[mcp-inspector] 🔍 MCP Inspector Report - 2026-08-31

[github-actions[bot]]

Summary

• Files Inspected: 27 (.github/workflows/shared/mcp/*.md)
• Active MCP Servers: 19
• Disabled (CVE): 5 (arxiv, brave, markitdown, notion, semgrep)
• Non-MCP Wrapper Files: 3 (sentrux, serena-go, slack)
• By Type: HTTP: 8, Container: 5, Local (stdio): 6

Inventory Table

Server	Type	Tools	Secrets	Status
agentdb	local	*	No	✅
arxiv	disabled	3 (docs only)	No	⚠️ CVE #51713
ast-grep	local	*	No	✅
azure-devops	http	*	Yes (ADO_MCP_AUTH_TOKEN)	✅
azure	container	7	Yes (3 Azure secrets)	✅
brave	disabled	2 (docs only)	No	⚠️ CVE #48546
datadog	http	6	Yes (DD_API_KEY, DD_APPLICATION_KEY, DD_SITE)	✅
deepwiki	http	3	No	✅
fabric-rti	local	12	Yes (3 Azure secrets)	✅
grafana	container	7	Yes (GRAFANA_URL, GRAFANA_SERVICE_ACCOUNT_TOKEN)	✅
graft	local	6	No	✅
jupyter	http (services)	5	No	✅
kreuzberg	container	9	No	✅
markitdown	disabled	1 (docs only)	No	⚠️ CVE #49515
mempalace	http (self-hosted)	18	No	✅
microsoftdocs	http	*	No	✅
notion	disabled	4 (docs only)	No	⚠️ CVE #49517
ruflo	local	8	No	✅
semgrep	disabled	6 (docs only)	No	⚠️ CVE #49520
sentrux	non-mcp	n/a	No	i️ CLI installer, not an MCP server
sentry	local	15	Yes (SENTRY_ACCESS_TOKEN, optional SENTRY_OPENAI_API_KEY)	✅
serena-go	non-mcp	n/a	No	i️ wrapper importing serena.md
serena	container	LSP tools	No	✅ (rw workspace mount)
skillz	container	* (dynamic)	github.token	✅
slack	non-mcp	n/a	Yes (SLACK_BOT_TOKEN)	i️ safe-output job, not MCP
svelte	http	5	No	✅
tavily	http	*	Yes (TAVILY_API_KEY)	⚠️ wildcard pending tool inventory

Details

agentdb

• File: shared/mcp/agentdb.md
• Type: local (npx agentdb@alpha mcp start)
• Tools: allowed: ["*"]
• Secrets: none; uses cache-memory path for storage
• Notes: Persists data under /tmp/gh-aw/cache-memory/agentdb-<workflow-id>/discussions.rvf

arxiv (disabled)

• File: shared/mcp/arxiv.md
• Type: n/a — container removed
• Notes: Docker image docker.io/mcp/arxiv-mcp-server has unpatched Critical/High CVEs (issue [container-image-scan] Container findings for mcp/arxiv-mcp-server #51713). Re-enable path documented in file comments.

ast-grep

• File: shared/mcp/ast-grep.md
• Type: local (npx ast-grep-mcp@0.0.2)
• Tools: wildcard
• Notes: Minimal config, no secrets.

azure-devops

• File: shared/mcp/azure-devops.md
• Type: http, parameterized by organization import input
• Secrets: ADO_MCP_AUTH_TOKEN
• Notes: Network allowlist restricted to Azure DevOps/Visual Studio/Microsoft online domains.

azure

• File: shared/mcp/azure.md
• Type: container mcr.microsoft.com/azure-sdk/azure-mcp:latest
• Tools: 7 explicitly allowed read-only tools (subscription/group/resource list & get)
• Secrets: AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET
• Notes: Documented 2026-05-19 security decision restricting wildcard to reduce blast radius.

brave (disabled)

• File: shared/mcp/brave.md
• Notes: Removed due to CVEs in docker.io/mcp/brave-search (issue [container-image-scan] Container findings for docker.io/mcp/brave-search #48546). Requires BRAVE_API_KEY if re-enabled.

datadog

• File: shared/mcp/datadog.md
• Type: http, required: false
• Tools: 6 span/trace/dashboard/SLO/metric search tools
• Secrets: DD_API_KEY, DD_APPLICATION_KEY (or DD_APP_KEY fallback), DD_SITE

deepwiki

• File: shared/mcp/deepwiki.md
• Type: http (SSE), required: false, public, no auth
• Tools: read_wiki_structure, read_wiki_contents, ask_question

fabric-rti

• File: shared/mcp/fabric-rti.md
• Type: local (uvx microsoft-fabric-rti-mcp)
• Tools: 12 Kusto/eventstream tools
• Secrets: 3 Azure identity secrets

grafana

• File: shared/mcp/grafana.md
• Type: container grafana/mcp-grafana:1.1.0-alpine, --disable-write flag
• Tools: 7 datasource/tempo tools
• Secrets: GRAFANA_URL, GRAFANA_SERVICE_ACCOUNT_TOKEN

graft

• File: shared/mcp/graft.md
• Type: local (npx @nanonets/graft@0.8.0)
• Tools: 6 (ask, skeleton, callers, grep, map, check)
• Notes: Builds context graph via pre-step; network allowlist limited to defaults+node.

jupyter

• File: shared/mcp/jupyter.md
• Type: two docker services (jupyter + jupyter-mcp), MCP type http
• Tools: 5 execute/notebook tools
• Notes: Uses github.run_id as ephemeral Jupyter token — no long-lived secret.

kreuzberg

• File: shared/mcp/kreuzberg.md
• Type: container ghcr.io/kreuzberg-dev/kreuzberg
• Tools: 9 read-only document extraction/format/cache-inspection tools
• Notes: Workspace mounted read-only; mutating tools (cache_clear, cache_warm) explicitly excluded.

markitdown (disabled)

• File: shared/mcp/markitdown.md
• Notes: Removed due to CVEs (issue [container-image-scan] Container findings for mcp/markitdown #49515).

mempalace

• File: shared/mcp/mempalace.md
• Type: http, self-hosted (pip-installed, started as background step on port 8765)
• Tools: 18 semantic memory / knowledge-graph tools
• Notes: Data persisted via cache-memory across runs.

microsoftdocs

• File: shared/mcp/microsoft-docs.md
• Type: http, mcp.dev.azure.com→ actually learn.microsoft.com/api/mcp
• Tools: wildcard, documented as intentional for a read-only public docs server.

notion (disabled)

• File: shared/mcp/notion.md
• Notes: Removed due to CVEs (issue [container-image-scan] Container findings for mcp/notion #49517).

ruflo

• File: shared/mcp/ruflo.md
• Type: local (npx ruflo@latest)
• Tools: 8 swarm/agent/task orchestration tools
• Notes: No secrets required.

semgrep (disabled)

• File: shared/mcp/semgrep.md
• Notes: Removed due to CVEs (issue [container-image-scan] Container findings for semgrep/semgrep:latest #49520).

sentrux

• File: shared/mcp/sentrux.md
• Type: not an MCP server — installs a pinned CLI binary (v0.5.7, SHA256-verified) for use via bash.
• Notes: No secrets; supply-chain integrity check present (sha256sum -c).

sentry

• File: shared/mcp/sentry.md
• Type: local (npx @sentry/mcp-server@0.33.0)
• Tools: 15 read/search/trace/issue/doc tools
• Secrets: SENTRY_ACCESS_TOKEN (required), SENTRY_OPENAI_API_KEY (optional, gates search_docs/get_doc)

serena-go

• File: shared/mcp/serena-go.md
• Type: not a standalone MCP config — imports serena.md with languages: ["go"], adds Go setup pre-steps.

serena

• File: shared/mcp/serena.md
• Type: container ghcr.io/oraios/serena:1.7.0, parameterized by languages import input
• Notes: Workspace mounted read-write (rw) — worth noting since most other containers are read-only mounts.

skillz

• File: shared/mcp/skillz.md
• Type: container intellectronica/skillz:latest
• Tools: wildcard, dynamic per repo .github/skills/ contents
• Secrets: GH_TOKEN/GITHUB_TOKEN (github.token)
• Notes: Wildcard justified since tool set is dynamically generated from committed skills.

slack

• File: shared/mcp/slack.md
• Type: not an MCP server — defines a safe-outputs job (post-to-slack-channel) using actions/github-script.
• Secrets: SLACK_BOT_TOKEN; requires GH_AW_SLACK_CHANNEL_ID env var.

svelte

• File: shared/mcp/svelte.md
• Type: http, public, no auth
• Tools: 5 (list-sections, get-documentation, svelte-autofixer, playground-link, svelte_definition)

tavily

• File: shared/mcp/tavily.md
• Type: http
• Tools: wildcard
• Secrets: TAVILY_API_KEY
• Notes: Comment explicitly flags wildcard as pending a follow-up tool inventory — tracked risk, not yet resolved.

Recommendations

1. tavily.md wildcard tool access is explicitly flagged as pending in-file as a follow-up; a concrete tool allowlist should be defined to match the pattern already used by azure.md, grafana.md, and kreuzberg.md.
2. Five servers (arxiv, brave, markitdown, notion, semgrep) remain disabled pending upstream CVE fixes — periodically re-check upstream image status so they can be re-enabled once patched.
3. serena.md mounts the workspace read-write while nearly all other containers use read-only mounts; confirm this is required for Serena's LSP tooling and not an oversight.
4. Consider renaming/relocating sentrux.md, serena-go.md, and slack.md (or adding a comment banner) since they are not MCP server definitions but are stored alongside genuine MCP configs in the same directory, which could cause confusion during future audits.
5. No other blocking issues found; all active MCP secrets are sourced from secrets.* (no hardcoded credentials observed).

Generated by 🔍 MCP Inspector Agent · copilot · auto · 36.9 AIC · ⌖ 11.4 AIC · ⊞ 9.1K · ◷

• expires on Sep 1, 2026, 10:52 AM UTC-08:00