ICUICU
critical

zd-mcp-server

v0.5.0

Zendesk MCP Server - Model Context Protocol server for Zendesk Support integration

npmgirish-koundinyaFirst seen Feb 22, 2026

5

Total

4

Critical

0

High

1

Medium

Findings

unknown
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    68: }
    69: const client = zendesk.createClient({
>>> 70:     username: process.env.ZENDESK_EMAIL,
    71:     token: process.env.ZENDESK_TOKEN,
    72:     remoteUri: `https://${process.env.ZENDESK_SUBDOMAIN}.zendesk.com/api/v2`,
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    69: const client = zendesk.createClient({
    70:     username: process.env.ZENDESK_EMAIL,
>>> 71:     token: process.env.ZENDESK_TOKEN,
    72:     remoteUri: `https://${process.env.ZENDESK_SUBDOMAIN}.zendesk.com/api/v2`,
    73: });
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    70:     username: process.env.ZENDESK_EMAIL,
    71:     token: process.env.ZENDESK_TOKEN,
>>> 72:     remoteUri: `https://${process.env.ZENDESK_SUBDOMAIN}.zendesk.com/api/v2`,
    73: });
    74: export function zenDeskTools(server) {
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    64: }
    65: // Environment-based client for backward compatibility
>>> 66: if (!process.env.ZENDESK_EMAIL || !process.env.ZENDESK_TOKEN || !process.env.ZENDESK_SUBDOMAIN) {
    67:     throw new Error('Missing required environment variables: ZENDESK_EMAIL, ZENDESK_TOKEN, ZENDESK_SUBDOMAIN');
    68: }
Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.8 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

Scan History

DateRiskFindings
Feb 25, 2026critical5
Feb 23, 2026critical5
Feb 22, 2026critical5