[mcp-inspector] 🔍 MCP Inspector Report - 2026-09-14

[github-actions[bot]]

Summary

• Servers Inspected: 27 config files (19 active MCP servers, 5 disabled/removed pending upstream CVE fixes, 3 non-MCP configs)
• By Type (active servers): HTTP: 8, Container: 5, Local (stdio): 6

Inventory Table

Server	Type	Tools	Secrets	Status
agentdb	Local (npx)	* (wildcard)	N	✅
arxiv	—	3 (disabled)	N/A	⚠️ removed (CVE)
ast-grep	Local (npx)	* (wildcard)	N	✅
azure-devops	HTTP	* (wildcard)	Y (ADO_MCP_AUTH_TOKEN)	✅
azure	Container	7 (restricted)	Y (AZURE_TENANT_ID/CLIENT_ID/CLIENT_SECRET)	✅
brave	—	2 (disabled)	N/A	⚠️ removed (CVE)
datadog	HTTP	6	Y (DD_API_KEY, DD_APPLICATION_KEY/DD_APP_KEY; DD_SITE optional)	✅
deepwiki	HTTP	3	N	✅
fabric-rti	Local (uvx)	14	Y (AZURE_TENANT_ID/CLIENT_ID/CLIENT_SECRET)	✅
grafana	Container	7 (read-only)	Y (GRAFANA_URL, GRAFANA_SERVICE_ACCOUNT_TOKEN)	✅
graft	Local (npx)	6	N	✅
jupyter	HTTP (docker services)	5	N (JUPYTER_TOKEN = github.run_id)	✅
kreuzberg	Container	10 (read-only)	N	✅
markitdown	—	1 (disabled)	N/A	⚠️ removed (CVE)
mempalace	HTTP (self-hosted local)	19	N	✅
microsoft-docs	HTTP	* (wildcard)	N	✅
notion	—	4 (disabled)	N/A	⚠️ removed (CVE)
ruflo	Local (npx)	8	N	✅
semgrep	—	6 (disabled)	N/A	⚠️ removed (CVE)
sentrux	N/A (CLI binary, not MCP)	N/A	N	i️ non-MCP
sentry	Local (npx)	16	Y (SENTRY_ACCESS_TOKEN required; SENTRY_HOST, SENTRY_OPENAI_API_KEY optional)	✅
serena-go	Wrapper (imports serena.md, languages=[go])	inherits serena	N	✅
serena	Container	dynamic (LSP-based, no static list)	N	✅
skillz	Container	* (wildcard, dynamic per-skill)	N (uses github.token)	✅
slack	N/A (safe-outputs job, not MCP)	N/A	Y (SLACK_BOT_TOKEN) + GH_AW_SLACK_CHANNEL_ID var	i️ non-MCP
svelte	HTTP	5	N	✅
tavily	HTTP	* (wildcard)	Y (TAVILY_API_KEY)	✅

Details

agentdb

• File: shared/mcp/agentdb.md
• Type: Local (npx stdio)
• Tools: allowed: ["*"]
• Secrets: None (uses cache-memory path only)
• Notes: Backs discussions with AgentDB persisted under cache-memory key per workflow ID.

arxiv (disabled)

• File: shared/mcp/arxiv.md
• Type: Was container; block removed
• Tools: search_arxiv, get_paper_details, get_paper_pdf (inactive)
• Secrets: N/A
• Notes: Removed due to Critical/High CVEs in docker.io/mcp/arxiv-mcp-server (issue [container-image-scan] Container findings for mcp/arxiv-mcp-server #51713), no upstream fix yet.

ast-grep

• File: shared/mcp/ast-grep.md
• Type: Local (npx stdio)
• Tools: allowed: ["*"]
• Secrets: None
• Notes: Structural code search server, minimal config.

azure-devops

• File: shared/mcp/azure-devops.md
• Type: HTTP (remote, org-specific URL via import-schema)
• Tools: allowed: ["*"]
• Secrets: ADO_MCP_AUTH_TOKEN
• Notes: Requires organization import input; network allowlist scoped to Azure DevOps/VSTS/Microsoft Online domains.

azure

• File: shared/mcp/azure.md
• Type: Container (mcr.microsoft.com/azure-sdk/azure-mcp)
• Tools: 7 read-only discovery tools (subscription_list/get, group_list/get, resource_list/get)
• Secrets: AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET
• Notes: Documented 2026-05-19 security decision restricting from wildcard to read-only tool allowlist.

