ICUICU
critical

@currents/mcp

v2.2.6

Currents MCP server

npmGitHub ActionsFirst seen Feb 22, 2026

14

Total

2

Critical

2

High

10

Medium

Findings

unknown
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

>>> 1: export const CURRENTS_API_URL = process.env.CURRENTS_API_URL || "https://api.currents.dev/v1";
    2: export const CURRENTS_API_KEY = process.env.CURRENTS_API_KEY || "";
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    1: export const CURRENTS_API_URL = process.env.CURRENTS_API_URL || "https://api.currents.dev/v1";
>>> 2: export const CURRENTS_API_KEY = process.env.CURRENTS_API_KEY || "";
Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: }�\�+����jǝ=�"��^t b

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��nZ�f����54HD�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
mediumOB-001ObfuscationMedium ConfidenceLine 0

Possible Base64-encoded payload (long encoded string)

Detected by automated pattern matching (rule OB-001) with medium confidence. May be a false positive.

    5: This is a MCP server that allows you to provide test results context to your AI agents by connecting them to Currents. Useful for asking AI to fix or optimize tests failing in CI.
    6: 
>>> 7: [![Install MCP Server](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/en/install-mcp?name=currents&config=eyJjb21tYW5kIjoibnB4IC15IEBjdXJyZW50cy9tY3AiLCJlbnYiOnsiQ1VSUkVOVFNfQVBJX0tFWSI6InlvdXItYXBpLWtleSJ9fQ%3D%3D)
    8: 
    9: ## Tools
Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (5.2 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    9:     };
    10:     try {
>>> 11:         const response = await fetch(`${CURRENTS_API_URL}${path}`, { headers });
    12:         if (!response.ok) {
    13:             logger.error(`HTTP error! status: ${response.status}`);
Report false positive
mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    30:     };
    31:     try {
>>> 32:         const response = await fetch(`${CURRENTS_API_URL}${path}`, {
    33:             method: "POST",
    34:             headers,
Report false positive
mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    55:     };
    56:     try {
>>> 57:         const response = await fetch(`${CURRENTS_API_URL}${path}`, {
    58:             method: "PUT",
    59:             headers,
Report false positive
mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    79:     };
    80:     try {
>>> 81:         const response = await fetch(`${CURRENTS_API_URL}${path}`, {
    82:             method: "DELETE",
    83:             headers,
Report false positive
mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    42:         .number()
    43:         .optional()
>>> 44:         .describe("The page number to fetch (0-indexed). Defaults to 0."),
    45:     tags: z
    46:         .array(z.string())
Report false positive
mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    48:         .number()
    49:         .optional()
>>> 50:         .describe("The page number to fetch (0-indexed). Defaults to 0."),
    51:     tags: z
    52:         .array(z.string())
Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.7 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

Scan History

DateRiskFindings
Feb 23, 2026critical14
Feb 22, 2026critical14