critical
mcp-evals
v2.0.1GitHub Action for evaluating MCP server tool calls using LLM-based scoring
5
Total
5
Critical
0
High
0
Medium
Findings
unknowncriticalDE-002Data ExfiltrationHigh ConfidenceLine 0
Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
5: import path from 'path';
6: import { createRequire } from 'module';
>>> 7: // Load .env file
8: dotenv.config();
9: // Register tsx as a loaderReport false positivecriticalDE-002Data ExfiltrationHigh ConfidenceLine 0
Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
7: command: "tsx",
8: args: [serverPath],
>>> 9: env: Object.fromEntries(Object.entries(process.env).filter(([_, v]) => v !== undefined))
10: });
11: const client = await experimental_createMCPClient({Report false positivecriticalDE-002Data ExfiltrationHigh ConfidenceLine 0
Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
82: command: "tsx",
83: args: [serverPath],
>>> 84: env: Object.fromEntries(Object.entries(process.env).filter(([_, v]) => v !== undefined))
85: });
86: const client = await experimental_createMCPClient({Report false positivecriticalDE-002Data ExfiltrationHigh ConfidenceLine 0
Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
41: // Set the API key as an environment variable if provided
42: if (yamlConfig.model.api_key) {
>>> 43: process.env.OPENAI_API_KEY = yamlConfig.model.api_key;
44: }
45: model = openai(yamlConfig.model.name);Report false positivecriticalDE-002Data ExfiltrationHigh ConfidenceLine 0
Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
48: // Set the API key as an environment variable if provided
49: if (yamlConfig.model.api_key) {
>>> 50: process.env.ANTHROPIC_API_KEY = yamlConfig.model.api_key;
51: }
52: model = anthropic(yamlConfig.model.name);Report false positiveScan History
| Date | Risk | Findings | Files | Duration |
|---|---|---|---|---|
| Feb 25, 2026 | critical | 5 | 24 | 0.00s |
| Feb 23, 2026 | critical | 5 | 24 | 0.00s |
| Feb 22, 2026 | critical | 5 | 24 | 0.00s |