MCP server

io.globalping/mcp

mcp:jsdelivr/globalping-mcp-server

Interact with a global network measurement platform.Run network commands from any point in the world

awesome-mcp-servers Glama MCP Registry

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 26, 2026, 11:37 UTC at 452ad04

findings

high

highest severity

threat classes

files scanned

1,076/1,076

checks satisfied

package advisories

Why this verdict

suspicious: finding mcp-server:.:src/index.ts:59:EXFIL
suspicious: finding mcp-server:.:src/lib/agentcat.ts:13:EXFIL
suspicious: finding mcp-server:.:src/ui/layout.ts:17:SUPPLY

Security findings 3

Data exfiltration

highContextual riskmedium confidence

The server undeclaredly wires third-party AgentCat/MCPcat analytics into the MCP server when a project ID is set, sending tool-call events (with only Authorization headers redacted) to an external telemetry service.

src/index.ts:59

agentcat.track(this.server, this.env.MCPCAT_PROJECT_ID, {

vector:code

Counter-argument considered

The server wires third-party analytics into tool calls, which sends tool-call events to an external host. That behavior is not part of the declared network-measurement capability, and only Authorization headers are redacted.

Data exfiltration

highContextual riskmedium confidence

The redactEvent hook only masks Authorization headers, so other secret-bearing data such as tool-argument headers (Set-Cookie, X-Access-Token) still reaches the AgentCat third-party service.

src/lib/agentcat.ts:13

name.toLowerCase() === "authorization" ? REDACTED_HEADER_VALUE : value,

vector:code

Counter-argument considered

The redaction masks only the Authorization header name, so other headers and secret-bearing arguments pass through to the third-party service. This is a real, narrow redaction gap.

Supply chain

highContextual risklow confidence

The OAuth/authentication HTML pages load an unpinned remote script from cdn.tailwindcss.com at runtime, so a compromised or mutable CDN script would execute in the authorization pages.

src/ui/layout.ts:17

<script src="https://cdn.tailwindcss.com"></script>

conceal:remotevector:code

Counter-argument considered

The auth pages load an unpinned script from a remote CDN with no integrity attribute, so a compromised CDN script would run in those pages. This is not a carve-out.

Refuted findings 2

Candidates the review stage examined and rejected, kept for transparency.

Data exfiltration

highRefutedlow confidence

The server includes an AgentCat third-party analytics/telemetry integration that is not part of the network-measurement purpose and is not declared in the tool metadata; the data sent is not shown here, though a sibling unit says Authorization values are stripped.

src/config/constants.ts:1-142

AgentCat configuration for analytics and telemetry

Why it was refuted

The constants file only holds a feature flag and an env var name, with no data flow. The comment openly labels it analytics and telemetry, so nothing is concealed here.

Data exfiltration

mediumRefutedmedium confidence

The MCP server forwards tool-call telemetry to a third-party analytics host (agentcat.com). The test asserts that http tool arguments, including user-supplied Set-Cookie and X-Access-Token header values, are included unredacted in the payload. This is undeclared in the tool list and sends potentially sensitive user data off-host.

test/integration/agentcat-public-contract.test.ts:42

if (url.hostname.endsWith("agentcat.com")) {

Why it was refuted

The cited code is a test mock that intercepts agentcat.com requests and returns a fake response locally, so it forwards nothing. Production forwarding is covered by the src/index.ts finding.