redis-mcpBLOCK
Redis MCP server -- SCAN-based key exploration, TTL/memory/keyspace introspection, slowlog + INFO health, and a DBA advisor for AI assistants
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://yaw.sh/mcp/install?name=Redis&command=npx&args=-y%2C%40yawlabs%2Fredis-mcp&description=Explore%20and%20diagnose%20Redis%20-%20SCAN%20key%20exploration%2C%20health%2C%20DBA%20advisor&source=https%3A%2F%2Fgithub.com%2FYawLabs%2Fredis-mcp)
One click adds this to your local Yaw MCP config so it's available in every Yaw Terminal session. Or install manually below.
Then give it your `REDIS_URL`. The button deliberately carries no connection string, and Yaw MCP will not prompt for one: it asks only for variables whose names look like credentials, and REDIS_URL does not. Until it is set, the server exits at startup with REDIS_URL is not set. Store it in Yaw MCP's encrypted vault in one step:
yaw-mcp set redis env.REDIS_URL --secret
The value is read from a no-echo prompt (or piped stdin), never from the command line; the vault entry is named redis_redis_url and the server's entry gets "REDIS_URL": "${secret:redis_redis_url}". Yaw MCP reads the vault when it starts the server, so after changing the value run mcp_connect_deactivate redis (or start a new session) for the new one to take effect.
[](https://www.npmjs.com/package/@yawlabs/redis-mcp) [](https://opensource.org/licenses/MIT)
Explore and diagnose a Redis instance from Claude Code, Cursor, and any MCP client. Read-only by default - writes opt in via a single env var - and key enumeration always uses SCAN, never the O(N) KEYS, so it is safe to point at a production instance with millions of keys.
Built and maintained by Yaw Labs.
Why this one?
- `SCAN`, never `KEYS`. Every key-enumeration path uses cursor-based
SCANwith a boundedCOUNTand an iteration cap.KEYS *is O(N) over the entire keyspace and blocks Redis's single-threaded even
112535c30737OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add redis-mcp -- npx -y @yawlabs/[email protected]
Exposed tools (7)
6 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
redis_advisor | read | Rolled-up Redis health lint pass -- one call returns four categories of findings, each with |
redis_command | write | Run a single Redis command through the safety gate. Read-only commands (GET, HGETALL, |
redis_get | read | Read a key |
redis_health | read | One-call health snapshot rolled up from INFO + DBSIZE + recent SLOWLOG: server version and |
redis_key_info | read | Inspect a single key without reading its (possibly huge) value: type, TTL (seconds and |
redis_scan | read | Enumerate keys with cursor-based SCAN -- NEVER the O(N) KEYS command, so this is safe to |
redis_slowlog | read | Recent entries from the Redis slow log -- commands that took longer than |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (6 observation(s))
- Shell
- declared (4 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (12)
const SSH = 'ssh -i ~/.ssh/gh_woods -o IdentitiesOnly=yes';
if (raw === "0" || raw === "false") return { rejectUnauthorized: false };return new Function(`${pieces}\nreturn runtimePlan;`)() as RuntimePlan;return new Function(`${pieces}\nreturn { pickNewest, floor: OAM_MIN };`)() as {const netGrant = new Function(
const remedyFor = new Function(
const childEnv = new Function(
const source = readFileSync(fileURLToPath(new URL("../../src/tools/keyspace.ts", import.meta.url)), "utf8");it("maps '0'/'false' -> rejectUnauthorized:false, '1'/'true' -> true, no warning", () => {assert.deepEqual(getTlsConfig(), { rejectUnauthorized: false });@biomejs/biome, @modelcontextprotocol/sdk, @types/node, @yawlabs/mcp-compliance, esbuild, ioredis, postject, typescript
- **The bundled MCP SDK moves from 1.30.0 to 1.32.1** (GHSA-6qxp-vccf-f47h, high: the SDK's OAuth client could send credentials to an authorization server chosen by the MCP server). esbuild bundles th
Gates applied: no_behavioural_pass.
112535c30737full audit observations/trust-audit/mcp-server/yawlabs__redis-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 112535c30737 | BLOCK | D | 69 | first audit |
Questions
What is the redis-mcp MCP server?
Redis MCP server -- SCAN-based key exploration, TTL/memory/keyspace introspection, slowlog + INFO health, and a DBA advisor for AI assistants
What tools does redis-mcp expose?
7 in total: 6 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is redis-mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does redis-mcp need?
It reads GH_TOKEN, GITHUB_TOKEN, REDIS_MAX_KEYS and REDIS_TLS_REJECT_UNAUTHORIZED from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does redis-mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @yawlabs/redis-mcp at 0.5.3.
How current is this page?
The grade is for one exact copy of the source (112535c30737), read on 2026-10-11. The repository is watched and re-audited when it changes.