jina-ai/MCP

Review signals: 1 connection review, 118 known vulnerability.

Reviewed as expected for a test run: npm looked for a config file that did not exist, so nothing was read; resolver address lookups that send no data.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 4 distinct locations. 8 attributed processes.

OSV reports a known vulnerability in this dependency version. 20 distinct locations. 118 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• read_url reads a web page as markdown without an API key: Real input produced the expected result: title: Example Domain

  Source: Read a web page or PDF as markdown.

  Input: {"tool": "read_url", "arguments": {"url": "https://example.com"}}

  Expected: markdown page with title Example Domain

  Command: npm run start tools/call {"tool": "read_url", "arguments": {"url": "https://example.com"}}

  Observed: title: Example Domain\ncontent: >-\n This domain is for use in documentation examples without needing permission.\n This is not a service; avoid relying on it for testing and monitoring\n purposes.\n\n\n هذا النطاق مُخصص للاستخدام في أمثلة التوثيق دون الحاجة إلى إذن. هذه ليست خدمة،\n يُرجى تجنب الاعتماد عليها لأغراض الاختبار والمراقبة.\n\n\n 该域名仅用于文档示例，无需获得许可。这并非一项服务，请勿将其用于测试和监控目的。\n\n\n L’usage de ce domaine est réservé à des exemples de documentation, sans\n autorisation préalable. Il ne s’agit pas d’un service ; son utilisation à des\n fins de test ou de surveillance est à éviter.\

Examples

• Type-check the TypeScript source: command completed successfully

  Source: package.json scripts.type-check

  Input: none

  Expected: tsc exits 0 with no errors

  Command: npm run type-check

  Observed: > [email protected] type-check > tsc --noEmit

• Run the local dev server (documented in README Local Development): Long-running server, not a finite example; it is exercised by probe.json (npm run start on localhost:8787/v1, read_url call) and was stopped afterwards

  Source: README.md Developer Guide > Local Development

  Expected: documented command completes successfully

  Observed: Long-running server, not a finite example; it is exercised by probe.json (npm run start on localhost:8787/v1, read_url call) and was stopped afterwards

• Run the test suite: No test script exists in package.json (scripts: deploy, dev, format, lint:fix, start, cf-typegen, type-check); no documented tests to run

  Source: package.json scripts

  Expected: documented command completes successfully

  Observed: No test script exists in package.json (scripts: deploy, dev, format, lint:fix, start, cf-typegen, type-check); no documented tests to run

Local or hosted: both

Run the jina-mcp Remote MCP server locally with the README's dev command and call its read_url tool over streamable HTTP at /v1

