Is go-tokenless MCP server safe?
Yes, with the usual care.
Safe to use. Minor gaps such as a missing repository or slower maintenance.
No critical or high findings in the latest scan.
How go-tokenless compares
Against every graded Developer tools MCP server, from our own scans and uptime checks. Updated after each scan run.
- Safety score
- 83/100
- higher than 65% of 1,119 Developer tools servers
- Tools that change things
- 50%
- typical: 5%. Fewer write tools means less an agent can break
What its tools let an agent do: 1 read · 1 run or deploy
Public scan report
scanner v0.1.10 · 2026-10-14 · same rubric, same numbers if you re-run it
1 medium
- Code scan5 source files scanned20/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 7 days ago15/15
- Maintainer identityregistry namespace matches repository owner7/10
Findings (1)
- mediumeval / new Function used
exec.evaldist/chunks/mcp-232VFDX2.js: …&&(C=this.opts.code.process(C,g));let Q=new Function(`${o.default.self}`,`${o.default.scope}`…
Overall 83/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON
Other servers that do what go-tokenless does
- GithubMCP server for GitHub operations (PRs, issues, actions) with structured, token-efficient outputnot reviewedGrowingA
- GitDiagramArchitecture diagrams, explanations and Mermaid source for public GitHub repositories.not reviewedEstablishedA
- GitHubConnect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.not reviewedEstablishedA
