https://github.com/AccelByte/ags-api-mcp-server

ags-api-mcp-server

Caution

Score 87 / 100 · 80 files read · 0 critical, 0 high, 1 medium, 9 low findings

Report 18506bdf8ff3bb2f · first scanned 2026-10-28 · scanned 3× · keyed to the exact package contents, so this link always shows this version

Listed in the Agent Census directory data

Subscores

credentials82

exfiltration92

execution100

injection100

obfuscation100

files100

100 is clean. Deductions come only from the cited findings below.

Findings

mediumCode contacts static.modelcontextprotocol.io, which the documentation never mentions

(package) · line 1 · rule M3

static.modelcontextprotocol.io

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/config.ts · line 172 · rule L1

vVar("AB_BASE_URL", process.env.AB_BASE_URL, false) || "https://yourgame.accelbyte.io"; // Construct baseUrl from ADVER

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/logger.ts · line 4 · rule L1

ig.ts, so we'll use process.env directly const isDevelopment = process.env.NODE_ENV === "development"; const logLevel = process.en

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/oauth-middleware.ts · line 311 · rule L1

true, secure: process.env.NODE_ENV === "production", sameSite: "lax", // Allow cookies on same-site redirects ma

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/otp-manager.ts · line 26 · rule L1

ent hanging if (process.env.NODE_ENV !== "test") { this.startCleanup(); } logger.info("OTPManager initialized");

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/session-manager.ts · line 35 · rule L1

ent hanging if (process.env.NODE_ENV !== "test") { this.startCleanup(); } logger.info("SessionManager initialize

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/v2/auth/middleware.ts · line 37 · rule L1

ber { const raw = process.env[key]; if (!raw) return defaultValue; const parsed = parseInt(raw, 10); if (Number.isNaN(pars

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/v2/config.ts · line 123 · rule L1

t = parseInt( process.env.MCP_PORT || process.env.PORT || "3000", 10, ); // Track whether the URL was provided

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/v2/express.ts · line 19 · rule L1

const trustProxy = process.env.TRUST_PROXY; if (trustProxy) { if (trustProxy === "true" || trustProxy === "*") { log.

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/v2/logger.ts · line 6 · rule L1

const development = process.env.NODE_ENV === "development"; const level = process.env.LOG_LEVEL || (development ? "debug" : "info"

Permission surface

Network endpoints: antigravity.googleapi.example.comapp.example.combackup.example.comcdn.example.comcode.claude.comcode.visualstudio.comcursor.comdevelopment.accelbyte.iodocs.accelbyte.iogeminicli.comgetpino.iogithub.comiam.examplejson-schema.orgmcp.examplemcp.example.commodelcontextprotocol.ionodejs.orgproducts.example.comraw.githubusercontent.comstatic.modelcontextprotocol.iousers.example.comwww.example.comwww.npmjs.comyourgame.accelbyte.io
Environment read: AB_BASE_URLADVERTISED_HOSTNAMEADVERTISED_PORTADVERTISED_PROTOCOLALLOW_CROSS_DOMAIN_JWKSALLOW_JWKS_COLD_STARTALLOW_PARENT_DOMAIN_ISSUERDASHBOARD_ALLOW_DIRECT_PINSENABLE_CLIENT_CREDENTIALS_FALLBACKINCLUDE_WRITE_REQUESTSJWKS_CACHE_MAX_AGEJWKS_URIJWT_ALGORITHMSJWT_AUDIENCEJWT_ISSUERLOG_LEVELMCP_AUTHMCP_AUTH_SERVER_DISCOVERY_MODEMCP_HOSTEDMCP_HOSTNAMEMCP_PATHMCP_PORTMCP_PROTOCOLMCP_READ_ONLYMCP_RENDER_TOOLSMCP_SERVER_URLMCP_VALIDATE_TOKEN_ISSUERMY_OPTIONNODE_ENVOAUTH_AUTHORIZATION_URLOAUTH_CLIENT_IDOAUTH_CLIENT_SECRETOAUTH_REDIRECT_URIOAUTH_TOKEN_URLOPENAPI_DEFAULT_RUN_TIMEOUT_MSOPENAPI_DEFAULT_SEARCH_LIMITOPENAPI_MAX_RUN_TIMEOUT_MSOPENAPI_MAX_SEARCH_LIMITOPENAPI_SPECS_DIRPORTRATE_LIMIT_ENABLEDRATE_LIMIT_MAXRATE_LIMIT_WINDOW_MINSTRANSPORTTRUST_PROXY
Shell execution: no
Install hooks: none
Credential material: Reads named environment variables (normal for API keys; listed in the permission summary)

Provenance

Source: GitHub
Repository: AccelByte/ags-api-mcp-server
Owner: AccelByte
Stars: 0
Forks: 1
Repo created: 2025-10-21
Last push: 2026-10-06
License: Apache-2.0

Badge for the author

[![Preflight: Caution](https://preflight.orbitaldeskllc.com/badge/18506bdf8ff3bb2f.svg)](https://preflight.orbitaldeskllc.com/b/18506bdf8ff3bb2f)

The badge links back to this report and updates if the package is re-scanned at a new version.

Watch this package

Interest list only. We store the address and this report link, nothing else. No mail is sent in v1.

Share this report: https://preflight.orbitaldeskllc.com/r/18506bdf8ff3bb2f