ICUICU
critical

mcp-asana-minimal

v1.3.0

Minimal Asana MCP server with essential task operations (11 tools)

npmidbygeorgeFirst seen Feb 25, 2026

13

Total

7

Critical

0

High

6

Medium

Findings

unknown
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    38: };
    39: export async function createTask(args) {
>>> 40:     const token = process.env.ASANA_ACCESS_TOKEN;
    41:     if (!token) {
    42:         throw new Error('ASANA_ACCESS_TOKEN environment variable is required. ' +
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    18: };
    19: export async function addTaskToSection(args) {
>>> 20:     const token = process.env.ASANA_ACCESS_TOKEN;
    21:     if (!token) {
    22:         throw new Error('ASANA_ACCESS_TOKEN environment variable is required. ' +
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    14: };
    15: export async function listSections(args) {
>>> 16:     const token = process.env.ASANA_ACCESS_TOKEN;
    17:     if (!token) {
    18:         throw new Error('ASANA_ACCESS_TOKEN environment variable is required. ' +
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    30: };
    31: export async function createSubtask(args) {
>>> 32:     const token = process.env.ASANA_ACCESS_TOKEN;
    33:     if (!token) {
    34:         throw new Error('ASANA_ACCESS_TOKEN environment variable is required. ' +
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    14: };
    15: export async function listSubtasks(args) {
>>> 16:     const token = process.env.ASANA_ACCESS_TOKEN;
    17:     if (!token) {
    18:         throw new Error('ASANA_ACCESS_TOKEN environment variable is required. ' +
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    8: export function getAsanaClient() {
    9:     if (!clientInitialized) {
>>> 10:         const token = process.env.ASANA_ACCESS_TOKEN;
    11:         if (!token) {
    12:             throw new Error('ASANA_ACCESS_TOKEN environment variable is required. ' +
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    18: };
    19: export async function createSection(args) {
>>> 20:     const token = process.env.ASANA_ACCESS_TOKEN;
    21:     if (!token) {
    22:         throw new Error('ASANA_ACCESS_TOKEN environment variable is required. ' +
Report false positive
mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    22:         // Use fetch for reliable promise-based HTTP requests
    23:         // API endpoint: GET /tasks/{task_gid}/subtasks
>>> 24:         const response = await fetch(`https://app.asana.com/api/1.0/tasks/${args.task_id}/subtasks?opt_fields=name,completed,due_on,assignee,assignee.name`, {
    25:             method: 'GET',
    26:             headers: {
Report false positive
mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    32:         // Use fetch for reliable promise-based HTTP requests
    33:         // API endpoint: POST /sections/{section_gid}/addTask
>>> 34:         const response = await fetch(`https://app.asana.com/api/1.0/sections/${args.section_id}/addTask`, {
    35:             method: 'POST',
    36:             headers: {
Report false positive
mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    30:     try {
    31:         // Use fetch for reliable promise-based HTTP requests
>>> 32:         const response = await fetch(`https://app.asana.com/api/1.0/projects/${args.project}/sections`, {
    33:             method: 'POST',
    34:             headers: {
Report false positive
mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    52:         // Use fetch for reliable promise-based HTTP requests
    53:         // API endpoint: POST /tasks/{task_gid}/subtasks
>>> 54:         const response = await fetch(`https://app.asana.com/api/1.0/tasks/${args.parent_task_id}/subtasks`, {
    55:             method: 'POST',
    56:             headers: {
Report false positive
mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    74:     try {
    75:         // Use fetch for reliable promise-based HTTP requests
>>> 76:         const response = await fetch('https://app.asana.com/api/1.0/tasks', {
    77:             method: 'POST',
    78:             headers: {
Report false positive
mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    21:     try {
    22:         // Use fetch for reliable promise-based HTTP requests
>>> 23:         const response = await fetch(`https://app.asana.com/api/1.0/projects/${args.project}/sections`, {
    24:             method: 'GET',
    25:             headers: {
Report false positive