Is Massive Context MCP server safe?
Probably. Read the findings first.
Use with care. Some checks failed or could not be verified.
Public scan report
scanner v0.1.10 · 2026-10-01 · same rubric, same numbers if you re-run it
2 medium
- Code scan7 source files scanned15/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 249 days ago4/15
- Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Findings (2)
- mediumsubprocess with shell=True
exec.shell-truemassive_context_mcp-3.0.1/src/rlm_mcp_server.py: … "Process spawning"), ("shell=True", "Shell execution enabled"), … - mediumeval / new Function used
exec.evalmassive_context_mcp-3.0.1/src/rlm_mcp_server.py: …bprocess execution"), ("eval(", "Dynamic code evaluation"), …
Overall 60/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON
Other servers that do what Massive Context does
- Codebase MemoryCodebase knowledge graph for AI agents — 162 languages, sub-ms queries, 99% fewer tokens.not reviewedWidely usedC