Mmcp.market

Is Ref Tools MCP server safe?

Probably. Read the findings first.

C69/100grade C

Use with care. Some checks failed or could not be verified.

Public scan report

scanner v0.1.10 · 2026-10-01 · same rubric, same numbers if you re-run it

2 medium
  • Code scan2 source files scanned15/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 0 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year9/10

Findings (2)

  • mediumeval / new Function usedexec.eval
    dist/index.cjs: … try { var makeValidate = new Function( "self", "RULES"…
  • mediumHeavily hex-escaped string (obfuscation)obf.hex-density
    dist/index.cjs: … "type": "_sbcs", "chars": "\x80\x81\xE9\xE2\x84\xE0\x86\xE7\xEA\xEB\xE8\xEF\xEE\x8D\x8E\x8F\x90\u0651\u0652\xF4\xA4\u0640\xFB\xF9\u0621…
Overall 69/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

Other servers that do what Ref Tools does

  • Ref Tools
    Token-efficient search for coding agents over public and private documentation.
    A
  • GitHits
    Search public open-source code, documentation, metadata, vulnerabilities, changelogs, and examples.
    A
  • Documentation
    Local-first document management and semantic search for AI coding agents
    A

Ref Tools reviews, tools and install