mcp-serverBLOCK
mcp/pipeshub-ai/mcp-server
This repository contains the packages that make up Pipeshub’s local MCP server
Verdict
BLOCK
Grade
D
Trust score
62 /100
Exposed tools
15 14r · 1w · 0d
Transport
sse · stdio · streamable-http
License
Apache-2.0
Stars
6
01
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
This guide covers how to connect PipesHub's remote MCP server to Cursor, Claude Code, Gemini CLI, Codex CLI, Claude.ai (Web), and LibreChat using static OAuth credentials or bearer tokens.
PipesHub exposes a remote MCP endpoint over Streamable HTTP at /mcp. MCP Clients connect to this endpoint directly -- no local npm packages or stdio processes needed.
Coding agent? Start at For coding agents. Install the skill into the user's repo withnpx skills add pipeshub-ai/mcp-server(seeskills/pipeshub) and append theAGENTS.mdsnippet on that page. Listed on the official MCP registry asio.github.pipeshub-ai/mcpand on Cursor Directory as PipesHub. The listing files (plugin.json,mcp.json) default MCP tohttp://localhost:3000/mcp(Docker). Change the URL for a company instance; they contain no secrets. Contributors working in this repository: read AGENTS.md. Looking for the tool reference? See TOOLS.md for descriptions, arguments, and a decision guide for each tool the MCP server exposes (pipeshub_chat,pipeshub_search,pipeshub_get_record_content,pipeshub_download_record,pipeshub_directory,pipeshub_sources,pipeshub_agents). Using QM? QM cannot attach a third-party MCP endpoint — it is an MCP server to its own harness, not a client. Follow Use PipesHub with QM. The deployment-layer bundle inqm/gives agents apipeshubcommand inside their sandbox; this package ships that command as a second bin.
Prerequisites
- A running PipesHub instance (self-hosted or cloud). If they have none yet, the local Docker demo playbook covers install and first-run —
Read from source at commit
230a3a05deacOBSERVED · 2026-10-10Advertisement
02
Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude-code (npm)
claude mcp add mcp -- npx -y @pipeshub-ai/[email protected] start
03
Exposed tools (15)
14 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Support | read | answers support questions |
describe_tool_input | read | |
described | read | d |
execute_tool | write | |
list_scopes | read | |
list_tools | read | |
pipeshub-assistant | read | Load PipesHub tool-routing guidance so the assistant picks the correct |
pipeshub_agents | read | List the PipesHub **agents** configured for this org, each with its capabilities. Agents are specialized assistants (custom system prompt, tools, knowledge scope). To converse with one, take its \ |
pipeshub_chat | read | Ask a question, get an answer grounded in the org |
pipeshub_directory | read | Look up people, groups, and teams in PipesHub. Five actions — pick \ |
pipeshub_download_record | read | Download the file as stored for one record — not PipesHub |
pipeshub_get_record_content | read | Three operations on the org |
pipeshub_search | read | Vector / semantic search across the org |
pipeshub_sources | read | Discover available chat sources and AI models in one call. Returns up to three sections: - \ |
with-args-described | read | d2 |
04
Trust audit
BLOCKgrade D · trust 62/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | WARN |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
src/cli/config.ts:223
+ "Use https://, or pass --insecure-http if this really is a private "
Why it matters. certificate verification is disabled
Fix. leave verification on
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
src/cli/pipeshub.ts:57
--insecure-http allow cleartext to a host outside the private allowlist
Why it matters. certificate verification is disabled
Fix. leave verification on
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
src/cli/pipeshub.ts:113
case "--insecure-http": flags.insecureHttp = true; break;
Why it matters. certificate verification is disabled
Fix. leave verification on
MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
src/landing-page.ts:708
<a class="popover-button install-link" href="cursor://anysphere.cursor-deeplink/mcp/install?name=SDK&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyJtY3AiLCJzdGFydCIsIi0tc2VydmVyLWluZGV4IiwiMCIsIi0taW5zdGFu
MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
src/landing-page.ts:717
