Sample report
A client report, built from the public GitHub audit
Impact, reproduction, control, refuter result, confidence and a suggested fix for each finding.
Proof
Track record: public audits and what was filed upstream
Four public audits of vendors’ MCP servers, and every issue and pull request filed from them, with status as of 12 November 2026.
Upstream record.
Not counted above: 10 fix PRs by other contributors for issues we filed (drafts not counted).
An open issue is a report, not a confirmed vulnerability, until the maintainers say so.
Public audits
Outside audits of open-source MCP servers, on throwaway organizations, local instances and test accounts. Research, not client engagements.
| Server audited | Published | Upstream record | Write-up |
|---|---|---|---|
| GitHub github/github-mcp-server v2.1.0 | 1 open pull request; 11 issues filed; 10 fix PRs by other contributors: GitHub records | GitHub audit | |
| Grafana grafana/mcp-grafana v2.2.0 | 4 open pull requests: Grafana records | Grafana audit | |
| PostHog PostHog MCP server | 1 pull request merged (co-authored); 3 pull requests approved, awaiting merge: PostHog records | PostHog audit | |
| Kubernetes containers/kubernetes-mcp-server v0.1.2 | 10 open pull requests; 15 issues filed: Kubernetes records | Kubernetes audit |
Every issue and pull request
Each record links to the project’s own tracker. The finding IDs refer to the register in each audit.
Note:
When a fix ships in a project’s release, every team that upgrades to that release gets it.
Maintainers are not obligated to review, accept or merge our submissions. We record their responses and correct our articles when we are wrong.
GitHub MCP server
github/github-mcp-server (opens in new tab)
| Record | Title and note | Status | Opened | Merged or closed |
|---|---|---|---|---|
| Issue #3751 (opens in new tab) | issue_write update loses concurrent issue field changes (read-merge-PATCH with no precondition)Findings: GH-01 | Status: Open | Not merged or closed | |
| PR #3781 (opens in new tab) | Stop issue_write field updates reverting concurrent changesfix for issue #3751Findings: GH-01 | Status: Open | Not merged or closed | |
| Issue #3757 (opens in new tab) | delete_file: no sha precondition, and a directory path deletes the whole subtreeFindings: GH-02, GH-03 | Status: Open | Not merged or closed | |
| Issue #3755 (opens in new tab) | push_files leaves an orphan branch at the default branch's head when the push failsFindings: GH-04 | Status: Open | Not merged or closed | |
| Issue #3756 (opens in new tab) | create_pull_request / update_pull_request return an error after the PR was created or edited (reviewer step fails)Findings: GH-05 | Status: Open | Not merged or closed | |
| Issue #3759 (opens in new tab) | Silent no-op writes: issue_write skips empty title/body, and unknown parameters are droppedFindings: GH-06 | Status: Open | Not merged or closed | |
| Issue #3760 (opens in new tab) | update_issue_labels is annotated destructiveHint: false but replaces (removes) existing labelsFindings: GH-07 | Status: Open | Not merged or closed | |
| Issue #3747 (opens in new tab) | GITHUB_READ_ONLY=yes (or on) silently leaves read-only mode offFindings: GH-08 | Status: Open | Not merged or closed | |
| Issue #3748 (opens in new tab) | get_file_contents directory listings put tokenised private-repo download URLs in model contextFindings: GH-09 | Status: Open | Not merged or closed | |
| Issue #3761 (opens in new tab) | Config typos are handled inconsistently: a misspelled --exclude-tools or --features entry is silently ignoredFindings: GH-10 | Status: Open | Not merged or closed | |
| Issue #3763 (opens in new tab) | Protocol-gated tools (delete_repository) are listed based on the client's requested protocolVersion string, not the negotiated versionFindings: GH-11 | Status: Open | Not merged or closed | |
| Issue #3762 (opens in new tab) | Advertised page/perPage bounds are not enforced in list_commits, get_commit, actions_list and list_gists, and -2^63 returns a raw Go decode errorFindings: GH-12, GH-13 | Status: Open | Not merged or closed | |
| PR #3750 (opens in new tab)another contributor’s fix | Reject invalid boolean values for GITHUB_READ_ONLY and other bool env varsFixes issue #3747 | Status: Open | Not merged or closed | |
| PR #3801 (opens in new tab)another contributor’s fix | fix: fail closed on invalid boolean env settings and support yes/no/on/offFixes issue #3747 | Status: Open | Not merged or closed | |
| PR #3778 (opens in new tab)another contributor’s fix | Fix #3755: avoid creating orphan branch when push_files failsFixes issue #3755 | Status: Open | Not merged or closed | |
