ICUICU
critical

mysql-mcp-server

v0.1.3

An MCP server that provides read-only access to MySQL databases.

npmdpflucasFirst seen Feb 24, 2026

11

Total

10

Critical

1

High

0

Medium

Findings

unknown
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    92:  */
    93: export function getConfigFromEnv() {
>>> 94:     const host = process.env.MYSQL_HOST;
    95:     const portStr = process.env.MYSQL_PORT;
    96:     const user = process.env.MYSQL_USER;
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    93: export function getConfigFromEnv() {
    94:     const host = process.env.MYSQL_HOST;
>>> 95:     const portStr = process.env.MYSQL_PORT;
    96:     const user = process.env.MYSQL_USER;
    97:     const password = process.env.MYSQL_PASSWORD;
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    94:     const host = process.env.MYSQL_HOST;
    95:     const portStr = process.env.MYSQL_PORT;
>>> 96:     const user = process.env.MYSQL_USER;
    97:     const password = process.env.MYSQL_PASSWORD;
    98:     const database = process.env.MYSQL_DATABASE;
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    95:     const portStr = process.env.MYSQL_PORT;
    96:     const user = process.env.MYSQL_USER;
>>> 97:     const password = process.env.MYSQL_PASSWORD;
    98:     const database = process.env.MYSQL_DATABASE;
    99:     // Connection pool options
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    96:     const user = process.env.MYSQL_USER;
    97:     const password = process.env.MYSQL_PASSWORD;
>>> 98:     const database = process.env.MYSQL_DATABASE;
    99:     // Connection pool options
    100:     const connectionLimitStr = process.env.MYSQL_CONNECTION_LIMIT;
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    98:     const database = process.env.MYSQL_DATABASE;
    99:     // Connection pool options
>>> 100:     const connectionLimitStr = process.env.MYSQL_CONNECTION_LIMIT;
    101:     const queueLimitStr = process.env.MYSQL_QUEUE_LIMIT;
    102:     const connectTimeoutStr = process.env.MYSQL_CONNECT_TIMEOUT;
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    99:     // Connection pool options
    100:     const connectionLimitStr = process.env.MYSQL_CONNECTION_LIMIT;
>>> 101:     const queueLimitStr = process.env.MYSQL_QUEUE_LIMIT;
    102:     const connectTimeoutStr = process.env.MYSQL_CONNECT_TIMEOUT;
    103:     const idleTimeoutStr = process.env.MYSQL_IDLE_TIMEOUT;
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    100:     const connectionLimitStr = process.env.MYSQL_CONNECTION_LIMIT;
    101:     const queueLimitStr = process.env.MYSQL_QUEUE_LIMIT;
>>> 102:     const connectTimeoutStr = process.env.MYSQL_CONNECT_TIMEOUT;
    103:     const idleTimeoutStr = process.env.MYSQL_IDLE_TIMEOUT;
    104:     const maxIdleStr = process.env.MYSQL_MAX_IDLE;
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    101:     const queueLimitStr = process.env.MYSQL_QUEUE_LIMIT;
    102:     const connectTimeoutStr = process.env.MYSQL_CONNECT_TIMEOUT;
>>> 103:     const idleTimeoutStr = process.env.MYSQL_IDLE_TIMEOUT;
    104:     const maxIdleStr = process.env.MYSQL_MAX_IDLE;
    105:     if (!host)
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    102:     const connectTimeoutStr = process.env.MYSQL_CONNECT_TIMEOUT;
    103:     const idleTimeoutStr = process.env.MYSQL_IDLE_TIMEOUT;
>>> 104:     const maxIdleStr = process.env.MYSQL_MAX_IDLE;
    105:     if (!host)
    106:         throw new Error('MYSQL_HOST environment variable is required');
Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: r���ਞw��*'>�%

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive