@florentine-ai/mcp
v0.2.1MCP server for Florentine.ai - Natural language to MongoDB aggregations
45
Total
8
Critical
26
High
11
Medium
Findings
unknownEnvironment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
30: ? JSON.parse(process.env.REQUIRED_INPUTS)
31: : undefined,
>>> 32: returnTypes: process.env.RETURN_TYPES
33: ? JSON.parse(process.env.RETURN_TYPES)
34: : ['result']Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
28: sessionId: process.env.SESSION_ID,
29: requiredInputs: process.env.REQUIRED_INPUTS
>>> 30: ? JSON.parse(process.env.REQUIRED_INPUTS)
31: : undefined,
32: returnTypes: process.env.RETURN_TYPESEnvironment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
24: const envConfig = EnvConfigSchema.parse({
25: florentineToken: process.env.FLORENTINE_TOKEN,
>>> 26: llmService: process.env.LLM_SERVICE,
27: llmKey: process.env.LLM_KEY,
28: sessionId: process.env.SESSION_ID,Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
23: : undefined;
24: const envConfig = EnvConfigSchema.parse({
>>> 25: florentineToken: process.env.FLORENTINE_TOKEN,
26: llmService: process.env.LLM_SERVICE,
27: llmKey: process.env.LLM_KEY,Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
27: llmKey: process.env.LLM_KEY,
28: sessionId: process.env.SESSION_ID,
>>> 29: requiredInputs: process.env.REQUIRED_INPUTS
30: ? JSON.parse(process.env.REQUIRED_INPUTS)
31: : undefined,Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
26: llmService: process.env.LLM_SERVICE,
27: llmKey: process.env.LLM_KEY,
>>> 28: sessionId: process.env.SESSION_ID,
29: requiredInputs: process.env.REQUIRED_INPUTS
30: ? JSON.parse(process.env.REQUIRED_INPUTS)Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
25: florentineToken: process.env.FLORENTINE_TOKEN,
26: llmService: process.env.LLM_SERVICE,
>>> 27: llmKey: process.env.LLM_KEY,
28: sessionId: process.env.SESSION_ID,
29: requiredInputs: process.env.REQUIRED_INPUTSEnvironment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
31: : undefined,
32: returnTypes: process.env.RETURN_TYPES
>>> 33: ? JSON.parse(process.env.RETURN_TYPES)
34: : ['result']
35: });Decoded base64 content: L���*%��-���E�)�{
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: �N����m����{��7�Mu
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��^��'��m��-��%
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: J�b�)bz{S��즊�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: J�b�)bz{S��즊�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: zxZ�ǀ�Cڭ�����
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: zxZ�ǀ�Cڭ�����
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: J�b�)bz{S��즊�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: zxZ�ǀ�Cڭ�����
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: zxZ�ǀ�Cڭ�����
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: zxZ�ǀ�Cڭ�����
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: zxZ�ǀ�Cڭ�����
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: j/�y�n��?�ꮊ��
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: �N����m����{��7�Mu
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: �N����m����{��7�Mu
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: �N���^�] �����G�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: �N���^�] �����G�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: �N���^�] �����G�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: �N����m����{��7�Mu
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: Z+z{b��,j���+
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: J�b�'���ӭ�즊�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: J�b�'���ӭ�즊�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: � j{����Ԝ��
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: � j{����Ԝ��
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: � j{����Ԝ��
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: � j{����Ԝ��
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveJavaScript fetch() call
Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.
216: return {
217: question,
>>> 218: // Mocking user data fetch (i.e. returnTypes, requiredInputs, etc.),
219: // replace with actual implementation
220: ...(await fetchUserSpecificData({ userId: '<USER_ID>' }))High-entropy string (4.7 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.5 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.7 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.5 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.6 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.9 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveJavaScript fetch() call
Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.
56: // > => {
57: // try {
>>> 58: // const response: Response = await fetch(
59: // `${FLORENTINE_BASE_URL}/collections`,
60: // {JavaScript fetch() call
Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.
31: listCollections = async () => {
32: try {
>>> 33: const response = await fetch(`${FlorentineServer.FLORENTINE_BASE_URL}/collections`, {
34: headers: this.headers
35: });JavaScript fetch() call
Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.
65: });
66: this.logger?.info('Request body of florentine_ask tool:', requestBody);
>>> 67: const response = await fetch(`${FlorentineServer.FLORENTINE_BASE_URL}/ask`, {
68: method: 'POST',
69: headers: this.headers,JavaScript fetch() call
Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.
31: // });
32: // Logger?.error('Request Body:', requestBody);
>>> 33: // const response: Response = await fetch(`${FLORENTINE_BASE_URL}/ask`, {
34: // method: 'POST',
35: // headers,Scan History
| Date | Risk | Findings | Files | Duration |
|---|---|---|---|---|
| Feb 25, 2026 | critical | 45 | 11 | 0.00s |
| Feb 23, 2026 | critical | 45 | 11 | 0.00s |
| Feb 22, 2026 | critical | 45 | 11 | 0.00s |