| PR #3784 (opens in new tab)another contributor’s fix | Report the created or updated pull request when a later step failsFixes issue #3756 | Status: Open | Not merged or closed | |
| PR #3790 (opens in new tab)another contributor’s fix | fix: reject directory paths and stale shas in delete_fileFixes issue #3757 | Status: Open | Not merged or closed | |
| PR #3789 (opens in new tab)another contributor’s fix | fix: treat empty title and body as explicit input in issue_writeFixes issue #3759 | Status: Open | Not merged or closed | |
| PR #3791 (opens in new tab)another contributor’s fix | fix: mark the granular label/assignee replace tools as destructiveFixes issue #3760 | Status: Open | Not merged or closed | |
| PR #3800 (opens in new tab)another contributor’s fix | fix(issues): annotate update_issue_labels and update_issue_assignees as destructive (#3760)Fixes issue #3760 | Status: Open | Not merged or closed | |
| PR #3771 (opens in new tab)another contributor’s fix | fix: warn on unrecognized --exclude-tools and --features namesFixes issue #3761 | Status: Open | Not merged or closed | |
| PR #3785 (opens in new tab)another contributor’s fix | fix(normalizer): validate numeric float64 inputs in typed read normalizer (#3762)Fixes issue #3762 | Status: Open | Not merged or closed | |
| PR #3795 (opens in new tab)another contributor’s fix | fix: gate tool availability on the negotiated protocol versionFixes issue #3763 | Status: Draft | Not merged or closed |
Grafana MCP server
grafana/mcp-grafana (opens in new tab)
| Record | Title and note | Status | Opened | Merged or closed |
|---|---|---|---|---|
| PR #1518 (opens in new tab) | fix(dashboard): prevent silent lost updates on dashboard saves (GF-01/GF-19)Findings: GF-01, GF-19 | Status: Open | Not merged or closed | |
| PR #1519 (opens in new tab) | feat(alerting): enrich rule list and make rule updates partial (GF-03)Findings: GF-03, A1, A3, A4 | Status: Open | Not merged or closed | |
| PR #1520 (opens in new tab) | feat: write tools echo their result to remove verify readsFindings: B1, B2, D1 | Status: Open | Not merged or closed | |
| PR #1521 (opens in new tab) | fix(dashboard): stricter patch paths, id/title selectors, schema-bound validation (GF-08/GF-02/GF-18)Findings: GF-02, GF-08, GF-18 | Status: Open | Not merged or closed |
PostHog MCP server
PostHog/posthog (opens in new tab)
| Record | Title and note | Status | Opened | Merged or closed |
|---|---|---|---|---|
| PR #131620 (opens in new tab)co-authored | fix(insights): stop concurrent patches reverting other fieldsmaintainer PR, IsoKron co-authorFindings: C1 | Status: Merged | ||
| PR #131514 (opens in new tab) | fix(mcp): stop coercing booleans and nullable integers in tool schemasFindings: X1 | Status: Approved, awaiting merge | Not merged or closed | |
| PR #132356 (opens in new tab) | fix(mcp): accept real comment ids in tasks-comments-retrieveFindings: V1 | Status: Approved, awaiting merge | Not merged or closed | |
| PR #132357 (opens in new tab) | fix(mcp): keep the next-page hint on exec text resultsFindings: V6 | Status: Approved, awaiting merge | Not merged or closed |
Closed and superseded (1)
| Record | Title and note | Status | Opened | Merged or closed |
|---|---|---|---|---|
| PR #131519 (opens in new tab) | fix(insights): stop concurrent patches reverting other fieldsFindings: C1 | Status: Closed; the fix landed in #131620 |
Kubernetes MCP server
containers/kubernetes-mcp-server (opens in new tab)
| Record | Title and note | Status | Opened | Merged or closed |
|---|---|---|---|---|
| Issue #1658 (opens in new tab) | helm_install creates the chart's objects in the kubeconfig namespace, not the namespace argumentFindings: K8S-20 | Status: Open | Not merged or closed | |
| Issue #1659 (opens in new tab) | resources_create_or_update mis-splits multi-document YAML: --- and --- # comment drop later documents, a trailing --- fails with "EOF"Findings: K8S-06, K8S-15 | Status: Open | Not merged or closed | |
| Issue #1660 (opens in new tab) | resources_create_or_update stops at the first refused document and does not say which documents were already appliedFindings: K8S-01 | Status: Open | Not merged or closed | |
| Issue #1661 (opens in new tab) | vm_create: workload is rendered into the VM template unescaped, so a value with a newline and --- applies extra documentsFindings: K8S-25 | Status: Open | Not merged or closed | |
| Issue #1662 (opens in new tab) | pods_run is annotated non-destructive but force-applies over an existing Service of the same nameFindings: K8S-02 | Status: Open | Not merged or closed | |
| Issue #1663 (opens in new tab) | vm_create on an existing VM name overwrites the VM and answers "VirtualMachine created successfully"Findings: K8S-08 | Status: Open | Not merged or closed | |
