Atlas / MCP servers / qinyuanpei / Weibo

WeiboBLOCK

mcp/qinyuanpei/weibo

基于 Model Context Protocol 的微博数据接口服务器 - 实时获取微博用户信息、动态内容、热搜榜单、粉丝关注数据。支持用户搜索、内容搜索、话题分析,为 AI 应用提供完整的微博数据接入方案。

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
1 1r · 0w · 0d
Transport
stdio · streamable-http
License
MIT
Stars
63
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

通过微博访客接口提供用户、微博、热搜、评论、话题及社交关系数据。默认自动申请访客 Cookie,不读取用户手工提供的 Cookie;CLI 可通过扫码登录保存本机登录会话。

选择适合你的方式

快速开始

MCP

{
"mcpServers": {
"weibo": {
"command": "uvx",
"args": ["--from", "mcp-server-weibo", "mcp-server-weibo"]
}
}
}

HTTP 模式使用 Streamable HTTP 端点 http://localhost:4200/mcp。完整配置、工具清单与测试方法见 MCP 接入指南。

CLI

uvx --from mcp-server-weibo weibo-cli trending -n 3
uvx --from mcp-server-weibo weibo-cli users "雷军" -n 5
uvx --from mcp-server-weibo weibo-cli feeds 1749127163 -n 10 --no-include-pics

# 可选:扫码创建本机 CLI 登录会话
uvx --from mcp-server-weibo weibo-cli login

# 校验当前本机 CLI 登录会话
uvx --from mcp-server-weibo weibo-cli session

集合查询命令输出一个完整 JSON 数组;profile 输出对象,session 输出登录会话对象或 null。完整命令、分页和精简输出选项见 CLI 使用指南。

从源码运行

git clone https://github.com/qinyuanpei/mcp-server-weibo.git
cd mcp-server-weibo
uv sync --extra dev

# MCP:stdio 或 HTTP
uv run mcp-server-weibo
uv run mcp-server-weibo http

# CLI
uv run weibo-cli --help

致谢

CLI 二维码登录功能的协议实现参考并改编自 RicterZ/mcp-server-weibo。感谢其对微博二维码登录流程的实现与公开分享。

要求与声明

  • Python >= 3.10
  • MIT License,详见 LICENSE
  • 本项目与微博官方无关,仅用于学习和研究。
Read from source at commit 5ef508061347OBSERVED · 2026-10-08
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add mcp-server-weibo -- uvx mcp-server-weibo
claude-desktop
{
  "mcpServers": {
    "mcp-server-weibo": {
      "command": "uvx",
      "args": [
        "mcp-server-weibo"
      ]
    }
  }
}
03

Exposed tools (1)

1 read · 0 write · 0 destructive.

ToolRiskDescription
get_trendingsread
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (5 observation(s))
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (9)

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
skills/weibo-personality/SKILL.md:1
---
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
skills/weibo-personality/references/output-schema.md:1
# Output Schema
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
skills/weibo-personality/references/prompt-template.md:1
# Prompt Template
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/MCP.md:77
npx @modelcontextprotocol/inspector --cli http://127.0.0.1:4200/mcp --transport http --method tools/list
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/MCP.md:83
npx @modelcontextprotocol/inspector --cli http://127.0.0.1:4200/mcp --transport http --method tools/call --tool-name get_trendings --tool-arg limit=3
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/MCP_EN.md:79
npx @modelcontextprotocol/inspector --cli http://127.0.0.1:4200/mcp --transport http --method tools/list
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
docs/MCP_EN.md:85
npx @modelcontextprotocol/inspector --cli http://127.0.0.1:4200/mcp --transport http --method tools/call --tool-name get_trendings --tool-arg limit=3
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
docs/CLI_EN.md:27
The command displays a QR code and waits for the user to scan and confirm it in the Weibo app. After a successful login, the session is validated and saved to `~/.config/mcp-server-weibo/cookies.json`
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
INFOInventory / provenance · inv.oversize · CWE-1104
assets/mcp-server-weibo-cover.png
assets/mcp-server-weibo-cover.png
Why it matters. 1378971 bytes not read

Gates applied: no_behavioural_pass.

Audited 2026-10-08 · audit v0.4.1 · source sha 5ef508061347full audit observations/trust-audit/mcp-server/qinyuanpei__weibo.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-085ef508061347BLOCKD69first audit
06

Questions

What is the Weibo MCP server?

基于 Model Context Protocol 的微博数据接口服务器 - 实时获取微博用户信息、动态内容、热搜榜单、粉丝关注数据。支持用户搜索、内容搜索、话题分析,为 AI 应用提供完整的微博数据接入方案。

What tools does Weibo expose?

1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Weibo safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does Weibo need?

No credential environment variables were found in its source, so it appears to need none.

How does Weibo run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as mcp-server-weibo.

How current is this page?

The grade is for one exact copy of the source (5ef508061347), read on 2026-10-08. The repository is watched and re-audited when it changes.

Advertisement