ICUICU
critical

accessflow-mcp-server

v2.3.5

AccessFlow MCP Server for accessibility issue remediation

npmsharon_miFirst seen Feb 22, 2026Source

24

Total

12

Critical

9

High

3

Medium

Findings

unknown
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    17:         this.environment =
    18:             process.env.ENVIRONMENT || 'https://accessflow.accessibe.com';
>>> 19:         const nonProdUserName = process.env.NON_PROD_USER_NAME;
    20:         const nonProdPassword = process.env.NON_PROD_PASSWORD;
    21:         // Configure server options based on transport type
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    7:         console.log('Starting HTTP server...');
    8:         // Get port from environment variable or use default
>>> 9:         const port = process.env.PORT ? parseInt(process.env.PORT, 10) : 8080;
    10:         const stateless = process.env.STATELESS === 'true';
    11:         const transportConfig = {
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    8:         // Get port from environment variable or use default
    9:         const port = process.env.PORT ? parseInt(process.env.PORT, 10) : 8080;
>>> 10:         const stateless = process.env.STATELESS === 'true';
    11:         const transportConfig = {
    12:             type: 'httpStream',
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    16:         this.transportConfig = transportConfig;
    17:         this.environment =
>>> 18:             process.env.ENVIRONMENT || 'https://accessflow.accessibe.com';
    19:         const nonProdUserName = process.env.NON_PROD_USER_NAME;
    20:         const nonProdPassword = process.env.NON_PROD_PASSWORD;
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    18:             process.env.ENVIRONMENT || 'https://accessflow.accessibe.com';
    19:         const nonProdUserName = process.env.NON_PROD_USER_NAME;
>>> 20:         const nonProdPassword = process.env.NON_PROD_PASSWORD;
    21:         // Configure server options based on transport type
    22:         if (transportConfig.type === 'httpStream') {
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    99:         else {
    100:             // stdio mode: Use environment variables (backward compatible)
>>> 101:             const domain = sanitizeDomain(process.env.DOMAIN || '');
    102:             const apiKey = process.env.API_KEY || '';
    103:             this.stdioApiService = new ApiService(this.environment, domain, apiKey, nonProdUserName, nonProdPassword);
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    100:             // stdio mode: Use environment variables (backward compatible)
    101:             const domain = sanitizeDomain(process.env.DOMAIN || '');
>>> 102:             const apiKey = process.env.API_KEY || '';
    103:             this.stdioApiService = new ApiService(this.environment, domain, apiKey, nonProdUserName, nonProdPassword);
    104:             this.options = {
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    113:         const transportMode = transportType === 'stdio' ? 'stdio' : 'HTTP';
    114:         logger.info(`Initializing Flow MCP Server (${transportMode} mode)...`);
>>> 115:         const nonProdUserName = process.env.NON_PROD_USER_NAME;
    116:         const nonProdPassword = process.env.NON_PROD_PASSWORD;
    117:         // Register tools with appropriate configuration
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    114:         logger.info(`Initializing Flow MCP Server (${transportMode} mode)...`);
    115:         const nonProdUserName = process.env.NON_PROD_USER_NAME;
>>> 116:         const nonProdPassword = process.env.NON_PROD_PASSWORD;
    117:         // Register tools with appropriate configuration
    118:         if (transportType === 'stdio') {
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    7:     static instance;
    8:     static build() {
>>> 9:         const isCloudRun = process.env.K_SERVICE !== undefined; // Cloud Run sets K_SERVICE
    10:         // In Cloud Run: log to stdout for GCP Logging
    11:         // In stdio: log to file for local debugging
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    27:         }
    28:         const logger = pino({
>>> 29:             level: process.env.LOG_LEVEL || 'info',
    30:             timestamp: pino.stdTimeFunctions.isoTime,
    31:             formatters: {
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    38:         logger.info({
    39:             logLocation,
>>> 40:             environment: process.env.NODE_ENV,
    41:             isCloudRun,
    42:         }, 'Logger initialized');
Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ���,�tI'���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: 1�Cz֢��,�䜅�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: J���^y��rD^��'�䜅�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: �ǫ�'����'��'

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: 1�Cz֢��,�䜅�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: J���^y��rD^��'�䜅�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ���,�tI'���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ���,�tI'���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��b�����}�m�$

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    69:         }
    70:         try {
>>> 71:             const response = await fetch(url, fetchOptions);
    72:             if (!response.ok) {
    73:                 // Try to get error details from response body
Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

Scan History

DateRiskFindings
Feb 25, 2026critical24
Feb 23, 2026critical24
Feb 22, 2026critical24