ICUICU
critical

@mcp-apps/kusto-mcp-server

v1.0.41

MCP server for interacting with Kusto databases

npmaditya.vaishFirst seen Feb 22, 2026Source

13

Total

5

Critical

7

High

1

Medium

Findings

unknown
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    10:   try {
    11:     const server = new McpServer({
>>> 12:       name: process.env.MCP_SERVER_NAME || "kusto-mcp-server",
    13:       description: "Kusto MCP Server for Azure Data Explorer integration",
    14:       version: process.env.MCP_SERVER_VERSION || "1.0.0",
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    12:       name: process.env.MCP_SERVER_NAME || "kusto-mcp-server",
    13:       description: "Kusto MCP Server for Azure Data Explorer integration",
>>> 14:       version: process.env.MCP_SERVER_VERSION || "1.0.0",
    15:       capabilities: {
    16:         resources: {},
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    10:     try {
    11:         const server = new mcp_js_1.McpServer({
>>> 12:             name: process.env.MCP_SERVER_NAME || "kusto-mcp-server",
    13:             description: "Kusto MCP Server for Azure Data Explorer integration",
    14:             version: process.env.MCP_SERVER_VERSION || "1.0.0",
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    12:             name: process.env.MCP_SERVER_NAME || "kusto-mcp-server",
    13:             description: "Kusto MCP Server for Azure Data Explorer integration",
>>> 14:             version: process.env.MCP_SERVER_VERSION || "1.0.0",
    15:             capabilities: {
    16:                 resources: {},
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

>>> 1: {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AACA,oEAAoE;AACpE,wEAAiF;AAEjF,qDAAqD;AACrD,+DAA8D;AAC9D,yDAAyD;AAEzD,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC;YAC3B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,kBAAkB;YACvD,WAAW,EAAE,sDAAsD;YACnE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO;YAClD,YAAY,EAAE;gBACZ,SAAS,EAAE,EAAE;gBACb,KAAK,EAAE,EAAE;aACV;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,CACT,4BAAc,CAAC,IAAI,EACnB,4BAAc,CAAC,WAAW,EAC1B,4BAAc,CAAC,UAAU,EACzB,4BAAc,CAAC,OAAO,CACvB,CAAC;QAEF,MAAM,CAAC,IAAI,CACT,qCAAkB,CAAC,IAAI,EACvB,qCAAkB,CAAC,WAAW,EAC9B,qCAAkB,CAAC,UAAU,EAC7B,qCAAkB,CAAC,OAAO,CAC3B,CAAC;QAEF,MAAM,CAAC,IAAI,CACT,gCAAgB,CAAC,IAAI,EACrB,gCAAgB,CAAC,WAAW,EAC5B,gCAAgB,CAAC,UAAU,EAC3B,gCAAgB,CAAC,OAAO,CACzB,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,+BAAoB,EAAE,CAAC;QAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,KAAU,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3D,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC","sourcesContent":["#!/usr/bin/env node\r\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\r\nimport { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';\r\n\r\nimport { listTablesTool } from \"./tools/list-tables\";\r\nimport { getTableSchemaTool } from \"./tools/get-table-schema\";\r\nimport { executeQueryTool } from \"./tools/execute-query\";\r\n\r\nasync function main() {\r\n  try {\r\n    const server = new McpServer({\r\n      name: process.env.MCP_SERVER_NAME || \"kusto-mcp-server\",\r\n      description: \"Kusto MCP Server for Azure Data Explorer integration\",\r\n      version: process.env.MCP_SERVER_VERSION || \"1.0.0\",\r\n      capabilities: {\r\n        resources: {},\r\n        tools: {},\r\n      },\r\n    });\r\n\r\n    server.tool(\r\n      listTablesTool.name,\r\n      listTablesTool.description,\r\n      listTablesTool.parameters,\r\n      listTablesTool.handler\r\n    );\r\n\r\n    server.tool(\r\n      getTableSchemaTool.name,\r\n      getTableSchemaTool.description,\r\n      getTableSchemaTool.parameters,\r\n      getTableSchemaTool.handler\r\n    );\r\n\r\n    server.tool(\r\n      executeQueryTool.name,\r\n      executeQueryTool.description,\r\n      executeQueryTool.parameters,\r\n      executeQueryTool.handler\r\n    );\r\n\r\n    const transport = new StdioServerTransport();\r\n    await server.connect(transport);\r\n    console.error(\"Kusto MCP Server running on stdio\");\r\n  }\r\n  catch (error: any) {\r\n    console.error(\"Error starting MCP server:\", error.message);\r\n    console.error(\"Stack trace:\", error.stack);\r\n    process.exit(1);\r\n  }\r\n}\r\n\r\nmain();"]}
Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: J�b�'���ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: J�b�'���ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��^��'��m��-��%��d

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: J�b�'���ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: J�b�'���ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: J�b�'���ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDE-008Data ExfiltrationMedium ConfidenceLine 0

NPM config access (may contain tokens)

Detected by automated pattern matching (rule DE-008) with medium confidence. May be a false positive.

    20:     "test": "vitest run",
    21:     "debug": "npx @modelcontextprotocol/inspector node dist/index.js",
>>> 22:     "token": "npx vsts-npm-auth -config .npmrc"
    23:   },
    24:   "dependencies": {
Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.7 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

Scan History

DateRiskFindings
Feb 25, 2026critical13
Feb 23, 2026critical13
Feb 22, 2026critical13