Is InfraNodus MCP server safe?

The component can run operating-system commands or spawn processes.

import { execFileSync } from "node:child_process";

Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.

Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; prefer execFile with an argument array.

The component reads files from disk.

const content = fs.readFileSync(filePath, "utf-8");

return fs.readFileSync(path.resolve(root, candidate), "utf-8");

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

The component makes outbound network requests.

const response = await fetch(`${config.apiBase}${endpoint}`, {

const response = await fetch(`${config.apiBase}${endpoint}`, {

const response = await fetch(`${BRAND_API_BASE}/userId`, {

import * as http from "http";

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.

An OAuth 2.0 / OpenID Connect delegated-authentication flow was detected (authorization-code / refresh-token / token-exchange grant, an OIDC authorize/discovery endpoint or id_token, or a delegation library). Tools authenticate with the end user's delegated, scoped credentials rather than a long-lived embedded service credential. (7 occurrence(s) shown as evidence).

grant_type: "authorization_code";

app.get("/oauth/authorize", (req: Request, res: Response) => {

<form method="POST" action="/oauth/authorize">

"/oauth/authorize",

authorization_endpoint: `${baseUrl}/oauth/authorize`,

app.get("/.well-known/openid-configuration", (req: Request, res: Response) => {

authorization_endpoint: `${baseUrl}/oauth/authorize`,

Fix: Delegated auth is a lower-blast-radius execution context than an embedded static credential. Confirm the requested scopes are minimal and that tokens are never logged or forwarded off-host.

An MCP tool surface (manifest or tool definitions) was found.

"mcpServers": {

{

"mcpServers": {

{

const transport = new StdioServerTransport();

transport = new StreamableHTTPServerTransport({

const transport = new SSEServerTransport("/message", res);

const mcpServer = new McpServer(serverInfo, {

mcpServer.registerTool(

const transport = new StdioServerTransport();

Why it matters: Just context — review which tools it offers and their permissions.

Fix: Review the declared MCP tools and their permissions.