MCP server

Prometheus MCP Server

mcp:pab1it0/prometheus-mcp-server

MCP server providing Prometheus metrics access and PromQL query execution for AI assistants

awesome-mcp-servers Docker MCP Catalog Glama MCP Registry

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 26, 2026, 11:10 UTC at 4c9b377

findings

high

highest severity

threat classes

files scanned

282/282

checks satisfied

package advisories

Why this verdict

suspicious: finding mcp-server:.:src/prometheus_mcp_server/server.py:221:CRED

Security findings 1

Credential access

highContextual risklow confidence

The debug log in make_prometheus_request writes the request headers, which can include the bearer token, to stderr; this only happens at DEBUG level, which is disabled by the INFO default, and nothing is sent off-host.

src/prometheus_mcp_server/server.py:221

logger.debug("Making Prometheus API request", endpoint=endpoint, url=url, params=params, headers=headers, timeout=config.request_timeout)

vector:code

Counter-argument considered

The bearer token is placed in the headers dict and the whole dict is logged at debug level. That is a real credential-in-logs weakness. The claim itself says it is limited to DEBUG level and nothing leaves the host, and no mitigation is visible that redacts the headers, so the finding stands as low severity.

Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Supply chain

mediumRefutedlow confidence

pyproject.toml declares runtime dependencies python-dotenv, requests and starlette with no version constraint, so installs without the uv.lock float to whatever is newest on the index (low-risk, official registry).

pyproject.toml:9

"requests",

Why it was refuted

The unpinned dependencies are openly declared in the project's own dependency list. They are ordinary, well-known packages from the official index, with no concealment, no moving git/URL reference and no agent instruction. This is a normal packaging choice, not an undeclared or hidden supply-chain behavior.