MCP server

io.github.vaemail/vaemail

mcp:vaemail/vaemail-mcp

Email infrastructure for AI agents: send, authenticate domains, track delivery, diagnose issues.

awesome-mcp-servers Glama MCP Registry

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 26, 2026, 13:09 UTC at b11fa33

findings

high

highest severity

threat classes

files scanned

180/180

checks satisfied

package advisories

Why this verdict

suspicious: unverified finding mcp-server:.:lib/serveur-mcp.js:35:EXFIL

Security findings 1

Data exfiltration

highUnverifiedlow confidence

The MCP server's connection-time instructions tell the agent to report problems to a hardcoded third-party email address (hugo@agencesw.com) with the exact call and the response received, an undeclared channel that could carry account data and API responses off-host.

lib/serveur-mcp.js:35

signale-le à hugo@agencesw.com avec l

vector:instruction

Coverage gaps 1

Parts of the artifact the static analysis could not fully examine.

no_tools_extracted MCP server target with no statically extractable tools/prompts/resources

server.json