Back to Browse

Unicode Security MCP Server

SecurityLow Risk8.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

Local first MCP checks for Unicode confusables, mixed scripts, invisible controls, and...

About

Local first MCP checks for Unicode confusables, mixed scripts, invisible controls, and...

Security Report

8.2
Low Risk8.2Low Risk

Excellent security posture. This is a local-first Unicode analysis tool with no network calls, no authentication requirements, and well-scoped permissions. Code is clean, input validation is present via Zod schemas, and the server appropriately warns users that its heuristic analysis is not a complete security implementation. No security vulnerabilities detected. Supply chain analysis found 1 known vulnerability in dependencies (0 critical, 1 high severity). Package verification found 1 issue.

5 files analyzed · 3 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-mrfentmen-unicode-security-mcp": {
      "args": [
        "-y",
        "unicode-security-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

unicode-security-mcp

A local-first MCP server for catching Unicode tricks before they become confusing bug reports or security incidents.

Tools

  • analyze_text: detect confusable characters, invisible controls, mixed scripts, and a heuristic risk level.
  • compare_identifiers: compare two names through a small confusable skeleton.
  • get_skeleton: normalize one identifier for local comparison.

The server never sends input to a network service. It is a review aid, not a complete Unicode Security Mechanisms implementation. The bundled mappings are intentionally conservative and should not replace platform IDNA, normalization, font, or language-specific security review.

Run

npm install
npm run build
node dist/index.js

Reviews

No reviews yet

Be the first to review this server!