Back to Browse

Ossfind MCP Server

Developer ToolsModerate5.8MCP RegistryLocal
Free

Server data from the Official MCP Registry

Safety-ranked open-source component discovery for agents across six package ecosystems.

About

Safety-ranked open-source component discovery for agents across six package ecosystems.

Security Report

5.8
Moderate5.8Moderate Risk

ossfind is a well-architected MCP server for open-source component discovery with a strong safety-first design. The codebase demonstrates mature security practices: explicit fail-closed defaults, comprehensive audit trails, and deliberate scoping of permissions. Minor code quality observations around telemetry error handling and env var validation do not materially affect security posture. Permissions (network_http, env_vars, file I/O) are appropriate for a discovery/enrichment tool that aggregates data from multiple package registries and suppliers. Supply chain analysis found 1 known vulnerability in dependencies (1 critical, 0 high severity). Package verification found 1 issue.

3 files analyzed · 6 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

system_info

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

Optional. Raises the GitHub repository-search rate limit; discovery works without it.Required

Environment variable: GITHUB_TOKEN

Optional libraries.io key, used as the PyPI discovery fallback when no local index has been built. Without it, and without an index, PyPI search reports itself unavailable rather than returning nothing.Required

Environment variable: LIBRARY_IO_API_KEY

Set to 1 to run fully offline against frozen supplier responses, for evaluation without network access.Optional

Environment variable: OSSFIND_FIXTURES

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-aniket-kr1030-ossfind": {
      "env": {
        "GITHUB_TOKEN": "your-github-token-here",
        "OSSFIND_FIXTURES": "your-ossfind-fixtures-here",
        "LIBRARY_IO_API_KEY": "your-library-io-api-key-here"
      },
      "args": [
        "-y",
        "ossfind"
      ],
      "command": "npx"
    }
  }
}

Reviews

No reviews yet

Be the first to review this server!