Is mcp-remote proxy safe?
- Node.js shell/command execution
- Node.js dynamic code execution
- Node.js filesystem read
mcp-remote is an AI npm_package analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators, though 7 risky constructs are reported for review. It can: delegated authentication, dynamic code execution, filesystem read, filesystem write, install time execution, network egress and shell execution — capabilities are what the code can do, not a verdict on intent. Risk score 0/100 (low).
mcp-remote 0.14.3
Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of mcp-remote proxy's authors. Report a false positive.
Behavioral traits
How this component maps to the CSA agentic threat model. Descriptive — it never affects the risk score.
Findings (7)
The code turns strings into live code at runtime (eval / new Function / exec).
const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get());const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get());Why it matters: If those strings aren't fixed and trusted, they become a way to run arbitrary code.
Fix: Avoid evaluating dynamically constructed code; if unavoidable, ensure the input is a trusted constant and never derived from external data.
The component can run operating-system commands or spawn processes.
import { spawn } from "child_process";if (await launched(spawn(fallback.command, fallback.args(url2), { stdio: "ignore" }), fallback.command)) {Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.
Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; prefer execFile with an argument array.
The component reads files from disk.
const content = await fs.readFile(filePath, "utf-8");
return await fs.readFile(filePath, "utf-8");
Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.
Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.
The component writes or deletes files on disk.
await fs.unlink(filePath);
await fs.unlink(filePath);
await fs.writeFile(tempPath, serialized, { encoding: "utf-8", mode: 384 });await fs.unlink(tempPath).catch(() => {await fs.writeFile(filePath, serialized, { encoding: "utf-8", mode: 384 });await fs.writeFile(filePath, text, { encoding: "utf-8", mode: 384 });await fs.writeFile(filePath, JSON.stringify(lease, null, 2), { encoding: "utf-8", mode: 384, flag: "wx" });await fs.unlink(filePath).catch(() => {Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.
Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.
package.json has a 'prepare' script (runs on git/local installs and before publishing).
"prepare": "husky",
Why it matters: Usually a build step, but confirm it doesn't fetch or run remote code.
Fix: Usually a legitimate build step; confirm it only builds and does not fetch or execute remote code.
The component makes outbound network requests.
* explicit static predicate (the axios/AWS-SDK `isInstance` style). Reads
* explicit static predicate (the axios/AWS-SDK `isInstance` style). Reads
* explicit static predicate (the axios/AWS-SDK `isInstance` style). Reads
* Get request options for the `fetch()` request
* explicit static predicate (the axios/AWS-SDK `isInstance` style). Reads
* explicit static predicate (the axios/AWS-SDK `isInstance` style). Reads
* always fetch (the caller decides whether to write). Freshness and
* explicit static predicate (the axios/AWS-SDK `isInstance` style). Reads
const response = await fetch(metadataUrl, {const response = await fetch(metadataUrl, {const response = await fetch(endpoint, { method: "POST", headers, body: params });const response = await fetch(tokenEndpoint, { method: "POST", headers, body: params });const response = await fetch(tokenEndpoint, { method: "POST", headers, body: params });response = await fetch(authorizationUrl.toString(), {const response = await fetch(`http://127.0.0.1:${port}${MCP_REMOTE_ID_PATH}`, {const response = await fetch(serverUrl, {* explicit static predicate (the axios/AWS-SDK `isInstance` style). Reads
* explicit static predicate (the axios/AWS-SDK `isInstance` style). Reads
* explicit static predicate (the axios/AWS-SDK `isInstance` style). Reads
Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.
Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.
An OAuth 2.0 / OpenID Connect delegated-authentication flow was detected (authorization-code / refresh-token / token-exchange grant, an OIDC authorize/discovery endpoint or id_token, or a delegation library). Tools authenticate with the end user's delegated, scoped credentials rather than a long-lived embedded service credential. (15 occurrence(s) shown as evidence).
authorization_endpoint: SafeUrlSchema,
authorization_endpoint: SafeUrlSchema,
id_token: string2().optional(),
url: new URL(`/.well-known/openid-configuration`, url2.origin),
url: new URL(`/.well-known/openid-configuration${pathname}`, url2.origin),url: new URL(`${pathname}/.well-known/openid-configuration`, url2.origin),authorizationUrl = new URL(metadata.authorization_endpoint);
grant_type: "authorization_code",
grant_type: "refresh_token",
const oidcPath = "/.well-known/openid-configuration";
hasIdToken: !!tokens.id_token,
if (!tokens.id_token) {return { ...tokens, access_token: tokens.id_token };if (!this.useIdToken || !tokens.id_token) {return jwtExpiresAt(tokens.id_token) ?? tokens.expires_at;
Fix: Delegated auth is a lower-blast-radius execution context than an embedded static credential. Confirm the requested scopes are minimal and that tokens are never logged or forwarded off-host.
Check your own component
Run the same evidence-backed scan on any MCP server, agent skill, or package.
Scan your own componentHow we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →