MCP server

htmldrop

mcp:vin-spiegel/htmldrop

Publish HTML, Markdown, PDF, or images as instant shareable links with expiry and passwords.

awesome-mcp-servers Glama MCP Registry

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 26, 2026, 13:24 UTC at 8f8c42b

findings

high

highest severity

threat classes

files scanned

478/478

checks satisfied

package advisories

Why this verdict

suspicious: finding mcp-server:.:src/safe-fetch.ts:55:EXFIL
suspicious: unverified finding mcp-server:.:src/storage.ts:42:EXFIL

Security findings 2

Data exfiltration

highContextual riskmedium confidence

The safeFetch SSRF guard only recognizes dotted-quad IPv4-mapped IPv6 addresses, but URL parsing normalizes them to hex form (::ffff:7f00:1), so a user-supplied url could reach loopback or cloud-metadata hosts and have the response published publicly.

src/safe-fetch.ts:55

const mapped = lower.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);

vector:code

Counter-argument considered

The SSRF bypass is real. WHATWG URL parsing normalizes http://[::ffff:127.0.0.1]/ to the hex form ::ffff:7f00:1, which the dotted-quad regex does not match. isBlockedIp then returns false, so loopback and metadata addresses pass the guard. This contradicts the guard's stated purpose, and the response is published publicly.

Data exfiltration

highUnverifiedlow confidence

FilesystemStorage builds file paths from an unvalidated subdomain value (taken from the route parameter or Host header) via path.join, so a traversal-style value could read or delete .json/.html file pairs outside the data directory; this is limited by the required suffixes and the need for a matching pair.

src/storage.ts:42

const metaPath = path.join(DATA_DIR, `${subdomain}.json`);

vector:code

Refuted findings 2

Candidates the review stage examined and rejected, kept for transparency.

Tool poisoning

criticalRefutedlow confidence

The MCP server's single tool definition is imported from ./mcp-handlers.js (PUBLISH_TOOL) and not shown here, so its name, description, and schema cannot be reviewed for tool poisoning or parameter conditioning.

src/mcp-server.ts:17

tools: [PUBLISH_TOOL],

Why it was refuted

The finding's premise is wrong: PUBLISH_TOOL is shown in src/mcp-handlers.ts. Its name, description and schema are static and benign, with no hidden instructions or parameter conditioning.

Data exfiltration

highRefutedlow confidence

The undeclared /publish/from-url feature fetches user-supplied URLs server-side and publishes the response publicly; the SSRF guard admits a DNS-rebinding residual risk that could expose internal resources.

src/safe-fetch.ts:17

Residual risk: DNS rebinding between the check and the connection.

Why it was refuted

Fetching a user-supplied URL is the tool's declared core capability. The code comment only notes a known residual DNS-rebinding limitation in an otherwise present SSRF guard, which is not an undeclared or concealed behavior.