ICUICU
critical

@henkey/postgres-mcp-server

v1.0.5

A Model Context Protocol (MCP) server that provides comprehensive PostgreSQL database management capabilities for AI assistants

npmhenkeyFirst seen Feb 22, 2026

22

Total

4

Critical

14

High

4

Medium

Findings

unknown
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    120:         return cliConnectionString;
    121:     }
>>> 122:     const envConnectionString = process.env.POSTGRES_CONNECTION_STRING;
    123:     if (envConnectionString) {
    124:         return envConnectionString;
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    35:         try {
    36:             // Use environment variable if connection string is not provided
>>> 37:             const connString = connectionString || process.env.POSTGRES_CONNECTION_STRING;
    38:             if (!connString) {
    39:                 throw new Error('No connection string provided and POSTGRES_CONNECTION_STRING environment variable is not set');
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    3: const { Pool } = pkg;
    4: // Enable pg-monitor for better debugging in development
>>> 5: if (process.env.NODE_ENV !== 'production') {
    6:     monitor.attach({
    7:         query: true,
Report false positive
criticalOB-004ObfuscationMedium ConfidenceLine 0

Zero-width character detected (potential hidden content)

Detected by automated pattern matching (rule OB-004) with medium confidence. May be a false positive.

    149: - **[🛠️ Development Guide](./docs/DEVELOPMENT.md)** - Setup and contribution guide  
    150: - **[⚙️ Technical Details](./docs/TECHNICAL.md)** - Architecture and implementation
>>> 151: - **[👨‍💻 Developer Reference](./docs/DEVELOPER.md)** - API reference and advanced usage
    152: - **[📋 Documentation Index](./docs/INDEX.md)** - Complete documentation overview
    153: 
Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: J�b�'���ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��Rz۩"{-��-���N�%

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: r�r�py��j֛jǬN�%

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��Rz۩"{-��-���N�%

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: �������+,���N�%

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: r����h�蠜��N�%

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: r���ਞ�kj)�N�%

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��Rz۩"{-��-���N�%

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��Rz۩"{-��-���N�%

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: r�r�py��j֛jǬN�%

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: r�r�py��j֛jǬ

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��Rz۩"{-��-���N�%

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��Rz۩"{-��-���

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: J�b�'���ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.9 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.7 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

Scan History

DateRiskFindings
Feb 26, 2026critical22
Feb 23, 2026critical22
Feb 22, 2026critical22