External endpoints declaredlowexpected for this capabilityczlonkowski-n8n-mcp-b604bea/.claude/agents/mcp-backend-engineer.md
1 distinct host(s)
Path traversal sequencesmediumexpected for this capabilityczlonkowski-n8n-mcp-b604bea/.dockerignore
'../' present in content or name
Internal host / private infrastructure referencemediumczlonkowski-n8n-mcp-b604bea/.env.example
shipped content references a private IP range or internal-only host
External endpoints declaredlowexpected for this capabilityczlonkowski-n8n-mcp-b604bea/.env.example
9 distinct host(s)
Suspicious code patternsmediumexpected for this capabilityczlonkowski-n8n-mcp-b604bea/.github/workflows/dependency-check.yml
child_process exec
External endpoints declaredlowexpected for this capabilityczlonkowski-n8n-mcp-b604bea/.github/workflows/docker-build-n8n.yml
2 distinct host(s)
Embedded credentialshighexpected for this capabilityczlonkowski-n8n-mcp-b604bea/.github/workflows/issue-triage.lock.yml
found: credentials in URL
Suspicious code patternshighexpected for this capabilityczlonkowski-n8n-mcp-b604bea/.github/workflows/issue-triage.lock.yml
destructive rm -rf /
Broad capability surfacelowczlonkowski-n8n-mcp-b604bea/.github/workflows/issue-triage.lock.yml
3 high-impact capability categories referenced — verify least-privilege
Prompt-injection phrasinghighexpected for this capabilityczlonkowski-n8n-mcp-b604bea/.github/workflows/issue-triage.lock.yml
instruction-subversion language detected
External endpoints declaredlowexpected for this capabilityczlonkowski-n8n-mcp-b604bea/.github/workflows/issue-triage.lock.yml
3 distinct host(s)
External endpoints declaredlowexpected for this capabilityczlonkowski-n8n-mcp-b604bea/.github/workflows/release.yml
4 distinct host(s)
Suspicious code patternsmediumexpected for this capabilityczlonkowski-n8n-mcp-b604bea/CHANGELOG.md
dynamic code execution
Broad capability surfacelowczlonkowski-n8n-mcp-b604bea/CHANGELOG.md
5 high-impact capability categories referenced — verify least-privilege
Possible obfuscationmediumczlonkowski-n8n-mcp-b604bea/CHANGELOG.md
very long lines
External endpoints declaredlowexpected for this capabilityczlonkowski-n8n-mcp-b604bea/CHANGELOG.md
7 distinct host(s)
Suspicious network referencesmediumczlonkowski-n8n-mcp-b604bea/Dockerfile
raw IP URL (2 URLs)
Suspicious network referencesmediumczlonkowski-n8n-mcp-b604bea/Dockerfile.railway
raw IP URL (3 URLs)
External endpoints declaredlowexpected for this capabilityczlonkowski-n8n-mcp-b604bea/README.md
8 distinct host(s)
Broad capability surfacelowczlonkowski-n8n-mcp-b604bea/data/skills/n8n-self-hosting/SECURITY.md
4 high-impact capability categories referenced — verify least-privilege
Suspicious code patternsmediumexpected for this capabilityczlonkowski-n8n-mcp-b604bea/data/skills/n8n-workflow-patterns/scheduled_tasks.md
child_process exec; dynamic code execution
External endpoints declaredlowexpected for this capabilityczlonkowski-n8n-mcp-b604bea/docs/AUTOMATED_RELEASES.md
5 distinct host(s)
Suspicious network referencesmediumczlonkowski-n8n-mcp-b604bea/docs/DOCKER_TROUBLESHOOTING.md
raw IP URL (16 URLs)
Egress to a private/loopback hosthighexpected for this capabilityczlonkowski-n8n-mcp-b604bea/docs/DOCKER_TROUBLESHOOTING.md
192.168.1.100
Suspicious code patternshighexpected for this capabilityczlonkowski-n8n-mcp-b604bea/docs/N8N_DEPLOYMENT.md
pipe-to-shell install
External endpoints declaredlowexpected for this capabilityczlonkowski-n8n-mcp-b604bea/docs/N8N_DEPLOYMENT.md
10 distinct host(s)
External endpoints declaredlowexpected for this capabilityczlonkowski-n8n-mcp-b604bea/docs/RAILWAY_DEPLOYMENT.md
6 distinct host(s)
Potentially unbounded loopmediumczlonkowski-n8n-mcp-b604bea/src/templates/sequential-processor.ts
an infinite loop (while True / while(1) / for(;;)) may cause runaway consumption
Suspicious network referencesmediumczlonkowski-n8n-mcp-b604bea/test-output.txt
raw IP URL (12 URLs)
Egress to a private/loopback hosthighexpected for this capabilityczlonkowski-n8n-mcp-b604bea/test-output.txt
127.0.0.1, 192.168.1.100, 10.0.0.1
External endpoints declaredmediumexpected for this capabilityczlonkowski-n8n-mcp-b604bea/test-output.txt
11 distinct host(s)
Zero-width characterslowczlonkowski-n8n-mcp-b604bea/tests/unit/docker/edge-cases.test.ts
6 hidden characters
Suspicious code patternshighexpected for this capabilityczlonkowski-n8n-mcp-b604bea/tests/unit/docker/parse-config.test.ts