| Issue #1664 (opens in new tab) | pods_exec drops the command's stdout and stderr when it exits non-zeroFindings: K8S-19 | Status: Open | Not merged or closed | |
| Issue #1665 (opens in new tab) | pods_delete reports success when deleting the pods_run Service fails, and deletes the Service before the PodFindings: K8S-03 | Status: Open | Not merged or closed | |
| Issue #1666 (opens in new tab) | helm_uninstall answers "Release X not found" (success) when the release lookup is refused by RBACFindings: K8S-17N | Status: Open | Not merged or closed | |
| Issue #1667 (opens in new tab) | pods_run: a negative port silently skips the Service, and ports of 2^31 and above wrap aroundFindings: K8S-11 | Status: Open | Not merged or closed | |
| Issue #1668 (opens in new tab) | config: misspelt names in enabled_tools / disabled_tools (and opt_in_tools) are accepted silentlyFindings: K8S-14 | Status: Open | Not merged or closed | |
| Issue #1669 (opens in new tab) | Write tools return metadata.managedFields in their results, while reads strip itFindings: K8S-07 | Status: Open | Not merged or closed | |
| Issue #1670 (opens in new tab) | vm_clone is annotated idempotentHint: true, but every call creates a new VirtualMachineCloneFindings: K8S-12 | Status: Open | Not merged or closed | |
| Issue #1671 (opens in new tab) | Namespaced list tools make a SelfSubjectAccessReview even when a namespace is givenFindings: K8S-23 | Status: Open | Not merged or closed | |
| Issue #1672 (opens in new tab) | events_list prints timestamps with Go's time.String() in the server's local time zone instead of RFC 3339 UTCFindings: K8S-24 | Status: Open | Not merged or closed | |
| Issue #1584 (opens in new tab)our comment | Integer tool arguments silently truncate fractional values (gracePeriodSeconds 0.5 becomes an immediate delete)Findings: K8S-09 | Status: Open | Not merged or closed | |
| PR #1675 (opens in new tab) | fix(helm): create chart objects in the namespace argumentFindings: K8S-20 | Status: Open | Not merged or closed | |
| PR #1676 (opens in new tab) | fix(core): split multi-document manifests like kubectl's YAML readerFindings: K8S-06, K8S-15 | Status: Open | Not merged or closed | |
| PR #1677 (opens in new tab) | fix(core): return pods_exec output when the command exits non-zeroFindings: K8S-19 | Status: Open | Not merged or closed | |
| PR #1678 (opens in new tab) | fix(core): report pods_delete clean-up failures, delete the Pod firstFindings: K8S-03 | Status: Open | Not merged or closed | |
| PR #1679 (opens in new tab) | fix(helm): do not report a refused release lookup as "not found"Findings: K8S-17N | Status: Open | Not merged or closed | |
| PR #1680 (opens in new tab) | fix(core): reject pods_run ports outside 1-65535Findings: K8S-11 | Status: Open | Not merged or closed | |
| PR #1681 (opens in new tab) | fix(output): omit managedFields from write resultsFindings: K8S-07 | Status: Open | Not merged or closed | |
| PR #1682 (opens in new tab) | fix(kubevirt): do not annotate vm_clone as idempotentFindings: K8S-12 | Status: Open | Not merged or closed | |
| PR #1683 (opens in new tab) | fix(core): skip the SelfSubjectAccessReview when a namespace is givenFindings: K8S-23 | Status: Open | Not merged or closed | |
| PR #1684 (opens in new tab) | fix(core): format events_list timestamps as RFC 3339 in UTCFindings: K8S-24 | Status: Open | Not merged or closed |
Specification
modelcontextprotocol/experimental-ext-tool-annotations (opens in new tab)
| Record | Title and note | Status | Opened | Merged or closed |
|---|---|---|---|---|
| Issue #10 (opens in new tab) | Field data on tool annotation accuracy from an audit of a 91-tool MCP server | Status: Open | Not merged or closed |
What goes to a public issue and what goes through a private channel follows the disclosure policy.
Check the work yourself
Evidence Pack
Verify the results on your own machine
An Evidence Pack is the signed, timestamped record of an audit. One command checks it locally.
Open-source tools
CLI and GitHub Action
mcp-catalog-snap
Snapshots an MCP server’s tools/list as canonical JSON and fails CI when it drifts. We pin a snapshot in every audit.
MCP server
kronicle-lite
A local, hash-chained document store for agents, with signed retrieval receipts and a call that reports what changed since the agent last looked.
MCP server
sea-lite
A fenced work queue for parallel coding agents: leased claims, typed links and all-or-nothing batch writes.
Claude Code plugin
cc-anchor
Re-injects a short anchor card (goal, invariants, recent steps) after Claude Code compacts its context.
Request an audit or a build
Tell us which server and what you need. We reply to confirm the scope, the price and the dates.