Announcing Beacon: Self-improving memory for coding agents

← All MCP servers

MCP server

MCP Gateway Scan

mcp:willianpinho/mcp-gateway-scan

Read-only MCP/agent-gateway readiness scanner — scores a repo across 7 security dimensions.

awesome-mcp-servers Glama MCP Registry

Verdict

No issues found

No suspicious or malicious behavior was found.

Analyzed Oct 26, 2026, 14:06 UTC at cb22af4

0

findings

—

highest severity

0

threat classes

38

files scanned

331/331

checks satisfied

0

package advisories

Why this verdict

benign: 331 checks satisfied, no findings for mcp-server:.

Security findings 0

No security findings

No suspicious or malicious behavior was found; 1 candidate finding was refuted on review.

Execution chain 24

What it calls, runs, installs, reads and writes, with the line that does it.

Files read 12

.env

src/walker.ts:41 · literal

.env.example

src/walker.ts:56 · literal

.env.local

src/walker.ts:54 · literal

.env.production

src/walker.ts:55 · literal

<dynamic>

src/cli.ts:143 · via:resolveConnectTarget

<dynamic>

src/connect-target.ts:90 · read

<dynamic>

src/scanner.ts:29 · via:loadFiles

<dynamic>

src/walker.ts:96 · read

<dynamic>

src/walker.ts:114 · via:walk

<dynamic>

src/walker.ts:122 · read

<dynamic>

src/walker.ts:139 · read

<dynamic>

src/walker.ts:151 · via:walk

GitHub repositories 4

willianpinho/mcp-gateway-scan

package.json:18 · url

willianpinho/mcp-gateway-scan

package.json:21 · url

willianpinho/mcp-gateway-scan

package.json:23 · url

willianpinho/mcp-gateway-scan

server.json:7 · url

Packages 1

npm:mcp-gateway-scan@0.2.0

server.json:15 · launch:server.json

URLs 7

https://github.com/willianpinho/mcp-gateway-scan

https://github.com/willianpinho/mcp-gateway-scan.git

package.json:18

https://github.com/willianpinho/mcp-gateway-scan/issues

package.json:21

https://github.com/willianpinho/mcp-gateway-scan#readme

package.json:23

https://provenwright.com/audit

src/report.ts:7

https://registry.npmjs.org

https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json

Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Reconnaissance

lowRefutedlow confidence

The scan_gateway MCP tool resolves an agent-supplied path with no workspace restriction, and the walker reads .env files and other config files under it, so an agent can enumerate arbitrary directories and get matched-line excerpts back in the tool result (read-only, no network sink).

src/mcp-server.ts:65

const target = resolve(inputPath);

Why it was refuted

The tool is a directory scanner whose purpose is to take a path and scan it, so reading config and .env files under that path is its core function. The output goes only to the calling agent, with no network sink or exfiltration chain.