MCP server

io.github.us-all/mlflow

mcp:us-all/mlflow-mcp-server

MLflow MCP — experiments, runs, registered models, versions, traces, assessments (MLflow 3)

awesome-mcp-servers Glama MCP Registry

Verdict

Inconclusive

The analysis could not cover enough of the artifact to decide.

Analyzed Oct 26, 2026, 13:19 UTC at 4cf1819

findings

—

highest severity

threat classes

files scanned

607/607

checks satisfied

package advisories

Why this verdict

inconclusive: gap dynamic_metadata at src/index.ts

Security findings 0

No individual findings recorded

The inconclusive verdict rests on the coverage gaps below; 1 candidate finding was refuted on review.

Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Data exfiltration

highRefutedlow confidence

The create-webhook tool lets the agent register an arbitrary caller-supplied URL (plus HMAC secret) on the MLflow server so model-registry events are posted to it; if the agent is prompt-injected this could route registry event data to an attacker endpoint, though it requires MLFLOW_ALLOW_WRITE=true and is a documented MLflow feature.

src/tools/webhooks.ts:37-48

url: params.url,

Why it was refuted

This is the standard MLflow Model Registry webhook-creation API, a core capability of an MLflow wrapper, gated behind assertWriteAllowed(). Nothing is hidden, and no instruction or source-to-sink chain sends data anywhere beyond what the caller-supplied URL parameter already implies. The exfil risk rests only on a hypothetical prompt injection.

Coverage gaps 1

Parts of the artifact the static analysis could not fully examine.

dynamic_metadata line 135: tool None input schema is computed: schema

src/index.ts