ICUICU
critical

mcp-evals

v2.0.1

GitHub Action for evaluating MCP server tool calls using LLM-based scoring

npmmclenhardFirst seen Feb 22, 2026

5

Total

5

Critical

0

High

0

Medium

Findings

unknown
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    5: import path from 'path';
    6: import { createRequire } from 'module';
>>> 7: // Load .env file
    8: dotenv.config();
    9: // Register tsx as a loader
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    7:         command: "tsx",
    8:         args: [serverPath],
>>> 9:         env: Object.fromEntries(Object.entries(process.env).filter(([_, v]) => v !== undefined))
    10:     });
    11:     const client = await experimental_createMCPClient({
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    82:             command: "tsx",
    83:             args: [serverPath],
>>> 84:             env: Object.fromEntries(Object.entries(process.env).filter(([_, v]) => v !== undefined))
    85:         });
    86:         const client = await experimental_createMCPClient({
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    41:             // Set the API key as an environment variable if provided
    42:             if (yamlConfig.model.api_key) {
>>> 43:                 process.env.OPENAI_API_KEY = yamlConfig.model.api_key;
    44:             }
    45:             model = openai(yamlConfig.model.name);
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    48:             // Set the API key as an environment variable if provided
    49:             if (yamlConfig.model.api_key) {
>>> 50:                 process.env.ANTHROPIC_API_KEY = yamlConfig.model.api_key;
    51:             }
    52:             model = anthropic(yamlConfig.model.name);
Report false positive

Scan History

DateRiskFindings
Feb 25, 2026critical5
Feb 23, 2026critical5
Feb 22, 2026critical5