MCP server · Audited from source
line-harness-oss MCP server
by shudesu/line-harness-ossMIT licenceAudited 25 Oct 2026 · source 6dc8d5da5c95
npm @line-harness/update-engine 0.0.13stdio★ 607
Is it safe? No — BLOCK, grade F (59/100). It exposes 50 tools: 31 read, 11 write and 8 destructive. The audit recorded 30 findings (0 critical, 1 high, 8 medium, 21 low). Maintainer's description: L Harness — self-hosted LINE Official Account CRM: step messaging, broadcasts, forms and reservations, with MCP and TypeScript SDK. By Shudesu (野田修一).
Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
Cite
Cite this page
ModelsAtlas. “line-harness-oss MCP server (Shudesu/line-harness-oss)”. Retrieved 25 Oct 2026. https://modelsatlas.com/mcp/shudesu/line-harness-oss
Why this is BLOCK. The audit found 0 critical and 1 high findings; the most severe is Code injection at packages/plugin-template/dist-mcp/index.js:2941. Each finding is listed below with its file and line.
Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.
Trust audit
Audit 0.4.1 · full source read 25 Oct 2026
Trust score59/100✕BLOCK F
0 critical1 high8 medium21 low0 info
30 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.
What the source does
- FilesystemDeclared3 observations
- NetworkDeclared8 observations
- ShellDeclared2 observations
- DependenciesNot pinnedSome ranges float
- SecretsFoundSee the findings
Findings (30)
Sorted by severity · the 25 most severe of 30 are listed
HIGHCode injectioncode.eval_exec · packages/plugin-template/dist-mcp/index.js:2941
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
MEDIUMInformation disclosuredisclose.log_secret · apps/worker/src/services/token-refresh.ts:75
F-12 Information disclosureCWE-209 · CWE-532Layer L1
console.log(`🔄 Token refreshed: ${account.name} (expires ${expiresAtJst})`);- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · apps/worker/src/index.ts:180
F-04 Network egressCWE-200 · CWE-319Layer L1
'http://127.0.0.1:4321',
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · apps/worker/src/routes/media-inquiries.ts:11
F-04 Network egressCWE-200 · CWE-319Layer L1
'http://127.0.0.1:4321',
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · apps/worker/src/routes/admin-sso.test.ts:20
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · apps/worker/src/services/auto-reply-normalization.test.ts:14
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · packages/create-line-harness/test/mcp-config.test.ts:8
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.private_key · docs/wiki/Configuration.md:54
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMFilesystem / pathmcp.destructive_tools
F-05 Filesystem / pathCWE-22 · CWE-59Layer L3
manage_auto_replies, manage_forms, manage_message_templates, manage_rich_menus, manage_scenarios, manage_tags, manage_tracked_links, manage_traffic_pools
- Why
- 8 tool(s) can delete or overwrite
- Fix
- prefer a read-only mode or scoped tokens; the page states the blast radius
LOWFilesystem / pathfs.traversal · apps/web/next.config.ts:6
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
const pkg = JSON.parse(readFileSync(resolve(__dirname, '../../package.json'), 'utf-8'))
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · apps/web/src/components/shared/polling-status.tsx:3
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import type { PollingReason } from '../../lib/activity-polling'- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · apps/web/src/components/ui/kumo-phase1-contract.test.ts:6
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
'../../app/staff/page.tsx',
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · apps/web/src/components/ui/kumo-phase1-contract.test.ts:7
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
'../../app/auto-replies/page.tsx',
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · apps/web/src/components/ui/kumo-phase1-contract.test.ts:8
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
'../../app/webhooks/page.tsx',
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · docs/OSS-SANDBOX-MERGE-GATE.md:97
F-04 Network egressCWE-200 · CWE-319Layer L1
NEXT_PUBLIC_API_URL=http://127.0.0.1:8787 pnpm --filter web build
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.decode_call · apps/worker/src/client/main.ts:636
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
const payload = JSON.parse(atob(payloadB64)) as { exp?: number };- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.decode_call · apps/worker/src/lib/admin-sso-token.test.ts:60
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
const json = JSON.parse(atob(parts[0].replaceAll('-', '+').replaceAll('_', '/')));- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.decode_call · apps/worker/src/lib/admin-sso-token.ts:93
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
const binary = atob(standard);
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.decode_call · apps/worker/src/routes/booking.ts:184
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
const json = JSON.parse(atob(padded));
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.decode_call · apps/worker/src/routes/images.ts:37
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
const binary = Uint8Array.from(atob(base64), (ch) => ch.charCodeAt(0));
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWSupply chainsupply.unpinned · apps/liff/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@line/liff, hls.js, react, react-dom, react-router-dom, @tailwindcss/postcss, @types/react, @types/react-dom
- Why
- 15 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · apps/web/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@dnd-kit/core, @dnd-kit/sortable, @dnd-kit/utilities, @phosphor-icons/react, echarts, next, react, react-dom
- Why
- 15 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · apps/worker/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
hls.js, hono, react, react-dom, @cloudflare/vite-plugin, @cloudflare/workers-types, @tailwindcss/vite, @types/react
- Why
- 16 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
Tools it exposes
50 declared in source · 8 destructive
31 read11 write8 destructive
8 tools can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.
