MCP server

VerifyAX

mcp:verifyax/verifyax-mcp

Evaluate, benchmark, and simulate AI agents on the VerifyAX agent-evaluation platform.

awesome-mcp-servers Glama MCP Registry

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 26, 2026, 12:44 UTC at 844ae20

findings

medium

highest severity

threat classes

152

files scanned

1,467/1,467

checks satisfied

package advisories

Why this verdict

mcp-server . Suspicious

suspicious: unverified finding mcp-server:.:pnpm-lock.yaml:1:SUPPLY

mcp-server packages/mcp-server Inconclusive

inconclusive: unresolved question on EXEC

Security findings 1

Supply chain

mediumUnverifiedlow confidence

The mcp-server package declares an undeclared dev dependency on dotenv-expand at the anomalous version ^1000.0.0 (a look-alike or version-squat pattern) alongside the legitimate dotenv-expand 12.x pulled in by dotenv-cli, which is a possible dependency-confusion vector.

pnpm-lock.yaml:1-4442

importers.packages/mcp-server.devDependencies.dotenv-expand.specifier: ^1000.0.0

vector:metadata

Open questions 1

What the analysis could not settle from the code alone.

[file request packages/mcp-server/scripts/run-with-env-file.mjs] Does this launcher script only load the dotenv file and spawn the given child command, or does it do any network access, credential forwarding, or other unexpected execution?

Code execution

Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Privilege escalation

mediumRefutedlow confidence

The Cloud Run deploy script publishes the MCP service with --allow-unauthenticated, exposing the public endpoint without IAM authentication (host-header allowlist only); this is a deployment-hardening risk, not malicious behavior.

deploy/gcp/deploy.sh:84

--allow-unauthenticated \

Why it was refuted

The flag is a deliberate, documented deployment choice for a public MCP endpoint, not privilege escalation. The script's own comments flag it as a hardening consideration and require host-header validation, so the behavior is not a concealed or undeclared harm.

Coverage gaps 3

Parts of the artifact the static analysis could not fully examine.

glob_budget_exceeded reference source exceeds 262144 characters

packages/sdk/src/types.gen.ts

parse_error tree-sitter typescript parse has errors; extraction may be partial

packages/sdk/src/index.ts

no_tools_extracted MCP server target with no statically extractable tools/prompts/resources

server.json