MCP server

io.github.brave/brave-search-mcp-server

mcp:brave/brave-search-mcp-server

Brave Search MCP Server: web results, images, videos, rich results, AI summaries, and more.

awesome-mcp-servers Docker MCP Catalog Glama MCP Registry

Verdict

Inconclusive

The analysis could not cover enough of the artifact to decide.

Analyzed Oct 26, 2026, 11:08 UTC at af08e0d

findings

—

highest severity

threat classes

files scanned

507/507

checks satisfied

package advisories

Why this verdict

inconclusive: gap dynamic_metadata at src/jsonSchemaDialect.ts

Security findings 0

No individual findings recorded

The inconclusive verdict rests on the coverage gaps below; 1 candidate finding was refuted on review.

Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Supply chain

mediumRefutedlow confidence

Undeclared npm 'prepare' lifecycle hook runs format and build automatically on install/pack; it is a local, standard dev build step with no remote fetch, so low risk and plausibly honest.

package.json:30

"prepare": "npm run format && npm run build"

Why it was refuted

The prepare hook is a standard local dev build step (prettier format and tsc build) with no remote fetch or exfil. The harm gate fails because it matches the ordinary build/cache-dir carve-out, and there is no chain to any harmful sink. The finding itself acknowledges low risk.

Coverage gaps 1

Parts of the artifact the static analysis could not fully examine.

dynamic_metadata line 63: tools list returned by ListToolsRequestSchema handler is computed

src/jsonSchemaDialect.ts