Is @mcpjam/inspector safe?
1 unfixed advisory Facts from the mcp-audit registry about the npm package @mcpjam/inspector. The same data is served as JSON.
Check it from your terminal
mcp-audit vet @mcpjam/inspectorOffline: it uses the registry bundled with mcp-audit. mcp-audit update-registry fetches the newest one.
Registry facts
| Maintainer | MCPJam |
|---|---|
| Verified publisher | no |
| Entry last checked | 2026-08-22 |
| Hash pins | none recorded |
| Provenance expected | no |
| Repository | https://github.com/MCPJam/inspector |
Recorded advisories 1
| Advisory | CVSS | Summary | Fixed in |
|---|---|---|---|
| CVE-2026-23744 | not recorded | no summary recorded | no fix recorded |
Advisories with no recorded fix are listed first. CVE IDs link to NVD, GHSA IDs to GitHub and other IDs to OSV. A fixed advisory affects only versions below its fix; vet exits 1 only for advisories with no fix.
What it can do
- It can make outbound network requests.
- It can execute shell commands.
Capability tags come from the registry. mcp-audit uses them to find dangerous combinations with your other servers.
Check how you run it
This page describes the public package. What matters is your setup: which version you pin, which secrets you pass, and which other servers sit next to it.
mcp-audit checkBadge for your README
mcp-audit1 unfixed CVE
Preview drawn by this page. The real badge is rendered by shields.io from this JSON and updates when the registry does.
[](https://mcp-audit.dev/servers/npm/at-mcpjam-inspector/)