Railway (crisog) MCP Server
@crisog/railway-mcp-server
npm
v0.2.0
Source verified
Published by crisog — publish provenance cryptographically ties this package to that repository. That is proof of origin, not an official vendor package.
Unofficial Railway MCP server.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 3 = 97. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 1
medium Untrusted input can drive an external actionMTC-FLOW-005
Untrusted-input tools ([railway_deployment_get, railway_deployment_logs, railway_deployment_events, railway_environment_logs, railway_template_get]) co-exist with external-action tools ([railway_observability_http_logs]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.
Evidence: untrusted [railway_deployment_get, railway_deployment_logs, railway_deployment_events, railway_environment_logs, railway_template_get] → sinks [railway_observab
Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.
Location: flow railway_deployment_get → railway_observability_http_logs
Tools 51
Each tool and what it can reach — statically extracted from the published source.
railway_deployment_eventsingests untrusted inputrailway_deployment_getingests untrusted inputrailway_deployment_logsingests untrusted inputrailway_environment_logsingests untrusted inputrailway_observability_http_logsnetwork egressrailway_template_getingests untrusted inputrailway_custom_domain_availableno sensitive capabilityrailway_custom_domain_createno sensitive capabilityrailway_deployment_cancelno sensitive capabilityrailway_deployment_listno sensitive capability
Show 41 more tools ↓
railway_deployment_redeployno sensitive capabilityrailway_deployment_restartno sensitive capabilityrailway_deployment_rollbackno sensitive capabilityrailway_deployment_stopno sensitive capabilityrailway_domain_generateno sensitive capabilityrailway_domains_listno sensitive capabilityrailway_environment_createno sensitive capabilityrailway_environment_get_by_nameno sensitive capabilityrailway_environment_renameno sensitive capabilityrailway_environments_listno sensitive capabilityrailway_github_branches_listno sensitive capabilityrailway_github_repo_deployno sensitive capabilityrailway_github_repos_listno sensitive capabilityrailway_observability_build_logsno sensitive capabilityrailway_observability_eventsno sensitive capabilityrailway_private_network_create_or_getno sensitive capabilityrailway_private_networks_listno sensitive capabilityrailway_project_createno sensitive capabilityrailway_project_getno sensitive capabilityrailway_projects_listno sensitive capabilityrailway_service_createno sensitive capabilityrailway_service_deploy_latestno sensitive capabilityrailway_service_getno sensitive capabilityrailway_service_instance_build_commandno sensitive capabilityrailway_service_instance_predeployno sensitive capabilityrailway_service_instance_start_commandno sensitive capabilityrailway_service_updateno sensitive capabilityrailway_services_listno sensitive capabilityrailway_tcp_proxies_listno sensitive capabilityrailway_template_deployno sensitive capabilityrailway_templates_listno sensitive capabilityrailway_variable_upsertno sensitive capabilityrailway_variables_collection_upsertno sensitive capabilityrailway_variables_render_for_deploymentno sensitive capabilityrailway_volume_createno sensitive capabilityrailway_volume_instance_backup_createno sensitive capabilityrailway_volume_instance_backup_listno sensitive capabilityrailway_volume_instance_backup_restoreno sensitive capabilityrailway_volume_instances_listno sensitive capabilityrailway_workflow_statusno sensitive capabilityrailway_workspaces_listno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (51 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.2.0 latest |
A 97/100 | 1 | 1.13.0 | 2026-09-07 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan @crisog/railway-mcp-server --onlineOther implementations of Railway 5
Independent packages implementing the same tool, scanned with the same engine. Compare all 6 side by side →
MCP server for Railway.app that enables AI agents to manage Railway infrastructure through natural language.
Railway MCP server with 146+ tools and full Railway API coverage for infrastructure management, based on Jason Tan's original server.
Railway MCP Server - 146+ tools with 100% Railway API coverage, comprehensive MCP testing framework, and real infrastructure management through AI assistants. Enhanced version with enterprise features, based on original work by Jason Tan.
Deprecated compatibility shim for Railway MCP
Security scan results for the Railway (npm) MCP server.
More in Cloud & DevOps
Operator control CLI for AdGuard Home with an MCP adapter
interacting with Aliyun (Alibaba Cloud) services through This MCP server provides tools.
MCP server for the Aspro.Cloud REST API
MCP server for Atlassian Confluence and Jira Cloud APIs
AuroraCloud-first MCP server that exposes AuroraDocs workspace data to Claude Desktop and other AI agents
The official AWS Knowledge Base retrieval server using Bedrock Agent Runtime.