| Tool | What it does | Risk |
|---|---|---|
manage_auto_replies | 自動応答の管理操作。list: 一覧、get: 詳細、create: 作成、update: 更新、delete: 削除。キーワードに一致するメッセージに自動返信する。 | destructive |
manage_forms | フォームの管理操作。list: 一覧、get: 詳細、update: 更新、delete: 削除。作成は create_form ツールを使用。 | destructive |
manage_message_templates | メッセージテンプレートの管理。list: 一覧、get: 詳細取得、create: 作成、update: 更新、delete: 削除。キャンペーン特典メッセージのテンプレートを管理する。 | destructive |
manage_rich_menus | リッチメニューの管理操作。list: 一覧取得、delete: 削除、set_default: デフォルト設定。作成は create_rich_menu ツールを使用。 | destructive |
manage_scenarios | シナリオの管理操作。list: 一覧、get: 詳細(ステップ含む)、update: 更新、delete: 削除、add_step: ステップ追加、update_step: ステップ更新、delete_step: ステップ削除。 | destructive |
manage_tags | List, create, or delete tags, and add/remove tags to/from friends. Supports batch operations on multiple friends. | destructive |
manage_tracked_links | トラッキングリンクの管理操作。list: 一覧、update: 更新、delete: 削除。作成は create_tracked_link ツールを使用。 | destructive |
manage_traffic_pools | Traffic Pool の管理。list: 一覧、create: 作成、update: 更新、delete: 削除、list_accounts: Pool内アカウント一覧、add_account: アカウント追加、remove_account: アカウント削除、toggle_account: 有効/無効切替。複数アカウントで均等分散する。 | destructive |
broadcast | Send a broadcast message to all friends, a specific tag group, or a filtered segment. Creates and immediately sends the broadcast. | write |
create_form | Create a form for collecting user responses. Can auto-tag responders and enroll them in scenarios. | write |
create_rich_menu | Create a LINE rich menu with optional image upload. Provide imageData (base64) to attach the menu image in one step. | write |
create_scenario | Create a step delivery scenario with multiple message steps. Each step has a delay and message content. Scenarios auto-trigger on friend_add, tag_added, or manual enrollment. | write |
create_tracked_link | Create a click-tracking link. When clicked, can auto-tag the user, enroll them in a scenario, or send a custom intro message via push. | write |
enroll_in_scenario | Enroll a friend into a scenario. The friend will start receiving the scenario | write |
get_conversion_logs | View ad conversion send logs for a specific platform. Shows the history of conversion events sent to Meta CAPI, X, Google Ads, or TikTok, including status (sent/failed) and error details. | write |
manage_broadcasts | 配信の管理操作。list: 一覧、get: 詳細、create_draft: 下書き作成(送信しない)、update: 更新、send: 送信、send_to_segment: セグメント配信。 | write |
send_message | Send a text, image, or flex message to a specific friend. Use messageType | write |
send_myservice_notification | Send a MyService-related notification (appointment reminder, etc.) to a LINE friend. | write |
upload_image | Upload an image to get a public URL for use in LINE messages (Flex Message hero images, image messages, etc.). Accepts base64-encoded image data. Returns public URL. | write |
Affiliates | アフィリエイト管理 | read |
Broadcasts | 一斉配信 | read |
Conversions | コンバージョン計測 | read |
Forms | フォーム(LIFF 内で回答) | read |
Friends | 友だち管理 | read |
Links | 流入経路(/r) とクリック計測(/t) — 役割が違うので取り違えないこと | read |
Scenarios | ステップ配信シナリオ | read |
Tags | タグ管理 | read |
Users | UUID Cross-Account ユーザー管理 | read |
Webhook | LINE Webhook | read |
Webinars | オートウェビナー(動画・CTA・コメント・分析) | read |
X | a | read |
account_summary | Get a high-level summary of the LINE account: friend count per account (DB + LINE API stats), active scenarios, recent broadcasts, tags, and forms. Use this to understand the current state before making changes. | read |
get_conversation | Get message history for a specific friend (both incoming and outgoing). Each message has a | read |
get_form_submissions | Get all submissions for a specific form. Returns response data with timestamps and friend IDs. | read |
get_friend_detail | Get detailed information about a specific friend including tags, metadata, profile, and message history. | read |
