Atlas / MCP servers / nitansde / Nitan

NitanBLOCK

Name: Nitan
Author: nitansde

mcp/nitansde/nitan

MCP server by nitansde · Audited 2026-10-07

⚑ Report / re-scan Source ↗

MCP client and Skill for US Card Forum

Verdict

BLOCK

Grade

Trust score

55 /100

Exposed tools

15 14r · 1w · 0d

Transport

stdio · streamable-http

License

MIT

Stars

123

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Nitan MCP

Project Homepage: https://nitan.ai/mcp

论坛开发讨论贴

This is a heavy modified version of Discourse MCP. It will be a dedicated MCP client for https://www.uscardforum.com/

Quick Installation

Prerequisites:

Node.js 18 or higher (required)
Python 3.7+ (required for Cloudflare bypass)
pip (used via local .venv Python)

Simplified setup by platform

macOS

npm install
python3 -m venv .venv
. .venv/bin/activate
pip install -r requirements.txt

npm install will also auto-install playwright and the Chromium runtime on macOS for browser fallback.

Linux

npm install
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

On non-macOS platforms, Playwright is not auto-installed.

Windows (PowerShell)

npm install
py -3 -m venv .venv
.\.venv\Scripts\Activate.ps1
pip install -r requirements.txt

On non-macOS platforms, Playwright is not auto-installed.

Run health check:

node dist/index.js doctor

Check your Node.js version:

node --version  # Should be v18.0.0 or higher

If you need to upgrade Node.js:

# Using nvm (recommended)
nvm install 18
nvm use 18

# Or download from https://nodejs.org/

Using npx (recommended):

npx -y @nitansde/mcp@latest

What happens automatically:

✅ Downloads and caches the package
✅ Installs Node.js dependencies
✅ Runs postinstall script to check/install Python dependencies
✅ On macOS, auto-installs playwright package and Chromium runtime for browser fallback
✅ Checks Python dependencies at runtime and shows helpful warnings if missing

If Python dependencies aren't installed automatically:

.venv/bin/python -m pip install cloudscraper curl-cffi
# Or install from requirements.txt (recommended)
.venv/bin/python -m pip install

Read from source at commit 79b3ac5f89b8OBSERVED · 2026-10-07

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add mcp --env DISCOURSE_2FA_TOKEN=${DISCOURSE_2FA_TOKEN} --env NITAN_PASSWORD=${NITAN_PASSWORD} -- npx -y @nitansde/[email protected]

claude-desktop

{
  "mcpServers": {
    "mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@nitansde/[email protected]"
      ],
      "env": {
        "DISCOURSE_2FA_TOKEN": "${DISCOURSE_2FA_TOKEN}",
        "NITAN_PASSWORD": "${NITAN_PASSWORD}"
      }
    }
  }
}

Exposed tools (15)

14 read · 1 write · 0 destructive.

Tool	Risk	Description
`discourse_filter_topics`	read
`discourse_get_trust_level_progress`	read
`discourse_get_user`	read
`discourse_get_user_activity`	read
`discourse_list_categories`	read
`discourse_list_excellent_topics`	read
`discourse_list_funny_topics`	read
`discourse_list_hot_topics`	read
`discourse_list_notifications`	read
`discourse_list_tags`	read
`discourse_list_top_topics`	read
`discourse_read_post`	write
`discourse_read_topic`	read
`discourse_search`	read
`discourse_select_site`	read

Trust audit

BLOCKgrade F · trust 55/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: declared (6 observation(s))
Shell: declared (8 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (18)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/http/browser_fallback.ts:194

const dynamicImport = new Function("m", "return import(m)") as (m: string) => Promise<any>;

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/http/browser_fallback.ts:778

const dynamicImport = new Function("m", "return import(m)") as (m: string) => Promise<any>;

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/index.ts:360

const dynamicImport = new Function("m", "return import(m)") as (m: string) => Promise<any>;

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250

scripts/check-python-deps.mjs:48

console.warn('  • On Linux: sudo apt-get install python3 python3-pip');

Why it matters. asks for elevated privileges

HIGHPrompt injection · prompt.credential_read · CWE-94, CWE-1427

skills/nitan/SKILL.md:97

Use this path when the user prefers login-based access instead of API key setup.

Why it matters. asks the agent to read credentials

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

src/http/curl_cffi_wrapper.py:95

print(f"[DEBUG] Obtained CSRF token: {token[:20]}...", file=sys.stderr)

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

src/http/browser_fallback.ts:726

return this.options.openClawRelayCdpUrl || process.env.OPENCLAW_CHROME_RELAY_CDP_URL || "http://127.0.0.1:18792";

LOWInventory / provenance · inv.hidden_file · CWE-1104

.gitmodules

.gitmodules

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.versionrc.json

.versionrc.json

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose