Cli Anything Biddeed MCP Server

This MCP server has significant security concerns despite being categorized as Developer Tools. The codebase contains suspicious dependencies (@_davideast/stitch-mcp, @google/stitch-sdk) with unclear purposes and potential typosquatting patterns, an incomplete code submission (only node_modules React reconciler included), and missing critical MCP implementation files. The token_budget mechanism suggests authenticated access, but authentication implementation is not visible. Permissions appear to include network HTTP and environment variables, which are baseline for this category, but the vague purpose and incomplete submission make it difficult to assess actual security posture. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 1 high severity).

4 files analyzed · 9 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.