get_link_clicks | Get click analytics for a tracked link including total clicks and per-friend click history. | read |
list_conversations | List unreplied conversations (friends who sent an incoming message with no subsequent human reply). Excludes automated outgoing (broadcast/scenario/auto_reply/reminder) and conversations marked resolved in the admin UI. Results sorted by longest wait first. | read |
list_crm_objects | List all CRM objects of a specific type: scenarios, forms, tags, rich menus, tracked links, or broadcasts. | read |
list_friends | List friends with optional filtering by tag, name search, or metadata values. Returns paginated results with friend details. | read |
lookup_customer | Look up a customer in MyService and show their LINE profile, tags, and membership status. | read |
manage_ad_platforms | Manage ad platform integrations for conversion tracking. Supports Meta (Facebook/Instagram), X (Twitter), Google Ads, and TikTok. Use | read |
manage_entry_routes | 流入リンク(entry_routes)の管理。/r/{refCode} で友だち追加したときの「タグ自動付与」「起動シナリオ」「振り分け先プール」を紐付ける。 | read |
manage_friends | 友だちの管理操作。count: 友だち数取得、set_metadata: メタデータ更新、set_rich_menu: リッチメニュー割当、remove_rich_menu: リッチメニュー解除。 | read |
manage_staff | スタッフアカウントの追加・一覧・更新・削除・APIキー再生成。オーナー権限が必要です。 | read |
manage_webinar_video | No description in the source | read |
イベント名 | イベント説明 | read |
キャンペーンA | 説明 | read |
フォーム名 | フォーム説明 | read |
案件A | desc | read |
診断フォーム | 説明 | read |
Safer alternatives
All cloud & infra servers →Kura✓SAFE
kurajs/kura
Kura — the knowledgebase for humans and agents. Agent-native docs infrastructure, built on June.
1 readGrade B
developers-seosiri-com✓SAFE
SEOSiri-Official/developers-seosiri-com
SEOSiri Official enterprise developer portal & Cloudflare edge topology for AI Search Governance, AEO/GEO Analytics, Schema Validation, Core Web Vitals, DNS Security, and Autonomous AI Agent Tooling for Claude Desktop, Cursor AI, and enterprise AI engines.
1 destructiveGrade B
toolstop✓SAFE
toolstop/toolstop
Small, stateless MCP servers served from toolstop.dev
10 readGrade B
Audit history
- ✕BLOCK F 59 / 100
First audit ·
6dc8d5da5c95
README badge
Badges show the current verdict, BLOCK included
A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.
Questions about line-harness-oss MCP server
What is the line-harness-oss MCP server?
L Harness — self-hosted LINE Official Account CRM: step messaging, broadcasts, forms and reservations, with MCP and TypeScript SDK. By Shudesu (野田修一).
What tools does line-harness-oss expose?
50 in total: 31 read-only, 11 that write, and 8 that can delete or overwrite (manage_auto_replies, manage_forms, manage_message_templates, manage_rich_menus, manage_scenarios). Every one is listed on this page with its risk.
Is line-harness-oss safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (59/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 8 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does line-harness-oss need?
It reads ADMIN_API_KEY, CLOUDFLARE_API_TOKEN, LINE_HARNESS_API_KEY and NEXT_PUBLIC_ADMIN_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does line-harness-oss run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @line-harness/update-engine at 0.0.13.
How current is this page?
The grade is for one exact copy of the source (6dc8d5da5c95), read on 2026-10-25. The repository is watched and re-audited when it changes.
I already installed line-harness-oss. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.
Sources
- Shudesu/line-harness-oss on GitHub — the source we read, its licence, stars and activityObserved · 25 Oct 2026
- ModelsAtlas trust audit — BLOCK verdict for commit 6dc8d5da5c95Observed · 25 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What is the line-harness-oss MCP server?
- What tools does line-harness-oss expose?
- Is line-harness-oss safe to connect to an agent?