[mcp-inspector] MCP Inspector Report - 2026-09-28

[github-actions[bot]]

🔍 MCP Inspector Report - 2026-09-28

Summary

• Servers Inspected: 27 files (20 active MCP/config, 5 disabled, 2 non-server helpers)
• By Type: HTTP: 7, Container: 5, Local (command): 6, Other: 4

Inventory Table

Server	Type	Secrets	Status
agentdb	local (npx)	N	✅
ast-grep	local (npx)	N	✅
azure-devops	http	Y (ADO_MCP_AUTH_TOKEN)	✅
azure	container (:latest in docs)	Y (tenant/client id/secret)	⚠️
datadog	http	Y (DD_API_KEY, DD_APPLICATION_KEY)	✅
deepwiki	http (SSE)	N	✅
fabric-rti	local (uvx)	Y (Azure creds)	✅
grafana	container (pinned 1.1.0)	Y (GRAFANA_URL, token)	✅
graft	local (npx)	N	✅
jupyter	services + http	N (run_id token)	⚠️ :latest images
kreuzberg	container	N	⚠️ no pinned tag
mempalace	http (host.docker.internal)	N	✅
microsoftdocs	http	N	✅
ruflo	local (npx)	N	✅
sentry	local (npx)	Y (SENTRY_ACCESS_TOKEN)	✅
serena / serena-go	container (pinned 1.7.0)	N	✅
skillz	container	N (github.token)	✅
svelte	http	N	✅
tavily	http	Y (TAVILY_API_KEY)	✅
slack	safe-job	Y (SLACK_BOT_TOKEN)	✅
sentrux	steps only	N	✅
arxiv, brave, markitdown, notion, semgrep	disabled	–	❌ removed due to Critical/High CVEs

Recommendations

1. Pin jupyter/base-notebook, datalayer/jupyter-mcp-server, and azure-mcp to versions/digests rather than :latest.
2. Pin kreuzberg (ghcr.io/xberg-io/xberg) to a tag/digest.
3. Track upstream fixes for the 5 disabled servers ([container-image-scan] Container findings for mcp/arxiv-mcp-server #51713, [container-image-scan] Container findings for docker.io/mcp/brave-search #48546, [container-image-scan] Container findings for mcp/markitdown #49515, [container-image-scan] Container findings for mcp/notion #49517, [container-image-scan] Container findings for semgrep/semgrep:latest #49520).
4. Several npx/uvx servers should specify pinned package versions.

Generated by 🔍 MCP Inspector Agent · copilot · auto · 11.1 AIC · ⌖ 9.36 AIC · ⊞ 8.9K · ◷

• expires on Sep 29, 2026, 10:59 AM UTC-08:00

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-09-29T18:59:44.501Z.

Closed by Workflow