MCP server

JSON MCP Lite

mcp:scoretracker4321/json-mcp-lite

Serve any JSON file as read-only list, keyword search and get-by-id MCP tools.

awesome-mcp-servers Glama MCP Registry

Verdict

Inconclusive

The analysis could not cover enough of the artifact to decide.

Analyzed Oct 29, 2026, 15:47 UTC at cf8f798

findings

—

highest severity

threat classes

files scanned

74/74

checks satisfied

package advisories

Why this verdict

inconclusive: gap dynamic_metadata at src/server.js

Security findings 0

No individual findings recorded

The inconclusive verdict rests on the coverage gaps below.

Notes 1

Capabilities, vulnerabilities and disclosed behavior worth knowing. Nothing here works against the person who installs it, so notes never change the verdict.

Tool poisoning

mediumNoteConfirmed on reviewlow confidence

The MCP tool names and titles are built from the operator-supplied --name argument, so the exact tool metadata the client receives is decided at launch rather than fixed in the reviewed source; this is operator-controlled configuration and is reported as a note.

src/server.js:115

buildServer(tools, values.name)

vector:code

Reviewer's reasoning

The tool name comes from the --name flag, which defaults to "records" and is set by the operator launching the server, so this is operator-controlled configuration that the user chooses. The detector's point that metadata is not fixed statically does not make the behavior harmful, and no outside input steers it.

Coverage gaps 6

Parts of the artifact the static analysis could not fully examine.

dynamic_metadata line 22: tool (computed name) name depends on unsupported construct (unsupported): member '.name' of a launcher configuration value: name

src/server.js

dynamic_metadata line 22: tool (computed name) title depends on unsupported construct (unsupported): member '.name' of a launcher configuration value: name

src/server.js

dynamic_metadata line 22: tool (computed name) description depends on unsupported construct (unsupported): member '.name' of a launcher configuration value: name

src/server.js

dynamic_metadata line 22: tool (computed name) description depends on unsupported construct (unsupported): member '.search' of a launcher configuration value: search

src/server.js

dynamic_metadata line 22: tool (computed name) param 'query' description depends on unsupported construct (unsupported): member '.search' of a launcher configuration value: search

src/server.js

dynamic_metadata line 70: tool (computed name) input schema depends on unsupported construct (unsupported): computed key: [id]: z.string().describe(`The ${id} of the record to fetch (exact match).`)

src/server.js