MCP server

dochost

mcp:zyli5313/dochost-mcp

Publish, list, update and delete shareable Markdown/HTML pages from your AI assistant.

awesome-mcp-servers Glama MCP Registry

Verdict

No issues found

Nothing found that works against the person who installs it.

Analyzed Oct 29, 2026, 13:15 UTC at f52649d

findings

—

highest severity

threat classes

files scanned

53/53

checks satisfied

package advisories

Why this verdict

benign: 53 checks satisfied, nothing works against the installer of mcp-server:. (1 notes, 0 third-party flags)

Security findings 0

No security findings

Nothing found that works against the person who installs it.

Notes 1

Capabilities, vulnerabilities and disclosed behavior worth knowing. Nothing here works against the person who installs it, so notes never change the verdict.

Credential access

mediumNoteConfirmed on reviewmedium confidence

The plugin manifest tells users there are no API keys, while the bundled server reads an optional DOCHOST_API_KEY env var and sends it as a bearer header to the publisher's own dochost.io; this misstates a note-level behavior.

.cursor-plugin/plugin.json:4

OAuth, no API keys.

vector:metadata

Reviewer's reasoning

The manifest's 'no API keys' claim is false, but it misstates an optional bearer key that is sent only to the publisher's own host dochost.io, which issued it. Under the rule that a false claim misstating a note-level behavior stays a note, and since the key goes to the issuing service, this is not credential exfiltration.