[mcp-inspector] 🔍 MCP Inspector Report - 2026-09-21

[github-actions[bot]]

Summary

• Servers Inspected: 27 (files in .github/workflows/shared/mcp/)
• Active: 19 · Disabled placeholders: 5 (arxiv, brave, markitdown, notion, semgrep — all removed pending upstream CVE fixes) · Non-MCP helpers: 2 (sentrux CLI, slack safe-output job) · Wrapper: 1 (serena-go)
• By Type: HTTP: 8, Container: 4, Local (command/npx/uvx): 7, Non-MCP/other: 3, Disabled: 5

Inventory Table

Server	Type	Tools	Secrets	Status
agentdb	local	* (wildcard)	–	✅
arxiv	disabled	–	–	⚠️ disabled (CVE #51713)
ast-grep	local	* (wildcard)	–	✅
azure-devops	http	* (wildcard)	ADO_MCP_AUTH_TOKEN	✅
azure	container	6	AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET	✅ least-privilege read-only
brave	disabled	–	BRAVE_API_KEY	⚠️ disabled (CVE #48546)
datadog	http	6	DD_API_KEY, DD_APPLICATION_KEY, DD_APP_KEY, DD_SITE	✅
deepwiki	http	3	–	✅
fabric-rti	local	13	AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET	✅
grafana	container	7	GRAFANA_URL, GRAFANA_SERVICE_ACCOUNT_TOKEN	✅
graft	local	6	–	✅
jupyter	http (docker services)	5	–	✅ ephemeral run_id token
kreuzberg	container	11	–	✅ read-only mount, documented exclusions
markitdown	disabled	–	–	⚠️ disabled (CVE #49515)
mempalace	http (local server)	19	–	⚠️ includes write/delete tools, no rationale comment
microsoftdocs	http	* (wildcard)	–	✅ public docs, documented rationale
notion	disabled	–	NOTION_API_TOKEN	⚠️ disabled (CVE #49517)
ruflo	local	8	–	✅
semgrep	disabled	–	–	⚠️ disabled (CVE #49520)
sentrux	CLI (not MCP)	n/a	–	✅ pinned binary, sha256 verified
sentry	local	16	SENTRY_ACCESS_TOKEN, SENTRY_OPENAI_API_KEY	✅
serena-go	wrapper (imports serena.md)	n/a	–	✅
serena	container	no allowlist	–	⚠️ unrestricted tool access
skillz	container	* (wildcard, dynamic)	–	✅ documented rationale
slack	safe-output job (not MCP)	n/a	SLACK_BOT_TOKEN	✅
svelte	http	5	–	✅
tavily	http	* (wildcard)	TAVILY_API_KEY	✅ documented rationale

Details

agentdb

• File: shared/mcp/agentdb.md
• Type: local (npx)
• Tools: wildcard ["*"]
• Secrets: none
• Notes: Uses cache-memory for persistent AgentDB path per workflow ID.

arxiv / brave / markitdown / notion / semgrep

• Type: disabled (comment-only placeholders)
• Notes: Each has a documented # SECURITY: comment citing an upstream Critical/High CVE issue number and reactivation instructions. Good hygiene — no action needed until upstream ships a patched image.

ast-grep

• File: shared/mcp/ast-grep.md
• Type: local (npx, pinned ast-grep-mcp@0.0.2)
• Tools: wildcard
• Secrets: none

azure-devops

• File: shared/mcp/azure-devops.md
• Type: http (`(mcp.dev.azure.com/redacted)
• Tools: wildcard
• Secrets: ADO_MCP_AUTH_TOKEN
• Notes: Requires organization import input; network restricted to Azure DevOps domains.

azure

• File: shared/mcp/azure.md
• Type: container (mcr.microsoft.com/azure-sdk/azure-mcp, read-only mode)
• Tools: 6 explicit read-only tools (subscription/group/resource list+get)
• Secrets: AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET
• Notes: Has an explicit dated security-decision comment restricting from wildcard to least privilege. Also documents an OIDC alternative via shared/azure-auth.md.

datadog

• File: shared/mcp/datadog.md
• Type: http, required: false
• Tools: 6 (search/get spans, traces, dashboards, SLOs, metrics)
• Secrets: DD_API_KEY, DD_APPLICATION_KEY/DD_APP_KEY fallback, DD_SITE fallback

deepwiki

• File: shared/mcp/deepwiki.md
• Type: http, public, no auth
• Tools: 3 (read_wiki_structure, read_wiki_contents, ask_question)
• Secrets: none

fabric-rti

• File: shared/mcp/fabric-rti.md
• Type: local (uvx microsoft-fabric-rti-mcp)
• Tools: 13 Kusto/eventstream read tools
• Secrets: Azure SP creds (tenant/client/secret)

grafana

• File: shared/mcp/grafana.md
• Type: container (grafana/mcp-grafana:1.1.0-alpine, --disable-write)
• Tools: 7 (datasources, tempo traceql/attributes/docs)
• Secrets: GRAFANA_URL, GRAFANA_SERVICE_ACCOUNT_TOKEN

graft

• File: shared/mcp/graft.md
• Type: local (npx ``@nanonets/graft`` ```@0```.8.0)
• Tools: 6 (ask, skeleton, callers, grep, map, check)
• Secrets: none
• Notes: Builds a context graph via pre-steps before MCP server starts; network restricted to defaults/node.

