critical

enrichr-mcp-server

v0.2.1

MCP Server for Enrichr gene set enrichment analysis with multi-library support

npmtianqitang1First seen Feb 25, 2026

24

Total

8

Critical

4

High

12

Medium

Findings

unknown

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    140:         config.defaultLibraries = process.env.ENRICHR_LIBRARIES.split(',').map(lib => lib.trim());
    141:     }
>>> 142:     if (process.env.ENRICHR_MAX_TERMS) {
    143:         const maxTerms = parseInt(process.env.ENRICHR_MAX_TERMS);
    144:         if (!isNaN(maxTerms) && maxTerms > 0) {

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    141:     }
    142:     if (process.env.ENRICHR_MAX_TERMS) {
>>> 143:         const maxTerms = parseInt(process.env.ENRICHR_MAX_TERMS);
    144:         if (!isNaN(maxTerms) && maxTerms > 0) {
    145:             config.maxTermsPerLibrary = maxTerms;

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    152:         }
    153:     }
>>> 154:     if (process.env.ENRICHR_OUTPUT_FILE) {
    155:         config.outputFile = process.env.ENRICHR_OUTPUT_FILE;
    156:         config.saveToFile = true;

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    147:     }
    148:     if (process.env.ENRICHR_FORMAT) {
>>> 149:         const format = process.env.ENRICHR_FORMAT;
    150:         if (['detailed', 'compact', 'minimal'].includes(format)) {
    151:             config.format = format;

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    146:         }
    147:     }
>>> 148:     if (process.env.ENRICHR_FORMAT) {
    149:         const format = process.env.ENRICHR_FORMAT;
    150:         if (['detailed', 'compact', 'minimal'].includes(format)) {

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    153:     }
    154:     if (process.env.ENRICHR_OUTPUT_FILE) {
>>> 155:         config.outputFile = process.env.ENRICHR_OUTPUT_FILE;
    156:         config.saveToFile = true;
    157:     }

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    137:     }
    138:     // Override with environment variables if set
>>> 139:     if (process.env.ENRICHR_LIBRARIES) {
    140:         config.defaultLibraries = process.env.ENRICHR_LIBRARIES.split(',').map(lib => lib.trim());
    141:     }

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    138:     // Override with environment variables if set
    139:     if (process.env.ENRICHR_LIBRARIES) {
>>> 140:         config.defaultLibraries = process.env.ENRICHR_LIBRARIES.split(',').map(lib => lib.trim());
    141:     }
    142:     if (process.env.ENRICHR_MAX_TERMS) {

Report false positive

highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: J�b�'��ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive

highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: rZ.w�'�'!��'!

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive

highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: J�b�'��ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive

highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: u�Z�W��&��-�h��f�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (5.0 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.7 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    178:     formData.append('description', description);
    179:     try {
>>> 180:         const addResponse = await fetch(addListUrl, {
    181:             method: 'POST',
    182:             body: formData,

Report false positive

mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    201:             });
    202:             try {
>>> 203:                 const enrichResponse = await fetch(`${enrichUrl}?${enrichParams}`);
    204:                 if (!enrichResponse.ok) {
    205:                     results[library] = { error: `HTTP error ${enrichResponse.status}: ${enrichResponse.statusText}` };

Report false positive

mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    296:     formData.append('description', description);
    297:     try {
>>> 298:         const addResponse = await fetch(addListUrl, {
    299:             method: 'POST',
    300:             body: formData,

Report false positive

mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    315:             backgroundType: geneSetLibrary
    316:         });
>>> 317:         const enrichResponse = await fetch(`${enrichUrl}?${enrichParams}`);
    318:         if (!enrichResponse.ok) {
    319:             return { error: `HTTP error ${enrichResponse.status}: ${enrichResponse.statusText}` };

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.8 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

mediumOB-001ObfuscationMedium ConfidenceLine 0

Possible Base64-encoded payload (long encoded string)

Detected by automated pattern matching (rule OB-001) with medium confidence. May be a false positive.

    20: Use the button below to install the MCP server to Cursor, VS Code, or VS Code Insiders with default settings.
    21: 
>>> 22: [![Install MCP Server](https://cursor.com/deeplink/mcp-install-dark.svg)](https://cursor.com/install-mcp?name=enrichr-mcp-server&config=eyJjb21tYW5kIjoibnB4IC15IGVucmljaHItbWNwLXNlcnZlciAtLWNvbXBhY3QgLS1tYXgtdGVybXMgMTAwIn0%3D)
    23: [![Add to VS Code](https://img.shields.io/badge/Add_to_VS_Code-007ACC?style=for-the-badge&logo=visualstudiocode&logoColor=white)](vscode:mcp/install?%7B%22name%22%3A%22enrichr-mcp-server%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22enrichr-mcp-server%22%2C%22--compact%22%2C%22--max-terms%22%2C%22100%22%5D%7D)
    24: [![Add to VS Code Insiders](https://img.shields.io/badge/Add_to_VS_Code_Insiders-24bfa5?style=for-the-badge&logo=visualstudiocode&logoColor=white)](vscode-insiders:mcp/install?%7B%22name%22%3A%22enrichr-mcp-server%22%2C%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22enrichr-mcp-server%22%2C%22--compact%22%2C%22--max-terms%22%2C%22100%22%5D%7D)

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (5.2 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive

mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.9 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive