Mmcp.market

Is MCP Hangar MCP server safe?

Probably. Read the findings first.

C57/100grade C

Use with care. Some checks failed or could not be verified.

What to know before installing
  • highWhole environment serialized (possible credential exfil)
  • highcurl | sh in a script

Public scan report

scanner v0.1.5 · 2026-09-19 · same rubric, same numbers if you re-run it

2 high
  • Code scan464 source files scanned1/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 0 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; website matches verified namespace9/10

Findings (2)

  • highWhole environment serialized (possible credential exfil)env.dump
    mcp_hangar-2.21.0/src/mcp_hangar/bootstrap/runtime.py: …d`` / ``burst_size``. """ env = dict(os.environ) if env is None else env rate_limit …
  • highcurl | sh in a scriptinstall.curl-pipe
    mcp_hangar-2.21.0/src/mcp_hangar/server/cli/services/dependency_detector.py: …tall uv: https://docs.astral.sh/uv/ or `curl -LsSf https://astral.sh/uv/install.sh | sh`", "docker/podman": "Install Do…
Overall 57/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

Other servers that do what MCP Hangar does

  • GoModel
    Self-hosted gateway aggregating upstream MCP servers behind one authenticated HTTP endpoint.
    B

MCP Hangar reviews, tools and install