ICUICU
critical

langsmith-mcp-server

v0.1.7

LangSmith MCP Server - TypeScript implementation

npmamitrechaviaFirst seen Feb 25, 2026Source

19

Total

5

Critical

6

High

8

Medium

Findings

unknown
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    20:         apiKey,
    21:         apiUrl: process.env.LANGSMITH_ENDPOINT || undefined,
>>> 22:         workspaceId: process.env.LANGSMITH_WORKSPACE_ID || undefined,
    23:     });
    24: }
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    13:  */
    14: export function getLangSmithClient() {
>>> 15:     const apiKey = process.env.LANGSMITH_API_KEY;
    16:     if (!apiKey) {
    17:         throw new Error("API key not found. Set LANGSMITH_API_KEY environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    31:  */
    32: export function getApiKeyAndEndpoint() {
>>> 33:     const apiKey = process.env.LANGSMITH_API_KEY;
    34:     if (!apiKey) {
    35:         throw new Error("API key not found. Set LANGSMITH_API_KEY environment variable.");
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    35:         throw new Error("API key not found. Set LANGSMITH_API_KEY environment variable.");
    36:     }
>>> 37:     const endpoint = (process.env.LANGSMITH_ENDPOINT || "https://api.smith.langchain.com").replace(/\/+$/, "");
    38:     return [apiKey, endpoint];
    39: }
Report false positive
criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    19:     return new Client({
    20:         apiKey,
>>> 21:         apiUrl: process.env.LANGSMITH_ENDPOINT || undefined,
    22:         workspaceId: process.env.LANGSMITH_WORKSPACE_ID || undefined,
    23:     });
Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��ޭ��x6�jǭ5��

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��S���tx����N�%

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��@�"�� �wi�)�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��S���tx����N�%

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��ޭ��x6�jǭ5��

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
highDO-BASunknownMedium ConfidenceLine 0

Decoded base64 content: ��ޭ��x6�jǭ5��

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Report false positive
mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    14:     }
    15:     try {
>>> 16:         const response = await fetch(url, {
    17:             method: "GET",
    18:             headers: {
Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.7 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.7 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive
mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    11:  * @param client - LangSmith client instance
    12:  * @param projectName - The name of the project to fetch the last trace for
>>> 13:  * @param traceId - The ID of the trace to fetch (preferred parameter)
    14:  * @returns Dictionary containing the last trace and metadata
    15:  */
Report false positive
mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    35:  * @param client - LangSmith client instance
    36:  * @param projectName - The name of the project to fetch the runs stats for
>>> 37:  * @param traceId - The ID of the trace to fetch (preferred parameter)
    38:  * @returns Dictionary containing the project runs stats
    39:  */
Report false positive
mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    16:  * @param client - LangSmith client instance
    17:  * @param projectName - The name of the project to fetch the last trace for
>>> 18:  * @param traceId - The ID of the trace to fetch (preferred parameter)
    19:  * @returns Dictionary containing the last trace and metadata
    20:  */
Report false positive
mediumNS-003Network SuspiciousMedium ConfidenceLine 0

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    160:  * @param client - LangSmith client instance
    161:  * @param projectName - The name of the project to fetch the runs stats for
>>> 162:  * @param traceId - The ID of the trace to fetch (preferred parameter)
    163:  * @returns Dictionary containing the project runs stats
    164:  */
Report false positive
mediumEN-001unknownMedium ConfidenceLine 0

High-entropy string (4.7 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

Report false positive