MCP server · Org-owned · Audited from source

signoz-mcp-server

by signoz/signoz-mcp-serverApache-2.0 licenceAudited 7 Oct 2026 · source 21d203fa903c

npm signoz-mcp-protocol-ci 1.0.0stdiostreamable-http★ 125

!CAUTIONGrade C · 74/100 · 7 Oct 2026 · 21d203f

125GitHub stars

Is it safe? With care — CAUTION, grade C (74/100). The tool list is built at runtime, so we cannot read it from the source. The audit recorded 24 findings (0 critical, 0 high, 4 medium, 14 low). Maintainer's description: MCP Server for SigNoz

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “signoz-mcp-server (SigNoz/signoz-mcp-server)”. Retrieved 7 Oct 2026. https://modelsatlas.com/mcp/signoz/signoz-mcp-server

Trust audit

Audit 0.4.1 · full source read 7 Oct 2026

Trust score74/100!CAUTION C

0 critical0 high4 medium14 low6 info

24 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemNone observedNothing seen in the source
NetworkDeclared3 observations
ShellNone observedNothing seen in the source
DependenciesPinnedNothing floats
SecretsFoundSee the findings

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

Layer	What we check	Result
`L0` Provenance	Repo owner, licence, archive status, activity	PASS 3 findings
`L1` Static source	Secrets, path traversal, supply chain	WARN 10 findings
`L2` Instructions	Prompt injection and authority framing in docs and tool descriptions	PASS 10 findings
`L3` Inventory	Declared tools match the source	PASS 1 finding
`L4` Sandbox	Run in isolation and watch behaviour	SKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

Repository owner signozOrganizationAccount type recorded when we read the repository.
PackagePublished on npmsignoz-mcp-protocol-ci at version 1.0.0
LicenceApache-2.0From the repository, as read at the audited commit.
Last pushTodayActivity of the repository when we read it.
Source commit read21d203fa903cThe audit covers exactly this commit, read on 7 Oct 2026.

Runtime

Sandbox runNot run yetThis audit read the source only; it did not execute the server.
Tool inventoryBuilt at runtimeThe source declares no tools; the server lists them when a client connects, so we cannot read them.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (24)

Sorted by severity

MEDIUMHard-coded secretssecret.generic · internal/client/notification_channels_test.go:150

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.stripe · internal/handler/tools/errs_test.go:356

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.stripe · internal/handler/tools/errs_test.go:359

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.stripe · internal/handler/tools/errs_test.go:360

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

LOWInventory / provenanceinv.hidden_file · .goreleaser.yaml

F-13 Inventory / provenanceCWE-1104Layer L0

.goreleaser.yaml

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.symlink · AGENTS.md

F-13 Inventory / provenanceCWE-1104Layer L0

AGENTS.md

Why: link not followed
Fix: —

LOWNetwork egressnet.metadata_ip · pkg/util/allowlist_test.go:74

F-04 Network egressCWE-200 · CWE-319Layer L1

"169.254.169.254", // SSRF target blocked once an allowlist is set

Why: cloud metadata endpoint: the classic SSRF credential grab
Fix: —

LOWNetwork egressnet.raw_ip · guardrails/README.md:66

F-04 Network egressCWE-200 · CWE-319Layer L1

server --url http://127.0.0.1:<port>/mcp \

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · internal/config/config_test.go:115

F-04 Network egressCWE-200 · CWE-319Layer L1

{"http://0.0.0.0:3301", "not allowed"},

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · internal/docs/verification_test.go:632

F-04 Network egressCWE-200 · CWE-319Layer L1

return &localHTTPTestServer{URL: "http://127.0.0.1", handler: handler}

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · internal/mcp-server/server_test.go:277

F-04 Network egressCWE-200 · CWE-319Layer L1

url:  "https://1.1.1.1:443",

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · internal/mcp-server/server_test.go:278

F-04 Network egressCWE-200 · CWE-319Layer L1

want: "https://1.1.1.1",

Why: No further detail recorded for this rule.
Fix: —

LOWPrompt injectionprompt.transfer_instruction · CLAUDE.md:114

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

never print or persist credentials, report which fields round-tripped server-side, and prefer

Why: an instruction to move sensitive data to an outside destination
Fix: remove; a skill never needs the user's secrets off the machine

LOWPrompt injectionprompt.transfer_instruction · docs/architecture.md:195

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

Since tokens are self-contained encrypted blobs, any server instance with the same `OAUTH_TOKEN_SECRET` can validate any token. No sticky sessions or shared state needed. The only requirement is that

Why: an instruction to move sensitive data to an outside destination
Fix: remove; a skill never needs the user's secrets off the machine

