MCP server · Org-owned · Audited from source

UltraRAG MCP server

by openbmb/ultraragApache-2.0 licenceAudited 21 Sep 2026 · source 73ef813df6b0

npm frontendstdiostreamable-http★ 5,703

!CAUTIONGrade B · 82/100 · 21 Sep 2026 · 73ef813

5,703GitHub stars

Is it safe? With care — CAUTION, grade B (82/100). It exposes 47 tools: 41 read, 6 write and 0 destructive. The audit recorded 17 findings (0 critical, 0 high, 5 medium, 11 low). Maintainer's description: A Low-Code MCP Framework for Building Complex and Innovative RAG Pipelines

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “UltraRAG MCP server (openbmb/ultrarag)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/openbmb/ultrarag

Trust audit

Audit 0.4.1 · full source read 21 Sep 2026

Trust score82/100!CAUTION B

0 critical0 high5 medium11 low1 info

17 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared7 observations
NetworkDeclared7 observations
ShellDeclared2 observations
DependenciesNot pinnedSome ranges float
SecretsNone foundNo keys in source

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

Layer	What we check	Result
`L0` Provenance	Repo owner, licence, archive status, activity	PASS 2 findings
`L1` Static source	Secrets, path traversal, supply chain	WARN 12 findings
`L2` Instructions	Prompt injection and authority framing in docs and tool descriptions	PASS 3 findings
`L3` Inventory	Declared tools match the source	PASS
`L4` Sandbox	Run in isolation and watch behaviour	SKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

Repository owner openbmbOrganizationAccount type recorded when we read the repository.
PackagePublished on npmfrontend, no version recorded
LicenceApache-2.0From the repository, as read at the audited commit.
Last pushTodayActivity of the repository when we read it.
Source commit read73ef813df6b0The audit covers exactly this commit, read on 21 Sep 2026.

Runtime

Sandbox runNot run yetThis audit read the source only; it did not execute the server.
Tool inventory47 declaredRead from the source and classed read, write or destructive.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (17)

Sorted by severity

MEDIUMCode injectioncode.dynamic_import · servers/retriever/src/index_backends/__init__.py:31

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

module = importlib.import_module(module_path, package=__package__)

Why: No further detail recorded for this rule.
Fix: —

MEDIUMCode injectioncode.dynamic_import · servers/retriever/src/websearch_backends/__init__.py:30

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

module = importlib.import_module(module_path, package=__package__)

Why: No further detail recorded for this rule.
Fix: —

MEDIUMFilesystem / pathfs.system_paths · Dockerfile:16

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

PATH="/root/.local/bin:/ultrarag/.venv/bin:${PATH}"

Why: No further detail recorded for this rule.
Fix: —

MEDIUMFilesystem / pathfs.system_paths · servers/corpus/src/corpus.py:52

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

if ".." in path_str or path_str.startswith("/etc/") or path_str.startswith("/proc/"):

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · ui/frontend/vite.config.ts:15

F-04 Network egressCWE-200 · CWE-319Layer L1

target: "http://127.0.0.1:5050",

Why: No further detail recorded for this rule.
Fix: —

LOWInventory / provenanceinv.hidden_file · .env.dev

F-13 Inventory / provenanceCWE-1104Layer L0

.env.dev

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWCode injectioncode.eval_exec · tests/servers/benchmark/test_key_map_alignment.py:62

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

exec(compile(module, str(BENCHMARK_SRC), "exec"), namespace)

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

LOWCode injectioncode.eval_exec · tests/servers/evaluation/test_normalize_text.py:38

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

exec(compile(module, str(EVALUATION_SRC), "exec"), namespace)

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

LOWNetwork egressnet.raw_ip · docs/llms.txt:6161

F-04 Network egressCWE-200 · CWE-319Layer L1

base_url: http://127.0.0.1:65501/v1 # [!code ++]

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · docs/llms.txt:7347

F-04 Network egressCWE-200 · CWE-319Layer L1

base_url: http://127.0.0.1:65504/v1 # [!code ++]

