ICUICU
critical

touchdesigner-mcp-server

v1.4.4

MCP server for TouchDesigner

npm8beeeaaatFirst seen Feb 22, 2026

24

Total

17

Critical

4

High

3

Medium

Findings

unknown
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    27:             await this.server.connect(transport);
    28:             this.logger.sendLog({
>>> 29:                 data: `Server connected and ready to process requests: ${process.env.TD_WEB_SERVER_HOST}:${process.env.TD_WEB_SERVER_PORT}`,
    30:                 level: "info",
    31:                 logger: "ConnectionManager",
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    97:         // Parse TouchDesigner connection arguments
    98:         const args = parseArgs(params?.argv);
>>> 99:         process.env.TD_WEB_SERVER_HOST = args.host;
    100:         process.env.TD_WEB_SERVER_PORT = args.port.toString();
    101:         // Create MCP server
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    98:         const args = parseArgs(params?.argv);
    99:         process.env.TD_WEB_SERVER_HOST = args.host;
>>> 100:         process.env.TD_WEB_SERVER_PORT = args.port.toString();
    101:         // Create MCP server
    102:         const server = new TouchDesignerServer();
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    177: startServer({
    178:     argv: process.argv,
>>> 179:     nodeEnv: process.env.NODE_ENV,
    180: }).catch((error) => {
    181:     console.error("Failed to start server:", error);
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    180: }).catch((error) => {
    181:     console.error("Failed to start server:", error);
>>> 182:     if (process.env.NODE_ENV === "test")
    183:         return;
    184:     process.exit(1);
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    35: */
    36: export const deleteNode = (params, options) => {
>>> 37:     return customInstance({ url: `${process.env.TD_WEB_SERVER_HOST}:${process.env.TD_WEB_SERVER_PORT}/api/nodes`, method: 'DELETE',
    38:         params
    39:     }, options);
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    43:  */
    44: export const getNodes = (params, options) => {
>>> 45:     return customInstance({ url: `${process.env.TD_WEB_SERVER_HOST}:${process.env.TD_WEB_SERVER_PORT}/api/nodes`, method: 'GET',
    46:         params
    47:     }, options);
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    51:  */
    52: export const createNode = (createNodeRequest, options) => {
>>> 53:     return customInstance({ url: `${process.env.TD_WEB_SERVER_HOST}:${process.env.TD_WEB_SERVER_PORT}/api/nodes`, method: 'POST',
    54:         headers: { 'Content-Type': 'application/json', },
    55:         data: createNodeRequest
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    61:  */
    62: export const getNodeDetail = (params, options) => {
>>> 63:     return customInstance({ url: `${process.env.TD_WEB_SERVER_HOST}:${process.env.TD_WEB_SERVER_PORT}/api/nodes/detail`, method: 'GET',
    64:         params
    65:     }, options);
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    69:  */
    70: export const updateNode = (updateNodeRequest, options) => {
>>> 71:     return customInstance({ url: `${process.env.TD_WEB_SERVER_HOST}:${process.env.TD_WEB_SERVER_PORT}/api/nodes/detail`, method: 'PATCH',
    72:         headers: { 'Content-Type': 'application/json', },
    73:         data: updateNodeRequest
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    79:  */
    80: export const getNodeErrors = (params, options) => {
>>> 81:     return customInstance({ url: `${process.env.TD_WEB_SERVER_HOST}:${process.env.TD_WEB_SERVER_PORT}/api/nodes/errors`, method: 'GET',
    82:         params
    83:     }, options);
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    88:  */
    89: export const getTdPythonClasses = (options) => {
>>> 90:     return customInstance({ url: `${process.env.TD_WEB_SERVER_HOST}:${process.env.TD_WEB_SERVER_PORT}/api/td/classes`, method: 'GET'
    91:     }, options);
    92: };
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    96:  */
    97: export const getTdPythonClassDetails = (className, options) => {
>>> 98:     return customInstance({ url: `${process.env.TD_WEB_SERVER_HOST}:${process.env.TD_WEB_SERVER_PORT}/api/td/classes/${className}`, method: 'GET'
    99:     }, options);
    100: };
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    104:  */
    105: export const getModuleHelp = (params, options) => {
>>> 106:     return customInstance({ url: `${process.env.TD_WEB_SERVER_HOST}:${process.env.TD_WEB_SERVER_PORT}/api/td/modules/help`, method: 'GET',
    107:         params
    108:     }, options);
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    116:  */
    117: export const execNodeMethod = (execNodeMethodRequest, options) => {
>>> 118:     return customInstance({ url: `${process.env.TD_WEB_SERVER_HOST}:${process.env.TD_WEB_SERVER_PORT}/api/td/nodes/exec`, method: 'POST',
    119:         headers: { 'Content-Type': 'application/json', },
    120:         data: execNodeMethodRequest
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    130:  */
    131: export const execPythonScript = (execPythonScriptRequest, options) => {
>>> 132:     return customInstance({ url: `${process.env.TD_WEB_SERVER_HOST}:${process.env.TD_WEB_SERVER_PORT}/api/td/server/exec`, method: 'POST',
    133:         headers: { 'Content-Type': 'application/json', },
    134:         data: execPythonScriptRequest
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    140:  */
    141: export const getTdInfo = (options) => {
>>> 142:     return customInstance({ url: `${process.env.TD_WEB_SERVER_HOST}:${process.env.TD_WEB_SERVER_PORT}/api/td/server/td`, method: 'GET'
    143:     }, options);
    144: };
Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ���y:ڞ�h�Ш���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: M��' V��7�j)lO*^

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��b����n��?��i

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ���y:ڞ�h�Ш���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (5.1 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (5.1 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.9 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

Scan History

DateRiskFindings
Feb 27, 2026critical24
Feb 25, 2026critical24
Feb 23, 2026critical24
Feb 22, 2026critical24