Is Auth0 MCP Server safe?

The component reads files from disk.

const data = fs.readFileSync(configPath, 'utf-8');

const data = fs.readFileSync(configPath, 'utf-8');

existingContent = fs.readFileSync(resolvedPath, 'utf-8');

const content = fs.readFileSync(gitignorePath, 'utf-8');

return dotenvParse(fs.readFileSync(filePath, 'utf-8'));

const state = JSON.parse(fs.readFileSync(statePath, 'utf-8'));

lines = fs.readFileSync(logPath, 'utf-8').split('\n').filter(Boolean);

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

The component writes or deletes files on disk.

fs.writeFileSync(configPath, JSON.stringify(config, null, 2));

fs.writeFileSync(configPath, JSON.stringify(config, null, 2));

fs.writeFileSync(tmpFile, content, { encoding: 'utf-8', mode: CREDENTIAL_FILE_MODE });

fs.unlinkSync(tmpFile);

fs.appendFileSync(gitignorePath, `${header}\n${envFileName}\n`, 'utf-8');

fs.writeFileSync(gitignorePath, `# Auth0 credentials\n${envFileName}\n`, 'utf-8');

fs.writeFileSync(statePath, JSON.stringify(state, null, 2), 'utf-8');

fs.writeFileSync(tmpPath, content, 'utf-8');

fs.unlinkSync(tmpPath);

Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.

Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.

The component makes outbound network requests.

const response = await fetch(`https://${config.tenant}/oauth/device/code`, {

const response = await fetch(`https://${config.tenant}/oauth/token`, {

const response = await fetch(`https://${config.tenant}/oauth/token`, {

const response = await fetch(`https://${config.tenant}/oauth/revoke`, {

const response = await fetch(this.endpoint, {

const response = await fetch(url, {

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.

An OAuth 2.0 / OpenID Connect delegated-authentication flow was detected (authorization-code / refresh-token / token-exchange grant, an OIDC authorize/discovery endpoint or id_token, or a delegation library). Tools authenticate with the end user's delegated, scoped credentials rather than a long-lived embedded service credential.

grant_type: 'refresh_token',

Fix: Delegated auth is a lower-blast-radius execution context than an embedded static credential. Confirm the requested scopes are minimal and that tokens are never logged or forwarded off-host.

An MCP tool surface (manifest or tool definitions) was found.

const server = new Server({ name: 'auth0', version: packageVersion }, { capabilities: { tools: {}, logging: {} } });

Why it matters: Just context — review which tools it offers and their permissions.

Fix: Review the declared MCP tools and their permissions.