jupyter

• File: shared/mcp/jupyter.md
• Type: http via docker services: (jupyter + jupyter-mcp sidecar containers)
• Tools: 5 (execute_cell, get_cell_output, create/list notebooks, get_notebook_content)
• Secrets: none (uses github.run_id as an ephemeral Jupyter token)

kreuzberg

• File: shared/mcp/kreuzberg.md
• Type: container (ghcr.io/xberg-io/xberg), workspace mounted read-only
• Tools: 11 explicit read-only tools; write ops (cache_clear, cache_warm) and feature-flagged (extract_structured) explicitly excluded with comments
• Secrets: none

mempalace

• File: shared/mcp/mempalace.md
• Type: http (local server started via pip install + background process on port 8765)
• Tools: 19, including mutation/delete tools (mempalace_add_drawer, mempalace_delete_drawer, mempalace_kg_add, mempalace_kg_invalidate)
• Secrets: none
• Notes: ⚠️ Unlike azure.md/kreuzberg.md/grafana.md, there is no security-decision comment explaining why write/delete tools are included in the allowlist. Data is scoped to workflow cache-memory, which limits blast radius, but documentation would improve auditability.

microsoftdocs

• File: shared/mcp/microsoft-docs.md
• Type: http (https://learn.microsoft.com/api/mcp)
• Tools: wildcard, with a dated comment justifying it (public read-only docs)
• Secrets: none

ruflo

• File: shared/mcp/ruflo.md
• Type: local (npx ruflo@latest)
• Tools: 8 (memory, swarm, agent, task orchestration)
• Secrets: none

sentrux

• File: shared/mcp/sentrux.md
• Type: CLI tool install (not an MCP server) — binary pinned to v0.5.7 with sha256 checksum verification
• Tools: n/a (invoked via bash: sentrux check, sentrux gate)
• Secrets: none

sentry

• File: shared/mcp/sentry.md
• Type: local (npx ``@sentry/mcp-server`` ```@0```.33.0)
• Tools: 16, mostly read-only (whoami, find_, search_, get_*); some depend on optional SENTRY_OPENAI_API_KEY
• Secrets: SENTRY_ACCESS_TOKEN, SENTRY_OPENAI_API_KEY (optional)

serena-go

• File: shared/mcp/serena-go.md
• Type: wrapper — imports serena.md with languages: ["go"] and adds a Go setup step
• Tools/Secrets: inherited from serena.md

serena

• File: shared/mcp/serena.md
• Type: container (ghcr.io/oraios/serena:1.7.0, --network host, workspace mounted read-write)
• Tools: ⚠️ no allowed: field present — all server-exposed tools are available by default, unlike nearly every other config in this directory which defines an explicit allowlist or a documented wildcard rationale.
• Secrets: none
• Notes: Workspace mount is rw (not ro like kreuzberg/skillz), consistent with its purpose as a code-editing LSP tool, but combined with an unrestricted tool list this is a wider blast radius than most peers. Consider adding an explicit allowed: list or a documented security rationale similar to azure.md/microsoft-docs.md/tavily.md.

skillz

• File: shared/mcp/skillz.md
• Type: container, skills mounted read-only from .github/skills/
• Tools: wildcard, with documented rationale (tools are dynamic per discovered skill, same trust level as repo code)
• Secrets: GH_TOKEN/GITHUB_TOKEN (uses github.token, not a repo secret)

slack

• File: shared/mcp/slack.md
• Type: safe-output job (post-to-slack-channel), not an MCP server
• Secrets: SLACK_BOT_TOKEN
• Notes: Supports staged-mode preview; validates message length ≤200 chars.

svelte

• File: shared/mcp/svelte.md
• Type: http, public, no auth
• Tools: 5 (list-sections, get-documentation, svelte-autofixer, playground-link, svelte_definition)
• Secrets: none

tavily

• File: shared/mcp/tavily.md
• Type: http
• Tools: wildcard, with a dated comment explaining the pending inventory follow-up
• Secrets: TAVILY_API_KEY

Recommendations

1. serena.md has no allowed: allowlist at all (unlike every other active server), giving it unrestricted tool access combined with a read-write workspace mount. Add an explicit tool allowlist or a documented security-decision comment justifying full access, matching the pattern used in azure.md, microsoft-docs.md, skillz.md, and tavily.md.
2. mempalace.md exposes mutation/delete tools (mempalace_add_drawer, mempalace_delete_drawer, mempalace_kg_add, mempalace_kg_invalidate) without a documented rationale comment; add one or reassess whether delete/invalidate operations are needed by default.
3. Five servers (arxiv, brave, markitdown, notion, semgrep) remain disabled pending upstream CVE fixes; each has clear reactivation notes — periodically re-check upstream for patched images/digests.
4. sentrux.md and slack.md live under mcp/ but are not MCP servers (a CLI tool install and a safe-output job respectively); this is a minor naming/organizational note, not a defect.

Generated by 🔍 MCP Inspector Agent · copilot · auto · 48.8 AIC · ⌖ 8.09 AIC · ⊞ 9K · ◷

• expires on Sep 22, 2026, 10:55 AM UTC-08:00

[github-actions[bot]]

🐾 Copilot smoke test rolled through your MCP Inspector discussion like a caveman discovering fire! Everything checked out shiny and green. Keep those wildcards tamed, friends. 🔥🤖

Warning

Firewall blocked 7 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• android.clients.google.com
• clients2.google.com
• contentautofill.googleapis.com
• update.googleapis.com
• www.google.com
• www.gstatic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "update.googleapis.com"
    - "www.google.com"
    - "www.gstatic.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · copilot · auto · 56.7 AIC · ⌖ 3.21 AIC · ⊞ 9.9K · ◷
_{Comment /smoke-copilot to run again
Add label smoke to run again}

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-22T18:55:38.651Z.

Closed by Workflow