{
 "schema_version": "1.0.0",
 "generated_at": "2026-10-13T14:32:44+00:00",
 "package": {
  "ecosystem": "npm",
  "name": "mcp-remote"
 },
 "registry": {
  "listed": true,
  "verified": false,
  "maintainer": "punkpeye (from 0.2.5, 2026-08-26; earlier releases geelen/mcp-remote)",
  "entry_updated": "2026-10-13",
  "registry_updated": "2026-10-13"
 },
 "known_vulnerabilities": [
  {
   "cve": "CVE-2026-51994",
   "cvss": null,
   "description": "SSRF via the resource_metadata URL in a remote server's WWW-Authenticate header (0.1.32\u20130.1.38; first unaffected release 0.1.39).",
   "fixed_in": "0.1.39",
   "source": "NVD",
   "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-51994"
  },
  {
   "cve": "CVE-2026-51995",
   "cvss": null,
   "description": "Information disclosure through authorization-server metadata handling (0.1.32\u20130.1.38; first unaffected release 0.1.39).",
   "fixed_in": "0.1.39",
   "source": "NVD",
   "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-51995"
  },
  {
   "cve": "CVE-2026-51996",
   "cvss": null,
   "description": "Remote code execution through getServerUrlHash in src/lib/utils.ts (0.1.16\u20130.1.38; first unaffected release 0.1.39).",
   "fixed_in": "0.1.39",
   "source": "NVD",
   "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-51996"
  },
  {
   "cve": "CVE-2026-51997",
   "cvss": null,
   "description": "Remote code execution through open() handling (0.1.16\u20130.1.38; first unaffected release 0.1.39).",
   "fixed_in": "0.1.39",
   "source": "NVD",
   "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-51997"
  },
  {
   "cve": "CVE-2026-52001",
   "cvss": null,
   "description": "Information disclosure through the SSE transport's eventSourceInit fetch wrapper (0.1.18\u20130.1.38; first unaffected release 0.1.39).",
   "fixed_in": "0.1.39",
   "source": "NVD",
   "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-52001"
  },
  {
   "cve": "CVE-2026-108716",
   "cvss": null,
   "description": "Cleartext transmission in 0.8.0 through 0.14.3; no patched version recorded (GHSA-jrvg-vw6c-rp59).",
   "fixed_in": null,
   "source": "NVD",
   "link": "https://nvd.nist.gov/vuln/detail/CVE-2026-108716"
  },
  {
   "cve": "CVE-2025-6514",
   "cvss": null,
   "description": "mcp-remote exposed to OS command injection via untrusted MCP server connections",
   "fixed_in": "0.1.16",
   "source": "NVD",
   "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-6514"
  }
 ],
 "capabilities": [
  "network_out"
 ],
 "attestation": {
  "hash_pins_available": false,
  "attestation_expected": false
 },
 "typosquat_of": null,
 "tags": [
  "proxy",
  "remote",
  "oauth"
 ],
 "links": {
  "repo": "https://github.com/punkpeye/mcp-remote",
  "verdict_page": "https://mcp-audit.dev/servers/npm/mcp-remote/"
 }
}