<a class="popover-button install-link" href="vscode://ms-vscode.vscode-mcp/install?name=SDK&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyJtY3AiLCJzdGFydCIsIi0tc2VydmVyLWluZGV4IiwiMCIsIi0taW5zdGFuY2UtdXJsI
MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
src/landing-page.ts:740
<a tabindex="0" class="card install-target install-link" href="cursor://anysphere.cursor-deeplink/mcp/install?name=SDK&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyJtY3AiLCJzdGFydCIsIi0tc2VydmVyLWluZGV4Ii
MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
src/landing-page.ts:762
<a tabindex="0" class="card install-target install-link" href="vscode://ms-vscode.vscode-mcp/install?name=SDK&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyJtY3AiLCJzdGFydCIsIi0tc2VydmVyLWluZGV4IiwiMCIsIi0
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
__tests__/cliConfig.test.ts:115
const token = "eyJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOiJ1LTEifQ.c2ln";
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
__tests__/sdkHttpLayer.test.ts:21
const TOKEN = "sdk-layer-token-0000";
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
__tests__/transportDefaults.test.ts:13
const TOKEN = "transport-defaults-token";
MEDIUMSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
skills/pipeshub/SKILL.md:51
curl -fsSL https://get.pipeshub.com/install | bash -s -- --yes
MEDIUMSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
skills/pipeshub/SKILL.md:53
Empty machine: `curl -fsSL https://get.pipeshub.com/install | bash -s -- --yes`
LOWInventory / provenance · inv.hidden_file · CWE-1104
.dxtignore
.dxtignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.genignore
.genignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/mcp-server/cli/serve/command.ts:8
import { consoleLoggerLevels } from "../../console-logger.js";LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/mcp-server/cli/serve/command.ts:9
import { mcpScopes } from "../../scopes.js";LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/mcp-server/cli/serve/impl.ts:8
import { LocalContext } from "../../cli.js";LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/mcp-server/cli/serve/impl.ts:12
} from "../../console-logger.js";
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
src/mcp-server/cli/serve/impl.ts:13
import { MCPServerFlags } from "../../flags.js";LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
__tests__/cliClient.test.ts:62
origin = `http://127.0.0.1:${server.port}`;LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
__tests__/cliClient.test.ts:235
const deadOrigin = `http://127.0.0.1:${closed.port}`;LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
__tests__/cliClient.test.ts:379
const text = await callTool(opts({ origin: `http://127.0.0.1:${moved.port}` }), "t", { a: 1 });LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
__tests__/cliClient.test.ts:399
headers: { location: `http://127.0.0.1:${elsewhere.port}/mcp` },LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
__tests__/cliClient.test.ts:407
`The server at ${origin} redirected to http://127.0.0.1:${elsewhere.port}/mcp. `LOWNetwork egress · net.tls_off · CWE-200, CWE-319
__tests__/cliConfig.test.ts:294
test("--insecure-http is the documented override and nothing else is", () => {Why it matters. certificate verification is disabled
Fix. leave verification on
Gates applied: no_behavioural_pass.
Audited 2026-10-10 · audit v0.4.1 · source sha
230a3a05deacfull audit observations/trust-audit/mcp-server/pipeshub-ai__mcp-server.json · Report an issue / request a re-scan05
Audit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 230a3a05deac | BLOCK | D | 62 | first audit |
06
Questions
What is the mcp-server MCP server?
This repository contains the packages that make up Pipeshub’s local MCP server
What tools does mcp-server expose?
15 in total: 14 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is mcp-server safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (62/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does mcp-server need?
No credential environment variables were found in its source, so it appears to need none.
How does mcp-server run?
It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @pipeshub-ai/mcp at 2.4.2.
How current is this page?
The grade is for one exact copy of the source (230a3a05deac), read on 2026-10-10. The repository is watched and re-audited when it changes.