MCP server

io.github.vibeads/mcp

mcp:vibeads/mcp

Manage Google Ads from ChatGPT, Claude or any MCP client. Sign in with OAuth or use an API key.

awesome-mcp-servers Glama MCP Registry

Verdict

Inconclusive

The analysis could not cover enough of the artifact to decide.

Analyzed Oct 26, 2026, 12:56 UTC at 6bf51b3

findings

—

highest severity

threat classes

files scanned

406/406

checks satisfied

package advisories

Why this verdict

inconclusive: gap no_tools_extracted at package.json

Security findings 0

No individual findings recorded

The inconclusive verdict rests on the coverage gaps below; 1 candidate finding was refuted on review.

Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Data exfiltration

highRefutedlow confidence

The gateway base URL can be overridden by the VIBEADS_SUPABASE_URL environment variable, and callGateway then POSTs the VIBEADS_API_KEY in the x-vibeads-api-key header to that URL. If the variable is attacker-controlled, the key is redirected to a third-party host; the default destination is the vendor's own endpoint.

src/gateway.ts:18

process.env.VIBEADS_SUPABASE_URL

Why it was refuted

This is the wrapped service's own API key sent to the vendor's own default gateway, which is the declared core capability and the env-API-key carve-out. The base URL override is set by the user's own MCP client config, not by an attacker. Nothing in the artifact reads or sends any other data, and nothing instructs the agent to set the variable.

Coverage gaps 1

Parts of the artifact the static analysis could not fully examine.

no_tools_extracted MCP server target with no statically extractable tools/prompts/resources

package.json