mcp-server-typescript

Security Findings (37)

• HighExcessive Permission Surface ×17

  • ai_optimization_keyword_data_search_volume:tool declares network permission
  • ai_opt_llm_ment_search:tool declares network permission
  • ai_optimization_chat_gpt_scraper:tool declares network permission
  • ai_optimization_chat_gpt_scraper_locations:tool declares network permission
  • kw_data_google_ads_search_volume:tool declares network permission
  • on_page_content_parsing:tool declares network permission
  • on_page_content_parsing:tool declares exec permission
  • on_page_instant_pages:tool declares network permission
  • on_page_instant_pages:tool declares exec permission
  • on_page_lighthouse:tool declares network permission
  • on_page_lighthouse:tool declares exec permission
  • dataforseo_labs_google_top_searches:tool declares network permission
  • dataforseo_labs_search_intent:tool declares network permission
  • dataforseo_labs_google_page_intersection:tool declares network permission
  • business_data_business_listings_search:tool declares network permission
  • business_data_business_listings_search:tool declares exec permission
  • content_analysis_search:tool declares network permission

  Rule: AS-002Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.
• MediumExcessive Permission Surface ×3

  • dataforseo_labs_google_related_keywords:tool declares db permission
  • dataforseo_labs_google_top_searches:tool declares db permission
  • backlinks_competitors:tool declares fs permission

  Rule: AS-002Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.
• LowDoS Resilience — Missing Rate Limit / Timeout ×13

  • ai_optimization_keyword_data_search_volume:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • ai_opt_llm_ment_search:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • ai_optimization_chat_gpt_scraper:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • ai_optimization_chat_gpt_scraper_locations:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • kw_data_google_ads_search_volume:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • on_page_content_parsing:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • on_page_instant_pages:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • on_page_lighthouse:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • dataforseo_labs_google_top_searches:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • dataforseo_labs_search_intent:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • dataforseo_labs_google_page_intersection:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • business_data_business_listings_search:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration
  • content_analysis_search:tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  Rule: AS-011Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.
• LowExcessive Permission Surface ×4

  • dataforseo_labs_google_competitors_domain:input schema exposes 11 properties (threshold: 10)
  • dataforseo_labs_google_domain_intersection:input schema exposes 12 properties (threshold: 10)
  • dataforseo_labs_google_page_intersection:input schema exposes 12 properties (threshold: 10)
  • dataforseo_labs_google_relevant_pages:input schema exposes 11 properties (threshold: 10)

  Rule: AS-002Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.