${AUTH0_ISSUER_BASE_URL} --env GEMINI_API_KEY=${GEMINI_API_KEY} --env MODEL_API_KEY=${MODEL_API_KEY} --env OPENAI_API_KEY=${OPENAI_API_KEY} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "example-styles": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "AUTH0_ISSUER_BASE_URL": "${AUTH0_ISSUER_BASE_URL}",
        "GEMINI_API_KEY": "${GEMINI_API_KEY}",
        "MODEL_API_KEY": "${MODEL_API_KEY}",
        "OPENAI_API_KEY": "${OPENAI_API_KEY}"
      }
    }
  }
}

Exposed tools (1)

0 read · 1 write · 0 destructive.

Tool	Risk	Description
`start-notification-stream`	write	Starts sending periodic notifications for testing resumability

Trust audit

BLOCKgrade F · trust 54/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: none-observed
Shell: declared (2 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

styles/public/js/highlight.min.js:463

exec(e) {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

styles/public/js/highlight.min.js:490

exec(e) {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427

examples/mcp/express-mcp/public/index.html:41

<a href="https://expressjs.com/">Express</a> is a minimal and flexible Node.js web application framework that provides a robust set of features to develop web applications.

Why it matters. invisible characters in instruction text

Fix. strip non-printing characters

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427

examples/mcp/hono-mcp/public/index.html:41

<a href="https://hono.dev/">Hono</a> is a modern, ultrafast, and lightweight web framework designed for building web applications and APIs across various JavaScript runtimes. Built entirely on Web Sta

Why it matters. invisible characters in instruction text

Fix. strip non-printing characters

MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94

styles/src/_includes/css/variables.scss:34

--icon-chevron: url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA1MTIgNTEyIj4KICA8cGF0aCBmaWxsPSIjMTgxYTFjIiBkPSJNMjMzLjQgNDA2LjZjMTIuNSAxMi41IDMyLj

LOWInventory / provenance · inv.hidden_file · CWE-1104

examples/auth/clerk-gated-page/.env.sample

.env.sample

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

examples/frameworks/hydrogen-caching/.eslintignore

.eslintignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

examples/frameworks/hydrogen-caching/.eslintrc.cjs

.eslintrc.cjs

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

examples/frameworks/hydrogen-caching/.graphqlrc.js

.graphqlrc.js

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

examples/edge-functions/public/lib/highlight.min.js:463

exec(e) {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

examples/edge-functions/public/lib/highlight.min.js:490

exec(e) {

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

examples/ai-bot-control/netlify/edge-functions/bots.ts:2

import agents from "../../agents.json" with { type: "json" };

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

examples/auth/auth0/netlify/functions/auth-gated-function.ts:2

import { verifyAuth0Token } from "../../utils/server-auth";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

examples/edge-functions/netlify/edge-functions/[page].js:3

import layout from "../../components/layout.js";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

examples/edge-functions/netlify/edge-functions/[page].js:8

import pageHome from "../../pages/home/index.js";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

examples/edge-functions/netlify/edge-functions/[page].js:9

import pageHello from "../../pages/hello/index.js";

LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94

examples/frameworks/hydrogen-caching/app/routes/account.orders.$id.tsx:16

const orderId = atob(params.id);

LOWObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

examples/frameworks/astro-with-qwik/src/components/emoji-example.tsx:31

<option value='🧑🚀'>🧑🚀 Astronaut</option>

LOWObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

examples/frameworks/astro-with-qwik/src/components/emoji-example.tsx:32

<option value='👨🚀'>👨🚀 Man Astronaut</option>

LOWObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

examples/frameworks/astro-with-qwik/src/components/emoji-example.tsx:33

<option value='👩🚀'>👩🚀 Woman Astronaut</option>

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

examples/ai-bot-control/package.json

@netlify/edge-functions

Why it matters. 1 dependency range(s) float