MCP.Market

Is Cafe24 MCP server safe?

Probably. Read the findings first.

C65/100grade C

Use with care. Some checks failed or could not be verified.

What to know before installing
  • highShell command built from a string (injection risk)

How Cafe24 compares

Against every graded E-commerce MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
65/100
higher than 25% of 2,176 E-commerce servers

Public scan report

scanner v0.1.10 · 2026-10-24 · same rubric, same numbers if you re-run it

1 high
  • Code scan13 source files scanned13/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 0 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (1)

  • highShell command built from a string (injection risk)exec.shell-concat
    dist/cli.js: …node:child_process").then(({ exec }) => exec(`${process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open"} "${url}"`)); const done = (t) => { …
Overall 65/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

Other servers that do what Cafe24 does

  • Bling
    MCP server for Bling — ERP: products, orders, invoices (NF-e/NFS-e), stock, AR/AP, webhooks
    More from codespar →
    B
  • Shopware
    Query and safely manage a Shopware 6 shop: products, orders, customers, stock, audits, reports.
    B
  • WebCake Storefront
    Build pages and manage products, orders, and content on the WebCake/StoreCake storefront builder.
    A

Cafe24 reviews, tools and install