@uidbai/mcp-server
v0.3.16UIDB Design System MCP Server for AI coding tools
17
Total
2
Critical
10
High
5
Medium
Findings
unknownEnvironment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
23: function loadCredentialsFromEnv() {
24: const apiKey = process.env.UIDB_API_KEY;
>>> 25: const projectSlug = process.env.UIDB_PROJECT_SLUG;
26: if (!apiKey || !projectSlug) {
27: return null;Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
22: */
23: function loadCredentialsFromEnv() {
>>> 24: const apiKey = process.env.UIDB_API_KEY;
25: const projectSlug = process.env.UIDB_PROJECT_SLUG;
26: if (!apiKey || !projectSlug) {Decoded base64 content: ��� ��z{bj[����ƥ
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��Kz��*�u�퉩l=�a
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��� ��z{bj[����ƥ
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ���*�u�퉩l=�a
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ���*�u�퉩l=�a
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ���*�u�퉩l=�a
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ���.��*�u�퉩l
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ���*�u�퉩l=�a
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ���*�u�퉩l=�a
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��Kz��*�u�퉩l=�a
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.6 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveJavaScript fetch() call
Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.
33: fetchOptions.body = JSON.stringify(body);
34: }
>>> 35: const response = await fetch(url, fetchOptions);
36: // Handle authentication errors
37: if (response.status === 401) {JavaScript fetch() call
Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.
214: export async function exchangeToken(oneTimeToken) {
215: try {
>>> 216: const response = await fetch(`${UIDB_API_URL}/api/auth/mcp/exchange`, {
217: method: "POST",
218: headers: {JavaScript fetch() call
Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.
253: }
254: try {
>>> 255: const response = await fetch(`${UIDB_API_URL}/api/auth/mcp/refresh`, {
256: method: "POST",
257: headers: {High-entropy string (4.6 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveScan History
| Date | Risk | Findings | Files | Duration |
|---|---|---|---|---|
| Feb 25, 2026 | critical | 17 | 140 | 0.00s |
| Feb 23, 2026 | critical | 17 | 140 | 0.00s |
| Feb 22, 2026 | critical | 17 | 140 | 0.00s |