← Scan another repo

github.com/modelcontextprotocol/servers

@ 76d64c822f51

Submitted 8/4/2026, 10:25:54 AM · Status: ok

Risk grade
F
100 / 100
Findings
58
0 critical8 high39 medium11 low0 info0 on CISA KEV0ATT&CK
Showing 58 of 58 findings

Findings

  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivysrc/git/Dockerfile:27
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivysrc/sequentialthinking/Dockerfile:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivysrc/filesystem/Dockerfile:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivysrc/fetch/Dockerfile:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivysrc/everything/Dockerfile:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivysrc/git/Dockerfile:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivysrc/memory/Dockerfile:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivysrc/time/Dockerfile:0
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /src/git/Dockerfile.
    checkovsrc/git/Dockerfile:1
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /src/fetch/Dockerfile.
    checkovsrc/fetch/Dockerfile:1
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /src/sequentialthinking/Dockerfile.
    checkovsrc/sequentialthinking/Dockerfile:1
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /src/memory/Dockerfile.
    checkovsrc/memory/Dockerfile:1
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /src/everything/Dockerfile.
    checkovsrc/everything/Dockerfile:1
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /src/filesystem/Dockerfile.
    checkovsrc/filesystem/Dockerfile:1
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /src/time/Dockerfile.
    checkovsrc/time/Dockerfile:1
  • Ensure that COPY is used instead of ADD in Dockerfiles
    Ensure that COPY is used instead of ADD in Dockerfiles on /src/time/Dockerfile.ADD
    checkovsrc/time/Dockerfile:21
  • Ensure that COPY is used instead of ADD in Dockerfiles
    Ensure that COPY is used instead of ADD in Dockerfiles on /src/git/Dockerfile.ADD
    checkovsrc/git/Dockerfile:21
  • Ensure that COPY is used instead of ADD in Dockerfiles
    Ensure that COPY is used instead of ADD in Dockerfiles on /src/fetch/Dockerfile.ADD
    checkovsrc/fetch/Dockerfile:21
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /src/git/Dockerfile.
    checkovsrc/git/Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /src/fetch/Dockerfile.
    checkovsrc/fetch/Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /src/sequentialthinking/Dockerfile.
    checkovsrc/sequentialthinking/Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /src/memory/Dockerfile.
    checkovsrc/memory/Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /src/everything/Dockerfile.
    checkovsrc/everything/Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /src/filesystem/Dockerfile.
    checkovsrc/filesystem/Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /src/time/Dockerfile.
    checkovsrc/time/Dockerfile:1
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Release)
    checkov.github/workflows/release.yml:70
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(README PR Check)
    checkov.github/workflows/readme-pr-check.yml:15
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Claude Code)
    checkov.github/workflows/claude.yml:21
  • Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration
    grypeCVE-2026-47751EPSS 0.6%
  • mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries
    grypeCVE-2026-27735EPSS 0.3%
  • mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files
    grypeCVE-2025-68144EPSS 7.4%
  • mcp-server-git has missing path validation when using --repository flag
    grypeCVE-2025-68145EPSS 6.4%
  • mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations
    grypeCVE-2025-68143EPSS 8.0%
  • mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files
    In mcp-server-git versions prior to 2025.12.18, the git_diff and git_checkout functions passed user-controlled arguments directly to git CLI commands without sanitization. Flag-like values (e.g., `--output=/path/to/file` for `git_diff`) would be interpreted as command-line option…
    osv-scannerCVE-2025-68144
  • mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files
    In mcp-server-git versions prior to 2025.12.18, the git_diff and git_checkout functions passed user-controlled arguments directly to git CLI commands without sanitization. Flag-like values (e.g., `--output=/path/to/file` for `git_diff`) would be interpreted as command-line option…
    osv-scannerCVE-2025-68144
  • GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
    ## Summary The fix for [GHSA-rwj8-pgh3-r573](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573) stopped `Repo.clone_from()` from running caller-supplied URLs through `os.path.expandvars()`, but it guarded only that one caller. `Remote.crea…
    osv-scanner
  • mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries
    In `mcp-server-git` versions prior to 2026.1.14, the `git_add` tool did not validate that file paths provided in the files argument were within the repository boundaries. The tool used GitPython's `repo.index.add(`, which did not enforce working-tree boundary checks for relative …
    osv-scannerCVE-2026-27735
  • mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries
    In `mcp-server-git` versions prior to 2026.1.14, the `git_add` tool did not validate that file paths provided in the files argument were within the repository boundaries. The tool used GitPython's `repo.index.add(`, which did not enforce working-tree boundary checks for relative …
    osv-scannerCVE-2026-27735
  • mcp-server-git has missing path validation when using --repository flag
    In mcp-server-git versions prior to 2025.12.18, when the server is started with the --repository flag to restrict operations to a specific repository path, it did not validate that repo_path arguments in subsequent tool calls were actually within that configured path. This could …
    osv-scannerCVE-2025-68145
  • mcp-server-git has missing path validation when using --repository flag
    In mcp-server-git versions prior to 2025.12.18, when the server is started with the --repository flag to restrict operations to a specific repository path, it did not validate that repo_path arguments in subsequent tool calls were actually within that configured path. This could …
    osv-scannerCVE-2025-68145
  • mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations
    In mcp-server-git versions prior to 2025.9.25, the git_init tool accepted arbitrary filesystem paths and created Git repositories without validating the target location. Unlike other tools which required an existing repository, git_init could operate on any directory accessible t…
    osv-scannerCVE-2025-68143
  • mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations
    In mcp-server-git versions prior to 2025.9.25, the git_init tool accepted arbitrary filesystem paths and created Git repositories without validating the target location. Unlike other tools which required an existing repository, git_init could operate on any directory accessible t…
    osv-scannerCVE-2025-68143
  • PYSEC-2026-2132
    Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
    osv-scannerCVE-2026-7246
  • PYSEC-2026-2132
    Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
    osv-scannerCVE-2026-7246
  • PYSEC-2026-2132
    Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
    osv-scannerCVE-2026-7246
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepsrc/everything/__tests__/tools.test.ts:360
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepsrc/everything/__tests__/tools.test.ts:352

This report is public.