Why this verdict
- benign: 184 checks satisfied, nothing works against the installer of mcp-server:. (1 notes, 0 third-party flags)
Security findings 0
No security findings
Nothing found that works against the person who installs it.
Notes 1
Capabilities, vulnerabilities and disclosed behavior worth knowing. Nothing here works against the person who installs it, so notes never change the verdict.
Credential access
mediumNoteConfirmed on reviewlow confidenceThe token-exchange helper logs the full OAuth token endpoint response body at debug level, so FHIR access and refresh tokens can land in local logs; this is an undeclared hygiene mistake that exposes credentials to anyone who reads the logs.
f"Token endpoint response: {response.status_code} - {response.text}"vector:code
Reviewer's reasoning
The debug log line does write the full token endpoint response body, which can contain tokens, but this is an undeclared hygiene mistake in local logging with no outside host receiving the data and no deliberate concealment. Harm requires someone with access to the local logs, so under the note carve-out for hygiene mistakes the level stays note.
Coverage gaps 4
Parts of the artifact the static analysis could not fully examine.
context:oversize 12861106 bytes > max_file_bytes 8388608
docs/videos/vscode/epic/demo-screen-recording.mp4
context:oversize 12525242 bytes > max_file_bytes 8388608
docs/videos/vscode/hapi/demo-screen-recording.mp4
context:bytes_unavailable yara-x: no bytes to scan
docs/videos/vscode/epic/demo-screen-recording.mp4
context:bytes_unavailable yara-x: no bytes to scan
docs/videos/vscode/hapi/demo-screen-recording.mp4
