ModelsAtlas
Explore
Atlas / MCP servers / wictorwilen / MRSF

MRSFBLOCK

mcp/wictorwilen/mrsf
MCP server by wictorwilen · agent skills · agent tools · ci cd · Audited 2026-10-09
⚑ Report / re-scanSource ↗

Markdown Review Sidecar Format (MRSF) v1.0 - Sidemark

Verdict
BLOCK
Grade
F
Trust score
56 /100
Exposed tools
13 8r · 4w · 1d
Transport
sse · stdio
License
MIT
Stars
30
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](LICENSE) [](MRSF-v1.0.md) [](https://www.npmjs.com/package/@mrsf/cli) [](https://www.npmjs.com/package/@mrsf/mcp) [](https://www.npmjs.com/package/@mrsf/cli) [](https://www.npmjs.com/package/@mrsf/mcp) [](https://marketplace.visualstudio.com/items?itemName=wictor.mrsf-vscode) [](https://marketplace.visualstudio.com/items?itemName=wictor.mrsf-vscode) [](https://pypi.org/project/mrsf/) [](https://www.npmjs.com/package/@mrsf/markdown-it-mrsf) [](https://www.npmjs.com/package/@mrsf/marp-mrsf) [](https://www.npmjs.com/package/@mrsf/marked-mrsf) [](https://www.npmjs.com/package/@mrsf/rehype-mrsf) [![MCP Compatible](https://img.shields.io/badge/MCP-compatible-

Read from source at commit bd28787b8e60OBSERVED · 2026-10-09
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add mrsf-vscode -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "mrsf-vscode": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}
03

Exposed tools (13)

8 read · 4 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
mrsf_addwrite
mrsf_add_batchwrite
mrsf_deletedestructive
mrsf_discoverread
mrsf_helpread
mrsf_listread
mrsf_reanchorread
mrsf_renamewrite
mrsf_repairread
mrsf_resolveread
mrsf_statusread
mrsf_updatewrite
mrsf_validateread
04

Trust audit

BLOCKgrade F · trust 56/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (1 observation(s))
Network
declared (1 observation(s))
Shell
declared (9 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (24)

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
cli/src/lib/discovery.ts:52
const parsed = yaml.load(raw, { schema: yaml.JSON_SCHEMA }) as Record<string, unknown> | null;
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
cli/src/lib/serialize.ts:58
parsed = yaml.load(trimmed, { schema: yaml.JSON_SCHEMA });
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
cli/src/lib/serialize.ts:90
parsed = isJson ? JSON.parse(trimmed) : yaml.load(trimmed, { schema: yaml.JSON_SCHEMA });
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
cli/src/lib/serialize.ts:168
const parsed = yaml.load(trimmed, { schema: yaml.JSON_SCHEMA });
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
MEDIUMInventory / provenance · inv.binary · CWE-1104
python/.coverage
.coverage
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
vscode/src/sidebar/SidebarViewProvider.ts:456
const filterIcon = showResolved ? "👁" : "👁🗨";
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
mrsf_delete
Why it matters. 1 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenance · inv.hidden_file · CWE-1104
python/.coverage
.coverage
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
vscode/.vscodeignore
.vscodeignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
cli/src/__tests__/conformance.test.ts:1300
"sidecar_root: ../../etc/reviews\n",
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
cli/src/__tests__/reanchor-eval.test.ts:149
fileURLToPath(new URL("../../../evaluation/reanchor/schema.json", import.meta.url)),
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
cli/src/__tests__/reanchor-eval.test.ts:161
"../../../evaluation/reanchor/cases",
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
cli/src/__tests__/reanchor-eval.test.ts:165
"../../../evaluation/reanchor/schema.json",
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
cli/src/__tests__/reanchor-generator.test.ts:78
"../../../evaluation/reanchor/schema.json",
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
vscode/test/suite.cjs:90
const browser = await chromium.connectOverCDP(`http://127.0.0.1:${process.env.MRSF_TEST_CDP_PORT}`);
LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
README.md:20
[![MCP Compatible](https://img.shields.io/badge/MCP-compatible-blueviolet?logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCIgZmlsbD0id2hpdGU
LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
mcp/README.md:9
[![MCP Compatible](https://img.shields.io/badge/MCP-compatible-blueviolet?logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCAyNCAyNCIgZmlsbD0id2hpdGU
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
cli/package.json
ajv, ajv-formats, chalk, chokidar, commander, fastest-levenshtein, js-yaml, uuid
Why it matters. 16 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
docs/package.json
remark-gfm, marked, markdown-it, mermaid, rehype-stringify, remark-breaks, remark-parse, remark-rehype
Why it matters. 11 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
examples/package.json
@marp-team/marpit, @milkdown/core, @milkdown/crepe, @milkdown/ctx, @milkdown/kit, @milkdown/plugin-listener, @milkdown/prose, @tiptap/core
Why it matters. 24 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
mcp/package.json
@modelcontextprotocol/sdk, @types/node, esbuild, typescript, vitest, zod
Why it matters. 6 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@vitest/coverage-v8, jsdom, vitest
Why it matters. 3 dependency range(s) float
Fix. pin exact versions or ship a lockfile
INFOInventory / provenance · inv.oversize · CWE-1104
media/mrsf-logo.png
media/mrsf-logo.png
Why it matters. 1362526 bytes not read
INFOPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
examples/security-policy.md:56
- **Admin**: Full access to all resources. Can manage users and roles.

Gates applied: no_behavioural_pass.

Audited 2026-10-09 · audit v0.4.1 · source sha bd28787b8e60full audit observations/trust-audit/mcp-server/wictorwilen__mrsf.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-09bd28787b8e60BLOCKF56first audit
06

Questions

What is the MRSF MCP server?

Markdown Review Sidecar Format (MRSF) v1.0 - Sidemark

What tools does MRSF expose?

13 in total: 8 read-only, 4 that write, and 1 that can delete or overwrite (mrsf_delete). Every one is listed on this page with its risk.

Is MRSF safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (56/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does MRSF need?

No credential environment variables were found in its source, so it appears to need none.

How does MRSF run?

It speaks sse and stdio, so it runs as a local process your client starts. It is published on npm as mrsf-vscode at 0.6.0.

How current is this page?

The grade is for one exact copy of the source (bd28787b8e60), read on 2026-10-09. The repository is watched and re-audited when it changes.

Advertisement