LOWPrompt injectionprompt.transfer_instruction · plans/analytics.md:830

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

The Streamable HTTP transport runs stateless (`WithStateLess(true)`; see [architecture.md](architecture.md)) — no `Mcp-Session-Id` is issued and there is no server-owned session lifecycle to report. T

Why: an instruction to move sensitive data to an outside destination
Fix: remove; a skill never needs the user's secrets off the machine

LOWPrompt injectionprompt.transfer_instruction · plans/observability-refactor.context.md:140

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

This is materially different from the post-decrypt OAuth paths (`handleAuthorizationCodeGrant`, `handleRefreshTokenGrant`, `issueTokenPair`), where `signozURL` comes out of an encrypted token the **se

Why: an instruction to move sensitive data to an outside destination
Fix: remove; a skill never needs the user's secrets off the machine

LOWPrompt injectionprompt.transfer_instruction · plans/official-go-sdk-migration.plan.md:544

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

- `README.md`: supported protocol-era/transport table, `server/discover` and legacy initialize behavior, stateless POST-only endpoint, no session ID, and unchanged client configuration.

Why: an instruction to move sensitive data to an outside destination
Fix: remove; a skill never needs the user's secrets off the machine

LOWInventory / provenancemcp.no_tools_extracted · server.json

F-13 Inventory / provenanceCWE-1104Layer L3

Why: the tool list is enumerated at runtime by tools/list, not declared in source
Fix: the page says so rather than showing an empty table

INFOInventory / provenanceinv.oversize · internal/docs/assets/corpus.gob.gz

F-13 Inventory / provenanceCWE-1104Layer L0

internal/docs/assets/corpus.gob.gz

Why: 1300399 bytes not read
Fix: —

INFOPrompt injectionprompt.credential_read · docs/architecture.md:204

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

When OAuth is enabled, the middleware first tries to decrypt an `Authorization` Bearer token as a server-issued OAuth access token; a valid one unwraps to a stored API key forwarded via `SIGNOZ-API-KE

Why: asks the agent to read credentials
Fix: —

INFOPrompt injectionprompt.credential_read · plans/2026-09-17-released-feature-parity-232.md:276

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

finds it. Use read-only queries and never persist credentials.

Why: asks the agent to read credentials
Fix: —

INFOPrompt injectionprompt.credential_read · plans/official-go-sdk-migration.context.md:331

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

assigning viewer access or creating/revoking credentials.

Why: asks the agent to read credentials
Fix: —

INFOPrompt injectionprompt.credential_read · plans/upstream-error-guidance.plan.md:113

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

read-only, avoid logging credentials, and report whether a real recognized

Why: asks the agent to read credentials
Fix: —

INFOPrompt injectionprompt.credential_read · plans/wire-contract-budget.context.md:69

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

- Do not retry or route around the policy. Ask the user for explicit approval after disclosing the risk. If approved, keep the routing suite non-executing and run only a separately identified read-onl

Why: asks the agent to read credentials
Fix: —

Tools it exposes

None declared in source

The tool list is built at runtime, so we cannot read it from the source.

Install

Package version 1.0.0 · audited commit 21d203f

Read the findings first. The most severe is Hard-coded secrets (medium) at internal/client/notification_channels_test.go.

No connect command is recorded for this server yet. Follow the repository's own instructions, and read the findings above first.

Audit history

2026-10-07
!CAUTION C 74 / 100
Source changed, verdict held · 21d203fa903c
2026-09-15
!CAUTION C 74 / 100
First audit · 6929851bea7b

README badge

For maintainers · updates on every re-audit

[![ModelsAtlas: CAUTION C](https://modelsatlas.com/mcp/signoz/signoz-mcp-server/badge.svg)](https://modelsatlas.com/mcp/signoz/signoz-mcp-server/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about signoz-mcp-server

What is the signoz-mcp-server MCP server?

MCP Server for SigNoz

Is signoz-mcp-server safe to connect to an agent?

With care. The audit graded it C (74/100) and found 24 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does signoz-mcp-server need?

It reads GITHUB_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does signoz-mcp-server run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as signoz-mcp-protocol-ci at 1.0.0.

How current is this page?

The grade is for one exact copy of the source (21d203fa903c), read on 2026-10-07. The repository is watched and re-audited when it changes.

Sources

SigNoz/signoz-mcp-server on GitHub — the source we read, its licence, stars and activityObserved · 7 Oct 2026
ModelsAtlas trust audit — CAUTION verdict for commit 21d203fa903cObserved · 7 Oct 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the signoz-mcp-server MCP server?
GChatGPT CClaude PPerplexity
Is signoz-mcp-server safe to connect to an agent?
GChatGPT CClaude PPerplexity
What credentials does signoz-mcp-server need?
GChatGPT CClaude PPerplexity