MCP server · Org-owned · Audited from source

Sourcebot MCP server

by sourcebot-dev/sourcebotNOASSERTION licenceAudited 22 Sep 2026 · source eed6733ae814

npm @sourcebot/web 0.1.0streamable-http★ 3,947

✕BLOCKGrade F · 42/100 · 22 Sep 2026 · eed6733

Safer alternatives View source on GitHub ↗

Is it safe? No — BLOCK, grade F (42/100). It exposes 58 tools: 48 read, 9 write and 1 destructive. The audit recorded 50 findings (0 critical, 3 high, 11 medium, 31 low). Maintainer's description: Sourcebot is a self-hosted tool that helps humans and agents understand your codebase.

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Sourcebot MCP server (sourcebot-dev/sourcebot)”. Retrieved 22 Sep 2026. https://modelsatlas.com/mcp/sourcebot-dev/sourcebot

Why this is BLOCK. The audit found 0 critical and 3 high findings; the most severe is Hard-coded secrets at .devcontainer/docker-compose.yml:16. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 22 Sep 2026

Trust score42/100✕BLOCK F

0 critical3 high11 medium31 low5 info

50 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared11 observations
NetworkDeclared7 observations
ShellNone observedNothing seen in the source
DependenciesNot pinnedSome ranges float
SecretsFoundSee the findings

Findings (50)

Sorted by severity · the 25 most severe of 50 are listed

HIGHHard-coded secretssecret.db_uri · .devcontainer/docker-compose.yml:16

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

HIGHHard-coded secretssecret.db_uri · .env.development:3

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

HIGHHard-coded secretssecret.db_uri · Coastfile:25

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMInformation disclosuredisclose.log_secret · packages/backend/src/ee/tokenRefresh.ts:162

F-12 Information disclosureCWE-209 · CWE-532Layer L1

logger.debug(`Refreshing OAuth token for account ${account.id} (${account.providerId})...`);

Why: No further detail recorded for this rule.
Fix: —

MEDIUMInformation disclosuredisclose.log_secret · packages/backend/src/ee/tokenRefresh.ts:170

F-12 Information disclosureCWE-209 · CWE-532Layer L1

logger.error(`OAuth token refresh failed for account ${account.id} (${account.providerId}): ${message}`);

Why: No further detail recorded for this rule.
Fix: —

MEDIUMInformation disclosuredisclose.log_secret · packages/backend/src/ee/tokenRefresh.ts:194

F-12 Information disclosureCWE-209 · CWE-532Layer L1

logger.debug(`Successfully refreshed OAuth token for account ${account.id} (${account.providerId}).`);

Why: No further detail recorded for this rule.
Fix: —

MEDIUMInformation disclosuredisclose.log_secret · packages/web/src/actions.ts:347

F-12 Information disclosureCWE-209 · CWE-532Layer L1

logger.warn(`Failed to get token for connection ${connection.id}:`, error);

Why: No further detail recorded for this rule.
Fix: —

MEDIUMInformation disclosuredisclose.log_secret · packages/web/src/ee/features/chat/mcp/mcpClientFactory.ts:82

F-12 Information disclosureCWE-209 · CWE-532Layer L1

logger.warn(`Access token for MCP server ${serverName} is expired and has no refresh token. User ${userId} needs to re-authorize.`);

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.db_uri · .github/actions/check-prisma-migrations/action.yml:76

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.db_uri · .github/actions/check-prisma-migrations/action.yml:84

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · packages/backend/src/ee/tokenRefresh.test.ts:303

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · packages/backend/src/utils.test.ts:75

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · packages/backend/src/utils.test.ts:78

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMFilesystem / pathmcp.destructive_tools

F-05 Filesystem / pathCWE-22 · CWE-59Layer L3

delete_issue

Why: 1 tool(s) can delete or overwrite
Fix: prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenanceinv.hidden_file · .env.development

F-13 Inventory / provenanceCWE-1104Layer L0

.env.development

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · .gitmodules

F-13 Inventory / provenanceCWE-1104Layer L0

.gitmodules

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · .trivyignore

F-13 Inventory / provenanceCWE-1104Layer L0

.trivyignore

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · .yarnrc.yml

F-13 Inventory / provenanceCWE-1104Layer L0

.yarnrc.yml

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWFilesystem / pathfs.traversal · packages/db/tools/scripts/inject-audit-data.ts:2

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { PrismaClient } from "../../dist";

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · packages/db/tools/scripts/inject-chat-data.ts:2

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { PrismaClient } from "../../dist";

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · packages/db/tools/scripts/inject-repo-data.ts:2

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { PrismaClient } from "../../dist";

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · packages/db/tools/scripts/inject-user-data.ts:2

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { PrismaClient } from "../../dist";

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · packages/db/tools/scripts/migrate-duplicate-connections.ts:2

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

import { PrismaClient } from "../../dist";

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.env_exfil · packages/setupWizard/tests/e2e/liveDeployment.mjs:157

F-04 Network egressCWE-200 · CWE-319Layer L1

'.env' ... fetch(

Why: reads secrets in the same file that sends data out
Fix: —

LOWNetwork egressnet.raw_ip · packages/backend/src/git.test.ts:61

F-04 Network egressCWE-200 · CWE-319Layer L1

const requestUrl = new URL(request.url ?? '/', 'http://127.0.0.1');

Why: No further detail recorded for this rule.
Fix: —

Tools it exposes

58 declared in source · 1 destructive

48 read9 write1 destructive

1 tool can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.

