Is Apple Rag MCP server safe?

The published artifact contains a .env file. That is where a project keeps its environment secrets; it reaches a release when the packer captures the project root, the same way publisher credentials do.

2 variable(s), values withheld: VITE_STRIPE_PUBLISHABLE_KEY=…, VITE_GA_MEASUREMENT_ID=…

Fix: Treat every value in it as exposed and rotate it, then exclude the file from the release (a `files` allowlist or .npmignore for npm, MANIFEST.in for a Python sdist — .gitignore alone excludes it from neither).

The component makes outbound network requests.

import axios, { type AxiosError, type AxiosInstance, type AxiosResponse } from "axios";

this.client = axios.create({

fetch("https://api.ipify.org?format=json")

const response = await fetch("https://oauth2.googleapis.com/token", {

const response = await fetch("https://github.com/login/oauth/access_token", {

const response = await fetch("https://www.googleapis.com/oauth2/v2/userinfo", {

fetch("https://api.github.com/user", {

fetch("https://api.github.com/user/emails", {

const response = await fetch(AppleAPIClient.ALL_VIDEOS_URL, {

const response = await fetch(videoUrl, {

const response = await fetch(url, {

const res = await fetch(DEEPINFRA_CONFIG.API_URL, {

const res = await c.env.ASSETS.fetch(c.req.raw);

return c.env.ASSETS.fetch(new Request(url.toString(), c.req.raw));

async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {

return mcpApp.fetch(request, env, ctx);

return app.fetch(request, env, ctx);

const res = await fetch(`${DEEPINFRA_CONFIG.BASE_URL}${endpoint}`, {

response += `This shows merged content from multiple parts. For the complete document, use Apple RAG MCP fetch tool: \`fetch(url: "${result.url}")\`\n\n`;

response += `This is a partial document. For the complete content, use Apple RAG MCP fetch tool: \`fetch(url: "${result.url}")\`\n\n`;

return handler.fetch(request, {

const res = await fetch(url, {

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.

An OAuth 2.0 / OpenID Connect delegated-authentication flow was detected (authorization-code / refresh-token / token-exchange grant, an OIDC authorize/discovery endpoint or id_token, or a delegation library). Tools authenticate with the end user's delegated, scoped credentials rather than a long-lived embedded service credential. (2 occurrence(s) shown as evidence).

return `https://github.com/login/oauth/authorize?${params}`;

grant_type: "authorization_code",

Fix: Delegated auth is a lower-blast-radius execution context than an embedded static credential. Confirm the requested scopes are minimal and that tokens are never logged or forwarded off-host.

A short-lived, scoped, assumed identity was detected — an STS AssumeRole / session token, a cloud managed or workload identity, an impersonated service account, a projected Kubernetes service-account token, or a dynamic-secret broker. Tools authenticate with a narrowly-scoped credential that expires, rather than a long-lived embedded service credential. (2 occurrence(s) shown as evidence).

export async function generateAccessToken(

const accessToken = await generateAccessToken(user, sessionId, planType, permissions, secret);

Fix: A scoped, short-lived identity is the smallest-blast-radius execution context. Confirm the assumed role / requested scope grants only the permissions the tool needs, and that the token lifetime is minimal.

An MCP tool surface (manifest or tool definitions) was found.

{

const server = new McpServer(

server.registerTool(

server.registerTool(

Why it matters: Just context — review which tools it offers and their permissions.

Fix: Review the declared MCP tools and their permissions.