Reporting a vulnerability
Email security@mcpvetter.com. Include steps to reproduce. We acknowledge within 3 business days, keep you updated, and credit you in the changelog if you want. Please do not access other users' data or degrade the service while testing.
How the product is built
- Dependencies are pinned.
- API keys, OAuth tokens, session IDs and magic-link tokens are stored only as SHA-256 hashes.
- The remote MCP endpoint returns 401 to unauthenticated requests to trigger standard OAuth discovery.
- Team-admin actions (adding and removing members) are audit-logged.
- Changes to tool behaviour are listed in the public changelog. Silent server-side changes are exactly what the scanner warns about.
The scanner is open source: https://github.com/jaablon/mcpvetter