registry / @mastra/mcp-docs-server / 1.2.9

@mastra/mcp-docs-server@1.2.9

MCP server for accessing Mastra.ai documentation, changelogs, and news.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No confirmed malicious attack surface. The optional course feature makes package-aligned requests only after MCP tool invocation and explicit registration.

Static reason

No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

User runs the CLI and invokes course tools; registration requires an email argument.

Impact

Stores course credentials/state under the Mastra cache and synchronizes opted-in course progress.

Mechanism

MCP documentation server with optional course-state persistence

Rationale

Direct source inspection shows an explicitly invoked documentation MCP server and opt-in course registration, not stealthy execution or exfiltration. Static fingerprint/network hints do not establish malicious behavior.

Evidence

package.jsondist/stdio.jsdist/chunk-HGADBLKG.js~/.cache/mastra/.device_id~/.cache/mastra/course/state.json~/.cache/mastra/mcp-docs-server-logs

Network endpoints2

mastra.ai/api/course/registermastra.ai/api/course/update

Decision evidence

public snapshot

@mastra/mcp-docs-server@1.2.9

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code