{"name":"io.mcp-hangar/hangar","slug":"mcp-hangar-hangar","title":"MCP Hangar","description":"Policy enforcement plane for MCP: every tool call ends in a verdict. Self-hosted, MIT.","url":"https://mcp.market/server/mcp-hangar-hangar","rating":null,"grade":"C","score":65,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":0,"stars":null,"forks":null,"downloads_week":null,"last_push_at":null,"license":null},"claimed":false,"transport":"pypi","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/mcp-hangar/mcp-hangar","website":"https://mcp-hangar.io","version":"2.21.0","remotes":[],"packages":[{"registryType":"pypi","identifier":"mcp-hangar","version":"2.21.0","runtimeHint":"uvx","transport":{"type":"stdio"},"environmentVariables":[{"description":"Path to config.yaml declaring the upstream MCP servers and policy. Without it Hangar starts on a demo config that serves no real upstream.","format":"filepath","name":"MCP_CONFIG"}]}],"tools":[],"scan":{"score":65,"grade":"C","scanned_at":"2026-09-18T04:53:59.431Z","report":{"scannerVersion":"0.1.2","scannedAt":"2026-09-18T04:53:59.351Z","components":{"code":{"score":1,"max":25,"notes":["464 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":15,"max":15,"notes":["only the listing description was available"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":15,"max":15,"notes":["last push 1 days ago"]},"identity":{"score":9,"max":10,"notes":["registry namespace matches repository owner","website matches verified namespace"]}},"findings":[{"id":"env.dump","severity":"high","component":"code","title":"Whole environment serialized (possible credential exfil)","evidence":"mcp_hangar-2.21.0/src/mcp_hangar/bootstrap/runtime.py: …d`` / ``burst_size``. \"\"\" env = dict(os.environ) if env is None else env rate_limit …"},{"id":"install.curl-pipe","severity":"high","component":"code","title":"curl | sh in a script","evidence":"mcp_hangar-2.21.0/src/mcp_hangar/server/cli/services/dependency_detector.py: …tall uv: https://docs.astral.sh/uv/ or `curl -LsSf https://astral.sh/uv/install.sh | sh`\", \"docker/podman\": \"Install Do…"}],"inputs":{"packages":[{"registryType":"pypi","identifier":"mcp-hangar","version":"2.21.0","found":true,"license":"MIT","dependencyCount":37,"publishedAt":"2026-09-16T20:57:16.006171Z","repositoryUrl":"https://github.com/mcp-hangar/mcp-hangar"}],"repo":{"found":true,"owner":"mcp-hangar","repo":"mcp-hangar","archived":false,"pushedAt":"2026-09-17T06:01:05Z","stars":15,"openIssues":43,"ownerType":"Organization","ownerCreatedAt":"2026-02-06T19:21:16Z","license":"MIT"}}}},"grade_history":[],"reviews":[]}