BeaconIntel
← All MCP servers
MCP server

io.github.webtoolbox/websitetoolbox-mcp

mcp:webtoolbox/websitetoolbox-mcp

Community forum management — posts, users, search, and moderation via the Website Toolbox API.

awesome-mcp-serversGlamaMCP Registry
Verdict
Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 26, 2026, 12:43 UTC at 9b75b20
1
findings
medium
highest severity
1
threat classes
15
files scanned
392/392
checks satisfied
0
package advisories

Why this verdict

  • suspicious: finding mcp-server:.:manifest.yaml:16:SUPPLY

Security findings 1

Supply chain

mediumContextual risklow confidence

The manifest installs the server from a mutable git branch (main) and runs npm install/build bootstrap steps, so the code fetched at install time can change without notice.

manifest.yaml:16
ref: main
vector:metadata
Counter-argument considered

The manifest installs from an unpinned mutable git branch and runs npm install/build bootstrap on the fetched code, which is not a pinned official-registry install carve-out; the install behavior is declared, but it is a genuine low-severity supply-chain weakness. No mitigation such as a commit pin exists, so the finding is not refuted.