datadog

• File: shared/mcp/datadog.md
• Type: HTTP (required: false)
• Tools: 6 (search/get spans, trace, dashboards, SLOs, metrics)
• Secrets: DD_API_KEY, DD_APPLICATION_KEY (or DD_APP_KEY fallback); DD_SITE optional, defaults to datadoghq.com
• Notes: Marked optional (required: false), safe to run without secrets configured (server won't start).

deepwiki

• File: shared/mcp/deepwiki.md
• Type: HTTP (public, required: false)
• Tools: read_wiki_structure, read_wiki_contents, ask_question
• Secrets: None
• Notes: No auth required, public documentation service.

fabric-rti

• File: shared/mcp/fabric-rti.md
• Type: Local (uvx)
• Tools: 14 Kusto/Eventstream tools
• Secrets: AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET
• Notes: Microsoft Fabric Real-Time Intelligence Kusto/Eventstream access.

grafana

• File: shared/mcp/grafana.md
• Type: Container (grafana/mcp-grafana:1.1.0-alpine, --disable-write)
• Tools: 7 (datasources, Tempo tracing tools)
• Secrets: GRAFANA_URL, GRAFANA_SERVICE_ACCOUNT_TOKEN
• Notes: Pinned image tag; write disabled at entrypoint level as defense-in-depth.

graft

• File: shared/mcp/graft.md
• Type: Local (npx, pinned @0.8.0)
• Tools: graft_ask, graft_skeleton, graft_callers, graft_grep, graft_map, graft_check
• Secrets: None
• Notes: Builds a context graph of the workspace before serving; scoped network allowlist (defaults, node).

jupyter

• File: shared/mcp/jupyter.md
• Type: HTTP (docker-compose services, not mcp-servers.command)
• Tools: execute_cell, get_cell_output, create_notebook, list_notebooks, get_notebook_content
• Secrets: None (JUPYTER_TOKEN derived from github.run_id, ephemeral not a stored secret)
• Notes: Two-service compose (jupyter + jupyter-mcp) with health checks; restricted from full tool surface per 2026-05-19 decision comment.

kreuzberg

• File: shared/mcp/kreuzberg.md
• Type: Container (ghcr.io/xberg-io/xberg)
• Tools: 10 read-only (extract/detect/embed/chunk/cache-inspect); write ops (cache_clear, cache_warm) explicitly excluded
• Secrets: None
• Notes: Workspace mounted read-only; document intelligence/extraction engine.

markitdown (disabled)

• File: shared/mcp/markitdown.md
• Type: Was container; block removed
• Tools: convert_to_markdown (inactive)
• Secrets: N/A
• Notes: Removed due to CVEs in docker.io/mcp/markitdown (issue [container-image-scan] Container findings for mcp/markitdown #49515).

mempalace

• File: shared/mcp/mempalace.md
• Type: HTTP (self-hosted local server started via workflow steps, host.docker.internal:8765)
• Tools: 19 (status, wings/rooms, taxonomy, search, dedup, drawers, knowledge-graph ops, traversal, diary)
• Secrets: None
• Notes: Requires pip install mempalace==3.2.0 step; persists via cache-memory palace dir.

microsoft-docs

• File: shared/mcp/microsoft-docs.md
• Type: HTTP
• Tools: allowed: ["*"]
• Secrets: None
• Notes: Documented 2026-05-19 decision to keep wildcard for this read-only public docs service.

notion (disabled)

• File: shared/mcp/notion.md
• Type: Was container; block removed
• Tools: search_pages, get_page, get_database, query_database (inactive)
• Secrets: N/A (would need NOTION_API_TOKEN)
• Notes: Removed due to CVEs in docker.io/mcp/notion (issue [container-image-scan] Container findings for mcp/notion #49517).

ruflo

• File: shared/mcp/ruflo.md
• Type: Local (npx, stdio)
• Tools: memory_search/store, swarm_init/status, agent_spawn/list, task_orchestrate/status (8)
• Secrets: None
• Notes: Multi-agent orchestration wrapper.

semgrep (disabled)