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · docs/llms.txt:7613

F-04 Network egressCWE-200 · CWE-319Layer L1

retriever_url: http://127.0.0.1:64501

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · ui/frontend/README.md:37

F-04 Network egressCWE-200 · CWE-319Layer L1

- `/api` -> `http://127.0.0.1:5050`

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainsupply.unpinned · ui/frontend/package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@radix-ui/react-dialog, @radix-ui/react-dropdown-menu, @radix-ui/react-select, @radix-ui/react-slot, @radix-ui/react-tabs, @tanstack/react-query, @xyflow/react, class-variance-authority

Why: 33 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWSupply chainprompt.pipe_to_shell · README.md:132

F-08 Supply chainCWE-829 · CWE-1357Layer L2

curl -LsSf https://astral.sh/uv/0.12.0/install.sh | sh

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainprompt.pipe_to_shell · docs/README_zh.md:132

F-08 Supply chainCWE-829 · CWE-1357Layer L2

curl -LsSf https://astral.sh/uv/0.12.0/install.sh | sh

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainprompt.pipe_to_shell · docs/llms.txt:3143

F-08 Supply chainCWE-829 · CWE-1357Layer L2

curl -LsSf https://astral.sh/uv/install.sh | sh

Why: No further detail recorded for this rule.
Fix: —

INFOInventory / provenanceinv.oversize · ui/frontend/dist/assets/index-CJkYAW3o.js

F-13 Inventory / provenanceCWE-1104Layer L0

ui/frontend/dist/assets/index-CJkYAW3o.js

Why: 1905651 bytes not read
Fix: —

Tools it exposes

47 declared in source · 0 destructive

41 read6 write0 destructive

Tool	Risk	What it does
`check_model_state`	write	Check if model should continue or stop based on search token.
`evaluate_trec_pvalue`	write	Compare two TREC run files using permutation test to calculate p-values.
`merge_passages`	write	Merge temporary passages into retrieved passages.
`save_memory`	write	Save one round of user-assistant dialogue into daily project memory.
`surveycpm_after_write`	write	Process responses after write action in SurveyCPM pipeline.
`surveycpm_update_state`	write	Update state based on cursor and extend results.
`assign_citation_ids`	read	Assign sequential citation IDs to passages.
`assign_citation_ids_stateful`	read	Assign unique citation IDs to passages using stateful registry.
`build_image_corpus`	read	Build image corpus from PDF files by extracting pages as images.
`build_mineru_corpus`	read	Build text and image corpus from MinerU parsing results.
`build_text_corpus`	read	Build text corpus from various file formats.
`chunk_documents`	read	Chunk documents using various chunking strategies.
`evaluate`	read	Evaluate predictions against ground truths using specified metrics.
`evaluate_trec`	read	Evaluate retrieval results in TREC format using IR metrics.
`evisrag_output_extract_from_special`	read	Extract content from <answer>...</answer> tags for EvisRAG.
`get_data`	read	Load benchmark data from file with key mapping and optional shuffling.
`get_global_memory`	read	Read global memory from MEMORY.md.
`greet`	read	Greet a person by name.
`init_citation_registry`	read	Initialize citation registry for stateful citation assignment.
`ircot_check_end`	read	Check if IRCoT answers are complete based on completion phrase.
`ircot_extract_ans`	read	Extract final answer from IRCoT responses using
`ircot_get_first_sent`	read	Extract first sentence from answers for IRCoT pipeline.
`iterretgen_nextquery`	read	Generate next query by combining previous query with answer.
`mineru_parse`	read	Parse PDF files using MinerU tool.
`output_extract_from_boxed`	read	Extract content from LaTeX \\boxed{} expressions in answers.
`r1_searcher_check`	read	Check if r1_searcher answers are complete based on EOS tokens.
`r1_searcher_query_extract`	read	Extract search queries from answer list using <\|begin_of_query\|> tags.
`route1`	read	Route queries to state1 or state2 based on query value.
`route2`	read	Route all queries to state2.
`search_o1_combine_final_information`	read	Combine extracted final information into total list for Search-o1.
`search_o1_combine_list`	read	Combine extracted queries and reasons into total lists for Search-o1.
`search_o1_extract_final_information`	read	Extract final information section from answers for Search-o1.
`search_o1_init_list`	read	Initialize lists for Search-o1 pipeline.
`search_o1_query_extract`	read	Extract search queries from answers using Search-o1 tags.
`search_o1_reasoning_extract`	read	Extract reasoning content before search query tags for Search-o1.
`search_r1_check`	read	Check if search-r1 answers are complete based on EOS tokens.
`search_r1_query_extract`	read	Extract search queries from answer list using <search> tags.
`surveycpm_after_extend`	read	Process responses after extend-plan action in SurveyCPM pipeline.
`surveycpm_after_init_plan`	read	Process responses after init-plan action in SurveyCPM pipeline.
`surveycpm_check_completion`	read	Check completion status based on step count only.
`surveycpm_format_output`	read	Format final survey output as clean Markdown.
`surveycpm_init_citation_registry`	read	Initialize citation registry for SurveyCPM pipeline.
`surveycpm_parse_search_response`	read	Parse search responses from LLM for SurveyCPM pipeline.
`surveycpm_process_passages`	read	Process and deduplicate passages for SurveyCPM pipeline.
`surveycpm_process_passages_with_citation`	read	Process passages and assign unique citation IDs for SurveyCPM.
`surveycpm_state_init`	read	Initialize state for SurveyCPM pipeline.
`webnote_check_page`	read	Check if WebNote pages are complete or incomplete.

