MCP server

io.github.ysalitrynskyi/opn-mcp

mcp:ysalitrynskyi/opn-mcp

MCP server for opn.onl: shorten links, analytics, branded QR codes, and link management.

awesome-mcp-servers Glama MCP Registry

Verdict

Inconclusive

The analysis could not cover enough of the artifact to decide.

Analyzed Oct 26, 2026, 13:03 UTC at 1c4baa0

findings

—

highest severity

threat classes

files scanned

238/238

checks satisfied

package advisories

Why this verdict

inconclusive: gap no_tools_extracted at package.json

Security findings 0

No individual findings recorded

The inconclusive verdict rests on the coverage gaps below; 1 candidate finding was refuted on review.

Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Supply chain

mediumRefutedlow confidence

The Smithery launch config runs the server via 'npx -y opn-mcp' with no version pin, so whatever the registry currently serves for that package is fetched and executed without confirmation.

smithery.yaml:22

args: ['-y', 'opn-mcp']

Why it was refuted

The unpinned npx call is the openly declared launch command for this server's own package (opn-mcp) in a Smithery config. It is not concealed and does not contradict any claim, and it is the declared core capability of starting the server. The residual unpinned-version risk is generic and low.

Coverage gaps 1

Parts of the artifact the static analysis could not fully examine.

no_tools_extracted MCP server target with no statically extractable tools/prompts/resources

package.json