ICUICU
critical

ai.smithery/kkjdaniel-bgg-mcp

v1.3.2

BGG MCP provides access to the BoardGameGeek API through the Model Context Protocol, enabling retr…

MCP RegistrysmitheryFirst seen Feb 24, 2026Source

7

Total

1

Critical

0

High

6

Medium

Findings

unknown
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    24: 
    25: # env file
>>> 26: .env
    27: 
    28: # Misc
Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (5.0 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.7 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumOB-001ObfuscationMedium ConfidenceLine 0

Possible Base64-encoded payload (long encoded string)

Detected by automated pattern matching (rule OB-001) with medium confidence. May be a false positive.

    1: # If you prefer the allow list template instead of the deny list, see community template:
>>> 2: # https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
    3: #
    4: # Binaries for programs and plugins
Report false positive
mediumOB-001ObfuscationMedium ConfidenceLine 0

Possible Base64-encoded payload (long encoded string)

Detected by automated pattern matching (rule OB-001) with medium confidence. May be a false positive.

    90:       - name: Install MCP Publisher
    91:         run: |
>>> 92:           curl -L "https://github.com/modelcontextprotocol/registry/releases/download/v1.4.1/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
    93: 
    94:       - name: Login to MCP Registry
Report false positive

Scan History

DateRiskFindings
Feb 26, 2026critical7
Feb 24, 2026critical7