cd <guest-path> && ls -la && id -u && python3 --version && cat README.md | head -200
cd <guest-path> && tail -c 1500 README.md; echo ----; cat package.json; echo ----; ls -la .coldpass .readme src; echo ----; cat wrangler.jsonc; echo ----; node -v 2>&1; npm -v 2>&1; git --version 2>&1; ls /inputs 2>&1
cd <guest-path> && git init -q && git remote add origin https://github.com/jina-ai/MCP && git fetch --depth 1 origin b938c00f0870a75b39a78d5dff1f5bf645151a6e 2>&1 | tail -5; git reset --mixed FETCH_HEAD 2>&1 | tail -3; git log --oneline -1; git status --short | head
cd /tmp && (sudo -n true && echo SUDO_OK) 2>&1; curl -sS -m 30 -o /tmp/nodesetup.sh https://deb.nodesource.com/setup_22.x 2>&1 && echo fetched; (sudo -n apt-get update -qq 2>&1 | tail -2; sudo -n apt-get install -y -qq nodejs npm 2>&1 | tail -3); node -v; npm -v
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && timeout 900 npm install 2>&1 | tail -15; echo EXIT=$?; node -e "console.log(require('wrangler/package.json').engines)" 2>&1
cd /tmp && sudo -n -E bash /tmp/nodesetup.sh >/tmp/nodesetup.log 2>&1; echo SETUP_EXIT=$?; sudo -n apt-get install -y -qq nodejs 2>&1 | tail -3; hash -r; node -v; npm -v; which node
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && npm install 2>&1 | tail -2; grep -n "v1\|Authorization\|auth\|primer\|exclude_tools\|registerTool\|name:" src/index.ts | head -60; ls src/tools src/utils
cd <guest-path> && export NODE_USE_ENV_PROXY=1 WRANGLER_SEND_METRICS=false && (nohup npm run start > /tmp/devserver.log 2>&1 &) ; for i in $(seq 1 60); do curl -s -o /dev/null http://localhost:8787/ && break; sleep 2; done; tail -20 /tmp/devserver.log; curl -s -m 10 -X POST http://localhost:8787/v1 -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"t","version":"1"}}}' | head -c 600
cd /tmp && H='-H Content-Type:application/json -H Accept:application/json,text/event-stream'; curl -s -m 20 -X POST http://localhost:8787/v1 $H -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"primer","arguments":{}}}' | head -c 800; echo; echo ---; curl -s -m 60 -X POST http://localhost:8787/v1 $H -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"guess_datetime_url","arguments":{"url":"https://jina.ai/news"}}}' | head -c 800
cd /tmp && H='-H Content-Type:application/json -H Accept:application/json,text/event-stream'; for u in "https://example.com/blog/2024/05/12/hello-world" "https://example.com/blog/2024/05/12/hello-world"; do curl -s -m 60 -X POST http://localhost:8787/v1 $H -d "{\"jsonrpc\":\"2.0\",\"id\":4,\"method\":\"tools/call\",\"params\":{\"name\":\"guess_datetime_url\",\"arguments\":{\"url\":\"$u\"}}}"; echo; done
cd /tmp && H='-H Content-Type:application/json -H Accept:application/json,text/event-stream'; curl -s -m 90 -X POST http://localhost:8787/v1 $H -d '{"jsonrpc":"2.0","id":5,"method":"tools/call","params":{"name":"read_url","arguments":{"url":"https://example.com"}}}' | head -c 1000
pkill -f "wrangler dev" ; pkill -f "npm run start"; sleep 3; curl -s -m 3 http://localhost:8787/ >/dev/null && echo STILL_UP || echo STOPPED; ls -la <guest-path> 2>&1; cd <guest-path> && timeout 300 npm run type-check 2>&1 | tail -5; echo TC_EXIT=${PIPESTATUS[0]}
for p in $(ps -eo pid,args | grep -E 'workerd|wrangler dev|wrangler/bin' | grep -v grep | awk '{print $1}'); do kill $p 2>/dev/null; done; sleep 3; curl -s -m 3 http://localhost:8787/ >/dev/null && echo STILL_UP || echo STOPPED; ls -la <guest-path> 2>&1
cd <guest-path> && timeout 300 npm run type-check > /tmp/typecheck.log 2>&1; echo TC_EXIT=$?; tail -5 /tmp/typecheck.log; grep -n "Example Domain\|mcp.jina\|Read a web page" README.md | head -5
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp_http","argv":["npm","run","start"],"cwd":"<guest-path>","url":"http://localhost:8787/v1","env":{"WRANGLER_SEND_METRICS":"false","NODE_USE_ENV_PROXY":"1"},"tool":"read_url","arguments":{"url":"https://example.com"},"expected_text":"title: Example Domain"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"read_url reads a web page as markdown without an API key","source":"Read a web page or PDF as markdown.","input":"https://example.com","expected":"markdown page with title Example Domain","probe_kind":"mcp_http","argv":["npm","run","start"],"url":"http://localhost:8787/v1","env":{"WRANGLER_SEND_METRICS":"false","NODE_USE_ENV_PROXY":"1"},"tool":"read_url","arguments":{"url":"https://example.com"},"expected_text":"title: Example Domain","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Type-check the TypeScript source","source":"package.json scripts.type-check","input":"none","expected":"tsc exits 0 with no errors","argv":["npm","run","type-check"],"cwd":"<guest-path>","env":{},"expected_text":"tsc --noEmit"},