Install

audited commit 73ef813

Read the findings first. The most severe is Code injection (medium) at servers/retriever/src/index_backends/__init__.py.

Add to Cursor Add to VS Code

One-click links open your editor with the config below filled in, exactly as the snippets show it. The audit covers commit 73ef813 only.

claude mcp add frontend --env EXA_API_KEY=${EXA_API_KEY} --env LLM_API_KEY=${LLM_API_KEY} --env RETRIEVER_API_KEY=${RETRIEVER_API_KEY} --env TAVILY_API_KEY=${TAVILY_API_KEY} -- npx -y [email protected]

{
  "mcpServers": {
    "frontend": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "EXA_API_KEY": "${EXA_API_KEY}",
        "LLM_API_KEY": "${LLM_API_KEY}",
        "RETRIEVER_API_KEY": "${RETRIEVER_API_KEY}",
        "TAVILY_API_KEY": "${TAVILY_API_KEY}"
      }
    }
  }
}

The command does not pin a version; the audit covers commit 73ef813df6b0. Transport: stdio · streamable-http. Reads these environment variables: EXA_API_KEY, LLM_API_KEY, RETRIEVER_API_KEY, TAVILY_API_KEY, ULTRARAG_SESSION_SECRET, ZHIPUAI_API_KEY. Give it the narrowest token it needs.

Audit history

2026-09-21
!CAUTION B 82 / 100
Source changed, verdict held · 73ef813df6b0
2026-09-16
!CAUTION B 82 / 100
First audit · 80d07c4833c7

README badge

For maintainers · updates on every re-audit

[![ModelsAtlas: CAUTION B](https://modelsatlas.com/mcp/openbmb/ultrarag/badge.svg)](https://modelsatlas.com/mcp/openbmb/ultrarag/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about UltraRAG MCP server

What is the UltraRAG MCP server?

A Low-Code MCP Framework for Building Complex and Innovative RAG Pipelines

What tools does UltraRAG expose?

47 in total: 41 read-only, 6 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is UltraRAG safe to connect to an agent?

With care. The audit graded it B (82/100) and found 17 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does UltraRAG need?

It reads EXA_API_KEY, LLM_API_KEY, RETRIEVER_API_KEY, TAVILY_API_KEY, ULTRARAG_SESSION_SECRET and ZHIPUAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does UltraRAG run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as frontend at 0.0.0.

How current is this page?

The grade is for one exact copy of the source (73ef813df6b0), read on 2026-09-21. The repository is watched and re-audited when it changes.

Sources

openbmb/ultrarag on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
ModelsAtlas trust audit — CAUTION verdict for commit 73ef813df6b0Observed · 21 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the UltraRAG MCP server?
GChatGPT CClaude PPerplexity
What tools does UltraRAG expose?
GChatGPT CClaude PPerplexity
Is UltraRAG safe to connect to an agent?
GChatGPT CClaude PPerplexity