• File: shared/mcp/semgrep.md
• Type: Was container; block removed
• Tools: 6 (scan/rule tools, inactive)
• Secrets: N/A
• Notes: Removed due to CVEs in semgrep/semgrep (issue [container-image-scan] Container findings for semgrep/semgrep:latest #49520).

sentrux

• File: shared/mcp/sentrux.md
• Type: Not an MCP server — installs a pinned CLI binary (v0.5.7, sha256-verified) for direct bash invocation
• Tools: N/A (CLI commands: check, gate, gate --save, --version)
• Secrets: None
• Notes: No mcp-servers block; purely a steps-based tool install.

sentry

• File: shared/mcp/sentry.md
• Type: Local (npx, @sentry/mcp-server@0.33.0)
• Tools: 16 (whoami, org/team/project/release lookups, issue/trace details, search_events/issues, list_events fallbacks, dsns, seer analysis, docs search)
• Secrets: SENTRY_ACCESS_TOKEN (required); SENTRY_HOST optional (default sentry.io); SENTRY_OPENAI_API_KEY optional (enables search_docs)
• Notes: Matches Sentry MCP guidance elsewhere in this workflow's instructions.

serena-go

• File: shared/mcp/serena-go.md
• Type: Wrapper — imports serena.md with languages: ["go"]; adds pre-agent-steps to set up Go toolchain
• Tools: Inherits from serena.md
• Secrets: None
• Notes: No own mcp-servers block; convenience preset for Go-only LSP analysis.

serena

• File: shared/mcp/serena.md
• Type: Container (ghcr.io/oraios/serena:1.7.0, host network, rw workspace mount)
• Tools: Dynamic — no static allowed list found; LSP-derived tool surface depends on configured languages
• Secrets: None
• Notes: Parameterized via import-schema.languages (array, required); mounts workspace read-write and tool cache read-only.

skillz

• File: shared/mcp/skillz.md
• Type: Container (intellectronica/skillz)
• Tools: allowed: ["*"] (dynamic, one tool per discovered .github/skills/*/SKILL.md)
• Secrets: None (uses github.token, not a repo secret)
• Notes: Documented 2026-05-19 decision to keep wildcard since tool set is dynamic per repository skill set; skills mounted read-only.

slack

• File: shared/mcp/slack.md
• Type: Not an MCP server — defines a safe-outputs.jobs.post-to-slack-channel safe-job
• Tools: N/A (safe-output type post_to_slack_channel, 200-char message limit)
• Secrets: SLACK_BOT_TOKEN; also requires GH_AW_SLACK_CHANNEL_ID env/repo variable
• Notes: Supports staged-mode preview via step summary instead of live posting.

svelte

• File: shared/mcp/svelte.md
• Type: HTTP (public)
• Tools: list-sections, get-documentation, svelte-autofixer, playground-link, svelte_definition
• Secrets: None
• Notes: No auth required.

tavily

• File: shared/mcp/tavily.md
• Type: HTTP
• Tools: allowed: ["*"]
• Secrets: TAVILY_API_KEY
• Notes: Documented 2026-05-19 decision to keep wildcard pending follow-up inventory of Tavily tool variants; multiple production workflows depend on broad access.

Recommendations

1. Tavily wildcard follow-up: The 2026-05-19 comment flags a pending inventory of Tavily tool variants before scoping down from allowed: ["*"] — this should be tracked to closure.
2. Disabled servers (arxiv, brave, markitdown, notion, semgrep): All five remain blocked on unpatched upstream CVEs in their Docker images; periodically re-check for patched image releases so these can be restored.
3. serena.md has no static tool allowlist: Unlike other MCP configs, serena (and by extension serena-go) does not scope allowed tools explicitly — consider documenting why (LSP surface is dynamic) or adding an explicit allowlist for consistency with the rest of the shared configs.
4. sentrux and slack are not true MCP servers but live in the shared/mcp/ directory — consider a naming/documentation convention (e.g., a shared/tools/ or shared/jobs/ directory) so future audits don't need to special-case them.
5. Secret hygiene is generally good: all servers needing credentials source them from secrets.* (or github.token) rather than hardcoding; no issues found there.

Generated by 🔍 MCP Inspector Agent · copilot · auto · 30.6 AIC · ⌖ 7.07 AIC · ⊞ 9.4K · ◷

• expires on Sep 15, 2026, 10:54 AM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-15T18:54:48.494Z.

Closed by Workflow