Tool	What it does	Risk
`delete_issue`	Delete an issue	destructive
`Deploy`	No description in the source	write
`create_issue`	Create issue	write
`mcp_jira__create_ticket`	Create a new Jira ticket	write
`mcp_linear__create_issue`	Create a new issue	write
`mcp_linear__save_comment`	Save a comment on a Linear issue	write
`mcp_linear__save_issue`	Save an issue	write
`mcp_linear__update_issue`	Update an existing issue	write
`mcp_pg__run_query`	Run a database query	write
`mcp_slack__send_message`	Send a message to a Slack channel	write
`Audit`	Audit	read
`Bitbucket`	Bitbucket Cloud or Bitbucket Data Center	read
`Connections`	Code host connection metadata.	read
`Disabled`	Personal review.	read
`Everything`	Index every project visible to the token on this self-hosted instance	read
`Files`	Include a file in the agent\	read
`Foreign`	Shared audit.	read
`Git`	Git history, diff, and file content endpoints.	read
`GitHub`	github.com, GitHub Enterprise Server, or GitHub Enterprise Cloud	read
`GitLab`	gitlab.com, GitLab Self Managed, or GitLab Dedicated	read
`Gitea`	Gitea Cloud or Gitea self-hosted	read
`Groups`	Index every project each chosen group owns	read
`Manual`	Edited description	read
`OpenAI-compatible`	self-hosted / custom endpoint	read
`Organizations`	Index every repo each chosen org owns	read
`Projects`	Index every repo in each chosen project	read
`Renamed`	Edited description	read
`Repositories`	Repository listing and metadata endpoints.	read
`Review`	Review risky changes.	read
`Skill`	Description.	read
`Summarize`	No description in the source	read
`Synced`	Personal review.	read
`System`	System health and version endpoints.	read
`Translate`	Translate text	read
`User`	User Account	read
`Users`	Index every repo each chosen user owns	read
`Workspaces`	Index every repo each chosen workspace owns	read
`X-Sourcebot-Api-Key`	Header of the form	read
`ask_codebase`	No description in the source	read
`cached_tool`	Cached tool	read
`catalog.query-catalog-entities`	Query catalog entities	read
`fake_tool`	A fake tool.	read
`foo-bar`	Hyphenated tool	read
`foo_bar`	Underscored tool	read
`list_issues`	List issues	read
`list_language_models`	No description in the source	read
`live_tool`	Live tool	read
`lookup`	Find alert(1) issues quickly	read
`mcp_github__list_repos`	List GitHub repositories	read
`mcp_github__search_repos`	Search repositories on GitHub	read
`mcp_linear__list_issues`	List issues	read
`new_tool`	Newly discovered	read
`search`	Find issues	read
`search_repos`	Search repos	read
`tool`	x	read
`tool1`	Tool 1	read
`tool2`	Tool 2	read
`xAI`	Grok	read

Safer alternatives

All code intelligence servers →

Srclight✓SAFE

srclight/srclight

Deep code indexing MCP server for AI agents. 25 tools: hybrid FTS5 + embedding search, call graphs, git blame/hotspots, build system analysis. Multi-repo workspaces, GPU-accelerated semantic search, 10 languages via tree-sitter. Fully local, zero cloud dependencies.

3 writeGrade B

Antigravity Workspace✓SAFE

study8677/antigravity-workspace-template

🧠 RepoBrain (formerly Antigravity) — Give your repo a brain. ChatGPT for your codebase: works in Claude Code, Cursor, Codex, Windsurf & more.

1 writeGrade B

Axon Pro✓SAFE

talhamsajid/axon-pro

Enterprise-grade graph-powered code intelligence engine. Deep structural awareness for Laravel, PHP, Python, and JS. Powers AI agents with high-fidelity architectural context via MCP & Neo4j.

1 writeGrade B

Audit history

2026-09-22
✕BLOCK F 42 / 100
Source changed, verdict held · eed6733ae814
2026-09-15
✕BLOCK F 42 / 100
First audit · 21920dda1711

README badge

Badges show the current verdict, BLOCK included

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about Sourcebot MCP server

What is the Sourcebot MCP server?

Sourcebot is a self-hosted tool that helps humans and agents understand your codebase.

What tools does Sourcebot expose?

58 in total: 48 read-only, 9 that write, and 1 that can delete or overwrite (delete_issue). Every one is listed on this page with its risk.

Is Sourcebot safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (42/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Sourcebot need?

It reads ANTHROPIC_API_KEY, AUTH_SECRET, AUTH_URL, EXPERIMENT_DISABLE_API_KEY_CREATION_FOR_NON_ADMIN_USERS, SCIM_TOKEN, SENTRY_AUTH_TOKEN, SETUP_TEST_CREDENTIAL_DIR, SETUP_TEST_DEV_TOKEN and SOURCEBOT_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Sourcebot run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @sourcebot/web at 0.1.0.

How current is this page?

The grade is for one exact copy of the source (eed6733ae814), read on 2026-09-22. The repository is watched and re-audited when it changes.

I already installed Sourcebot. What should I do?

Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.

Can the verdict change?

Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

sourcebot-dev/sourcebot on GitHub — the source we read, its licence, stars and activityObserved · 22 Sep 2026
ModelsAtlas trust audit — BLOCK verdict for commit eed6733ae814Observed · 22 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Sourcebot MCP server?
GChatGPT CClaude PPerplexity
What tools does Sourcebot expose?
GChatGPT CClaude PPerplexity
Is Sourcebot safe to connect to an agent?
GChatGPT CClaude PPerplexity