destructive rm -rf /; child_process exec
Embedded credentialshighexpected for this capabilityczlonkowski-n8n-mcp-b604bea/tests/unit/flexible-instance-security.test.ts
found: Stripe live key, credentials in URL, hardcoded credential
Egress to a private/loopback hosthighexpected for this capabilityczlonkowski-n8n-mcp-b604bea/tests/unit/flexible-instance-security.test.ts
169.254.169.254, 10.0.0.1
External endpoints declaredmediumexpected for this capabilityczlonkowski-n8n-mcp-b604bea/tests/unit/http-server/session-persistence.test.ts
14 distinct host(s)
Embedded credentialshighexpected for this capabilityczlonkowski-n8n-mcp-b604bea/tests/unit/http-server/ssrf-gate.test.ts
found: credentials in URL, hardcoded credential
Suspicious network referencesmediumczlonkowski-n8n-mcp-b604bea/tests/unit/http-server/ssrf-gate.test.ts
raw IP URL (15 URLs)
Suspicious code patternshighexpected for this capabilityczlonkowski-n8n-mcp-b604bea/tests/unit/mcp/disabled-tools-additional.test.ts
environment/secret exfiltration
Suspicious network referencesmediumczlonkowski-n8n-mcp-b604bea/tests/unit/multi-tenant-integration.test.ts
raw IP URL (31 URLs)
External endpoints declaredmediumexpected for this capabilityczlonkowski-n8n-mcp-b604bea/tests/unit/multi-tenant-integration.test.ts
17 distinct host(s)
Suspicious code patternsmediumexpected for this capabilityczlonkowski-n8n-mcp-b604bea/tests/unit/services/config-validator-security.test.ts
OS command execution; dynamic code execution
Embedded credentialshighexpected for this capabilityczlonkowski-n8n-mcp-b604bea/tests/unit/services/credential-scanner.test.ts
found: private key, AWS access key id, GitHub token, Stripe live key, API secret key (sk-)
Embedded credentialshighexpected for this capabilityczlonkowski-n8n-mcp-b604bea/tests/unit/services/error-execution-processor.test.ts
found: private key, hardcoded credential
Suspicious network referencesmediumczlonkowski-n8n-mcp-b604bea/tests/unit/services/n8n-api-client.test.ts
raw IP URL (22 URLs)
Egress to a private/loopback hosthighexpected for this capabilityczlonkowski-n8n-mcp-b604bea/tests/unit/services/n8n-api-client.test.ts
169.254.169.254
Embedded credentialshighexpected for this capabilityczlonkowski-n8n-mcp-b604bea/tests/unit/telemetry/telemetry-events.test.ts
found: AWS access key id, GitHub token
Embedded credentialshighexpected for this capabilityczlonkowski-n8n-mcp-b604bea/tests/unit/telemetry/workflow-sanitizer.test.ts
found: AWS access key id, GitHub token, API secret key (sk-), Slack token, DB connection string with credentials
External endpoints declaredmediumexpected for this capabilityczlonkowski-n8n-mcp-b604bea/tests/unit/telemetry/workflow-sanitizer.test.ts
12 distinct host(s)
Suspicious network referencesmediumczlonkowski-n8n-mcp-b604bea/tests/unit/types/instance-context-multi-tenant.test.ts
raw IP URL (91 URLs)
Egress to a private/loopback hosthighexpected for this capabilityczlonkowski-n8n-mcp-b604bea/tests/unit/types/instance-context-multi-tenant.test.ts
192.168.1.1, 10.0.0.1, 172.16.0.1, 192.168.1.100, 0.0.0.0, 255.255.255.255, [::1], 127.0.0.1
External endpoints declaredmediumexpected for this capabilityczlonkowski-n8n-mcp-b604bea/tests/unit/types/instance-context-multi-tenant.test.ts
44 distinct host(s)
Suspicious network referencesmediumczlonkowski-n8n-mcp-b604bea/tests/unit/utils/ssrf-protection.test.ts
raw IP URL (140 URLs)
Egress to a private/loopback hosthighexpected for this capabilityczlonkowski-n8n-mcp-b604bea/tests/unit/utils/ssrf-protection.test.ts
127.0.0.1, [::1], 169.254.169.254, 100.100.100.200, 10.0.0.1, 192.168.1.1, 172.16.0.1, 172.31.255.255, 169.254.170.2, [64:ff9b::a9fe:a9fe], 0.0.0.0, [::ffff:a9fe:a9fe], [::ffff:7f00:1], [::ffff:a00:1], [::ffff:c0a8:101], [::ffff:ac10:1], [fe80::1], [fc00::1], [fd00::1], [fcba::1], [fd12:3456::], fcexample.com, fdexample.com, [64:ff9b::7f00:1], [64:ff9b::a00:1], [64:ff9b::ac10:1], [64:ff9b::c0a8:1]
External endpoints declaredmediumexpected for this capabilityczlonkowski-n8n-mcp-b604bea/tests/unit/utils/ssrf-protection.test.ts
74 distinct host(s)
Vulnerable dependenciescritical
77 known vulnerabilities in: @anthropic-ai/sdk@0.90.0, @azure/identity@3.4.2, @grpc/grpc-js@1.14.3, @opentelemetry/core@2.0.0, @opentelemetry/core@2.1.0, @opentelemetry/core@2.7.1, @opentelemetry/exporter-prometheus@0.204.0, @opentelemetry/sdk-node@0.204.0