langsmith-mcp-server
v0.1.7LangSmith MCP Server - TypeScript implementation
19
Total
5
Critical
6
High
8
Medium
Findings
unknownEnvironment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
20: apiKey,
21: apiUrl: process.env.LANGSMITH_ENDPOINT || undefined,
>>> 22: workspaceId: process.env.LANGSMITH_WORKSPACE_ID || undefined,
23: });
24: }Report false positiveEnvironment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
13: */
14: export function getLangSmithClient() {
>>> 15: const apiKey = process.env.LANGSMITH_API_KEY;
16: if (!apiKey) {
17: throw new Error("API key not found. Set LANGSMITH_API_KEY environment variable.");Report false positiveEnvironment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
31: */
32: export function getApiKeyAndEndpoint() {
>>> 33: const apiKey = process.env.LANGSMITH_API_KEY;
34: if (!apiKey) {
35: throw new Error("API key not found. Set LANGSMITH_API_KEY environment variable.");Report false positiveEnvironment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
35: throw new Error("API key not found. Set LANGSMITH_API_KEY environment variable.");
36: }
>>> 37: const endpoint = (process.env.LANGSMITH_ENDPOINT || "https://api.smith.langchain.com").replace(/\/+$/, "");
38: return [apiKey, endpoint];
39: }Report false positiveEnvironment file access
Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.
19: return new Client({
20: apiKey,
>>> 21: apiUrl: process.env.LANGSMITH_ENDPOINT || undefined,
22: workspaceId: process.env.LANGSMITH_WORKSPACE_ID || undefined,
23: });Report false positiveDecoded base64 content: ��ޭ��x6�jǭ5��
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��S���tx����N�%
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��@�"�� �wi�)�
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��S���tx����N�%
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��ޭ��x6�jǭ5��
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveDecoded base64 content: ��ޭ��x6�jǭ5��
Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.
Report false positiveJavaScript fetch() call
Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.
14: }
15: try {
>>> 16: const response = await fetch(url, {
17: method: "GET",
18: headers: {Report false positiveHigh-entropy string (4.7 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveHigh-entropy string (4.7 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positiveJavaScript fetch() call
Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.
11: * @param client - LangSmith client instance
12: * @param projectName - The name of the project to fetch the last trace for
>>> 13: * @param traceId - The ID of the trace to fetch (preferred parameter)
14: * @returns Dictionary containing the last trace and metadata
15: */Report false positiveJavaScript fetch() call
Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.
35: * @param client - LangSmith client instance
36: * @param projectName - The name of the project to fetch the runs stats for
>>> 37: * @param traceId - The ID of the trace to fetch (preferred parameter)
38: * @returns Dictionary containing the project runs stats
39: */Report false positiveJavaScript fetch() call
Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.
16: * @param client - LangSmith client instance
17: * @param projectName - The name of the project to fetch the last trace for
>>> 18: * @param traceId - The ID of the trace to fetch (preferred parameter)
19: * @returns Dictionary containing the last trace and metadata
20: */Report false positiveJavaScript fetch() call
Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.
160: * @param client - LangSmith client instance
161: * @param projectName - The name of the project to fetch the runs stats for
>>> 162: * @param traceId - The ID of the trace to fetch (preferred parameter)
163: * @returns Dictionary containing the project runs stats
164: */Report false positiveHigh-entropy string (4.7 bits/char) — possible encoded payload
Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.
Report false positive