@gleanwork/configure-mcp-server
v3.0.1MCP server configurator for Glean
55
Total
27
Critical
15
High
13
Medium
Findings
unknownEnvironment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
68: if (!result.instance && !result.url) {
69: if (process.env.GLEAN_URL) {
>>> 70: result.url = process.env.GLEAN_URL;
71: }
72: else if (process.env.GLEAN_INSTANCE || process.env.GLEAN_SUBDOMAIN) {Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
70: result.url = process.env.GLEAN_URL;
71: }
>>> 72: else if (process.env.GLEAN_INSTANCE || process.env.GLEAN_SUBDOMAIN) {
73: result.instance =
74: process.env.GLEAN_INSTANCE || process.env.GLEAN_SUBDOMAIN;Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
72: else if (process.env.GLEAN_INSTANCE || process.env.GLEAN_SUBDOMAIN) {
73: result.instance =
>>> 74: process.env.GLEAN_INSTANCE || process.env.GLEAN_SUBDOMAIN;
75: }
76: }Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
76: }
77: if (!result.apiToken) {
>>> 78: result.apiToken = process.env.GLEAN_API_TOKEN;
79: }
80: return result;Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
125: process.exit(1);
126: }
>>> 127: if (options.instance && process.env._SKIP_INSTANCE_PREFLIGHT !== 'true') {
128: trace(`Validating instance: ${options.instance}...`);
129: if (!(await validateInstance(options.instance))) {Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
148: // Remote: URL required, token optional (DCR is default)
149: if (!url) {
>>> 150: throw new Error('Remote configuration requires a URL (--url). Please provide it via command line options or in your .env file.');
151: }
152: if (apiToken) {Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
160: // Local: both instance and token required
161: if (!instance && !url) {
>>> 162: throw new Error('Local configuration requires an instance (--instance) or URL. Please provide it via command line options or in your .env file.');
163: }
164: if (!apiToken) {Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
163: }
164: if (!apiToken) {
>>> 165: throw new Error('Local configuration requires an API token (--token). Please provide it via command line options or in your .env file.');
166: }
167: trace('Local configuration with instance and token');Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
255: const exampleClient = clients[0][0];
256: console.log(` npx @gleanwork/configure-mcp-server --client ${exampleClient} --token your-token --instance your-instance`);
>>> 257: console.log(` npx @gleanwork/configure-mcp-server --client ${exampleClient} --env ~/.glean.env`);
258: }
259: console.log(`\nVersion: v${VERSION}`);Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
272: const hasDeployment = Boolean(instance || url);
273: const hasToken = Boolean(token);
>>> 274: const hasEnvironmentToken = Boolean(process.env.GLEAN_API_TOKEN);
275: const hasEnvironmentInstance = Boolean(process.env.GLEAN_INSTANCE ||
276: process.env.GLEAN_SUBDOMAIN ||Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
273: const hasToken = Boolean(token);
274: const hasEnvironmentToken = Boolean(process.env.GLEAN_API_TOKEN);
>>> 275: const hasEnvironmentInstance = Boolean(process.env.GLEAN_INSTANCE ||
276: process.env.GLEAN_SUBDOMAIN ||
277: process.env.GLEAN_URL);Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
274: const hasEnvironmentToken = Boolean(process.env.GLEAN_API_TOKEN);
275: const hasEnvironmentInstance = Boolean(process.env.GLEAN_INSTANCE ||
>>> 276: process.env.GLEAN_SUBDOMAIN ||
277: process.env.GLEAN_URL);
278: const hasEnvParam = Boolean(env);Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
289: console.error(' 1. Both --token and --instance for local configuration, or');
290: console.error(' 2. --url for remote configuration, or');
>>> 291: console.error(' 3. --env pointing to a .env file with configuration');
292: console.error('Run with --help for usage information');
293: return false;Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
275: const hasEnvironmentInstance = Boolean(process.env.GLEAN_INSTANCE ||
276: process.env.GLEAN_SUBDOMAIN ||
>>> 277: process.env.GLEAN_URL);
278: const hasEnvParam = Boolean(env);
279: const hasAnyInstance = Boolean(hasDeployment || hasEnvironmentInstance);Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
56: Examples:
57: $ npx -y @gleanwork/configure-mcp-server local --client cursor --token xxx --instance acme
>>> 58: $ npx -y @gleanwork/configure-mcp-server local --client vscode --env ~/.glean.env
59: $ npx -y @gleanwork/configure-mcp-server local --client vscode --workspace --token xxx --instance acme
60: `)Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
50: .option('-i, --instance <instance>', 'Glean instance name')
51: .option('-t, --token <token>', 'Glean API token (required)')
>>> 52: .option('-e, --env <path>', 'Path to .env file containing GLEAN_INSTANCE and GLEAN_API_TOKEN')
53: .option('--workspace', 'Create workspace configuration instead of global (VS Code only)')
54: .option('--trace', 'Enable trace logging')Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
50:
51: ```bash
>>> 52: npx -y @gleanwork/configure-mcp-server local --client cursor --env path/to/.env.glean
53: ```
54: Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
99: $ npx -y @gleanwork/configure-mcp-server remote --client cursor --url https://my-be.glean.com/mcp/default
100: $ npx -y @gleanwork/configure-mcp-server remote --client cursor --url https://my-be.glean.com/mcp/default --token xxx
>>> 101: $ npx -y @gleanwork/configure-mcp-server remote --client vscode --url https://my-be.glean.com/mcp/default --env ~/.glean.env
102: `)
103: .action(async (options) => {Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
92: .option('-u, --url <url>', 'Full MCP server URL (required, e.g., https://my-be.glean.com/mcp/default)')
93: .option('-t, --token <token>', 'Glean API token (optional, OAuth will be used if not provided)')
>>> 94: .option('-e, --env <path>', 'Path to .env file containing GLEAN_URL and optionally GLEAN_API_TOKEN')
95: .option('--workspace', 'Create workspace configuration instead of global (VS Code only)')
96: .option('--trace', 'Enable trace logging')Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
106: }
107: const configPaths = clientInfo.configPath;
>>> 108: if (process.env.GLEAN_MCP_CONFIG_DIR) {
109: const platform = process.platform;
110: const pathTemplate = configPaths[platform];Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
116: .replace(/^\$HOME[\\/]?/, '')
117: .replace(/^%USERPROFILE%[\\/]?/, '');
>>> 118: return path.join(process.env.GLEAN_MCP_CONFIG_DIR, relativePath);
119: }
120: const platform = process.platform;Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
299: You must provide either:
300: 1. Both --token and --instance, or
>>> 301: 2. --env pointing to a .env file containing GLEAN_API_TOKEN and GLEAN_INSTANCE
302:
303: Continuing with configuration, but you will need to set credentials manually later."Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
17: import { VERSION } from '../common/version.js';
18: /**
>>> 19: * Load environment variables from .env file or existing environment
20: */
21: function loadCredentials(options) {Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
32: : options.envPath;
33: if (!fs.existsSync(envPath)) {
>>> 34: console.error(`Warning: .env file not found at ${envPath}`);
35: }
36: else {Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
37: const envConfig = dotenv.config({ path: envPath, quiet: true });
38: if (envConfig.error) {
>>> 39: throw new Error(`Failed to parse .env file: ${envConfig.error.message}`);
40: }
41: // Check for URL first, then instanceEnvironment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
52: }
53: catch (error) {
>>> 54: console.error(`Error loading .env file: ${error.message}`);
55: }
56: }Environment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
67: // Fall back to environment variables if not set via options or env file
68: if (!result.instance && !result.url) {
>>> 69: if (process.env.GLEAN_URL) {
70: result.url = process.env.GLEAN_URL;
71: }Decoded base64 content: �+-J�i��^t)bz{l
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: <svg viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg"> <path d="M24.3006 2.95427L2
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: �+a��ۖ������� ��ަ�"���
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ���z�ۖ�������Ԅ
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��Qzj-x���� &�'
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��Qzj-x���� &�'
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: r���ਝ��M驕�^
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��b������Ʃ�)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: r����qǬ�Ǭ��
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��aE�(���:���'^
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��aE�(���:���'^
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: r����qǬ�Ǭ��
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: �+-J�i��^t)bz{l
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: �+-J�i��^t)bz{l
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: �+-J�i��^t)bz{l
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.5 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.8 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.6 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positivePossible Base64-encoded payload (long encoded string)
Detected by automated pattern matching (rule OB-001) with medium confidence. May be a false positive.
1: # @gleanwork/configure-mcp-server
2:
>>> 3: [](https://github.com/gleanwork/.github/blob/main/docs/repository-stability.md#ga)
4: 
5: [](https://badge.fury.io/js/@gleanwork%2Fconfigure-mcp-server)High-entropy string (4.6 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.5 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.9 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.8 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.5 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.8 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.8 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.8 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.6 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positive