Voyageai Cli MCP Server
voyageai-cli
npm
v1.33.6
Published by mrlynn — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
CLI for Voyage AI embeddings, reranking, and MongoDB Atlas Vector Search
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 7 = 93. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 12
high Shell/command execution in server code (src/commands/app.js)MTC-SRC-002
In the server's implementation (`src/commands/app.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ync, spawn } = require('child_process'); const https = require('https'); const path = require('path'); const fs = requir
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/commands/app.js
high Shell/command execution in server code (src/commands/bug.js)MTC-SRC-002
In the server's implementation (`src/commands/bug.js:121`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: nst { exec } = require('child_process'); const command = os.platform() === 'darwin' ? 'open' : os.pl
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/commands/bug.js
high Shell/command execution in server code (src/commands/doctor.js)MTC-SRC-002
In the server's implementation (`src/commands/doctor.js:433`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: { execSync } = require('child_process'); console.log(pc.cyan('\n Installing pdf-parse...')); try { execSync('np
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/commands/doctor.js
high Shell/command execution in server code (src/commands/playground.js)MTC-SRC-002
In the server's implementation (`src/commands/playground.js:6`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: nst { exec } = require('child_process'); const crypto = require('crypto'); /** * Load announcements from the markdown
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/commands/playground.js
high Shell/command execution in server code (src/commands/workflow.js)MTC-SRC-002
In the server's implementation (`src/commands/workflow.js:13`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: { execSync } = require('child_process'); return execSync('git config user.name', { encoding: 'utf8' }).trim(); } c
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/commands/workflow.js
high Shell/command execution in server code (src/lib/export/formats/clipboard-export.js)MTC-SRC-002
In the server's implementation (`src/lib/export/formats/clipboard-export.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: { execSync } = require('child_process'); const os = require('os'); /** * Copy text content to the system clipboard. *
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/lib/export/formats/clipboard-export.js
high Shell/command execution in server code (src/lib/npm-utils.js)MTC-SRC-002
In the server's implementation (`src/lib/npm-utils.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: { execSync } = require('child_process'); const path = require('path'); const fs = require('fs'); const WORKFLOW_PREFIX
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/lib/npm-utils.js
high Shell/command execution in server code (src/lib/workflow-builder.js)MTC-SRC-002
In the server's implementation (`src/lib/workflow-builder.js:738`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: { execSync } = require('child_process'); return execSync('git config user.name', { encoding: 'utf8' }).trim(); } c
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/lib/workflow-builder.js
high Shell/command execution in server code (src/nano/nano-health.js)MTC-SRC-002
In the server's implementation (`src/nano/nano-health.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: eSync } = require('node:child_process'); const fs = require('node:fs'); const path = require('node:path'); const os = re
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/nano/nano-health.js
medium Hardcoded egress to an external endpoint (src/commands/playground.js)MTC-SRC-003
In the server's implementation (`src/commands/playground.js:1012`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: const regRes = await fetch(`https://registry.npmjs.org/${encodedName}/latest`, { headers: { 'Accept':
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/commands/playground.js
medium Dynamic module load from a non-literal (src/lib/codegen.js)MTC-SRC-005
In the server's implementation (`src/lib/codegen.js:21`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ) { const pkg = require(pkgPath); if (pkg.version) return pkg.version; } } catch { // Tr
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/lib/codegen.js
low Shell/command execution in packaging/dev tooling (src/mcp/install.js)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`src/mcp/install.js:391`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: { execSync } = require('child_process'); try { const version = execSync('vai --version', { encoding: 'utf8', timeo
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/mcp/install.js
Tools 22
Each tool and what it can reach — statically extracted from the published source.
vai_explainingests untrusted inputvai_code_find_similarno sensitive capabilityvai_code_indexno sensitive capabilityvai_code_queryno sensitive capabilityvai_code_searchno sensitive capabilityvai_code_statusno sensitive capabilityvai_collectionsno sensitive capabilityvai_embedno sensitive capabilityvai_estimateno sensitive capabilityvai_explain_codeno sensitive capability
Show 12 more tools ↓
vai_generate_workflowno sensitive capabilityvai_index_workspaceno sensitive capabilityvai_ingestno sensitive capabilityvai_modelsno sensitive capabilityvai_multimodal_embedno sensitive capabilityvai_queryno sensitive capabilityvai_rerankno sensitive capabilityvai_searchno sensitive capabilityvai_search_codeno sensitive capabilityvai_similarityno sensitive capabilityvai_topicsno sensitive capabilityvai_validate_workflowno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (22 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.33.6 latest |
A 93/100 | 12 | 1.13.0 | 2026-09-07 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan voyageai-cli --onlineMore in Web, Search & Scraping
Agent IP: MCP server with patents search tools
MCP server for searching the Agent Almanac — the public catalog of 9,000+ Model Context Protocol servers. Find, install, and discover MCP servers from inside Claude Desktop, Cursor, Continue, Zed, or any MCP-aware agent.
Search agents & MCP servers by capability, with daily-observed pricing, liveness and market data.
Verified merchants accepting agentic payments on Lightning/L402/BOLT12/USDT — search, verify, pay.
Airframe MCP Client - Connect agents to Airframe's product intelligence
Amazon product search demand over time, with growth for any keyword. Free key at trendsmcp.ai