{"kind":"example","claim":"Run the local dev server (documented in README Local Development)","source":"README.md Developer Guide > Local Development","reason":"Long-running server, not a finite example; it is exercised by probe.json (npm run start on localhost:8787/v1, read_url call) and was stopped afterwards","deferred":true},
{"kind":"example","claim":"Run the test suite","source":"package.json scripts","reason":"No test script exists in package.json (scripts: deploy, dev, format, lint:fix, start, cf-typegen, type-check); no documented tests to run"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README.md, package.json scripts (deploy, dev, start, format, lint:fix, cf-typegen, type-check), wrangler.jsonc and src/index.ts. The README and code describe a request-driven Cloudflare Worker serving /v1 on demand; there is no cron trigger, scheduler, loop, --once/--now flag or webhook in the product (wrangler.jsonc has no triggers.crons block). CI schedules are not product cycles.","checks":[]}
EOF
python3 -I -c "import json;[json.load(open('.coldpass/'+f)) for f in ['probe.json','claims.json','examples.json','cycles.json']];print('json ok')"; ls -la .coldpass; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -40; echo CHECK_EXIT=${PIPESTATUS[0]}
curl -s -m 3 http://localhost:8787/ >/dev/null && echo PORT_BUSY || echo PORT_FREE; ps -eo pid,args | grep -E 'workerd|wrangler' | grep -v grep | wc -l; cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{
  "outcome": "working",
  "fault_owner": "null",
  "operation": "Run the jina-mcp Remote MCP server locally with the README's dev command and call its read_url tool over streamable HTTP at /v1",
  "operation_scope": "Local development only (wrangler dev on localhost:8787). Needs Node.js >=20 (wrangler 4 requires it). No Jina API key used; read_url is an optional-key tool. Hosted https://mcp.jina.ai/v1 was not tested. Requires outbound network to fetch the target page.",
  "steps": [
    "git init; git remote add origin https://github.com/jina-ai/MCP; git fetch --depth 1 origin b938c00f0870a75b39a78d5dff1f5bf645151a6e; git reset --mixed FETCH_HEAD",
    "npm install (README Developer Guide > Local Development)",
    "npm run start (wrangler dev, serves http://localhost:8787/v1)",
    "MCP tools/call read_url {\"url\":\"https://example.com\"} -> 'title: Example Domain'",
    "npm run type-check (package.json script, exit 0)"
  ],
  "deviations": [
    "Guest Node was v18.19.1 from apt; npm install succeeded but wrangler 4 declares engines node >=20. Installed Node 22.23.4 via NodeSource setup_22.x script (sudo bash) and reran npm install. The README does not state a Node version.",
    "README does not specify a Node version; this is a documentation gap.",
    "guess_datetime_url on a made-up URL returned upstream HTTP 404 (expected for a nonexistent page); not used as the probe because output is live-upstream dependent.",
    "Probe stops the server at the end; a pkill pattern accidentally killed my own shell once and was redone with a ps/kill loop.",
    "Checker path: the task text referenced /inputs/coldpass-preflight.py which does not exist in this guest; used <guest-path> as instructed in the coldpass task.",
    "Telemetry: WRANGLER_SEND_METRICS=false set in probe env to decline wrangler metrics."
  ],
  "stuck_step": null,
  "main_blocker": null,
  "plain_failure": null,
  "suggested_fix": "Add an explicit Node.js engine requirement (>=20) to the README Local Development section, since the default apt Node 18 fails the wrangler install requirement."
}
EOF
python3 -I -c "import json;json.load(open('.coldpass/report.json'));print('report ok')"
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > /tmp/final_check.json 2>&1; echo CHECK_EXIT=$?; python3 -I -c "import json;d=json.load(open('/tmp/final_check.json'));print(d['valid'], d['problems'], d['replay']['status'])"