Skip to content

mcp-from-openapi

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Behind the package

View on npm

Explore what the publisher declares for the latest npm release. These details are not a safety score; listed attestations have not been independently verified here.

Production-ready library for converting OpenAPI specifications into MCP tool definitions

Latest release2.9.3
Declared licenseApache-2.0
Listed maintainersdavidfrontegg
Runtime dependencies3
Install-time scriptsNone declared
Integrity metadataRecorded by registry
Attestation metadataRecorded, not verified here
Registry deprecationNot marked deprecated
Direct dependencies of 2.9.3

Fetched 15/11/2026, 02:29:19 UTC · Original registry metadata

Release history

Explore up to 40 recent releases. Pick a version for an OSV check; registry metadata alone does not tell you whether a release has known vulnerabilities.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium6.3
CVE-2026-115751

mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname

Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target can append a root dot to a blocked hostname to fetch content from operator-blocked hosts.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

agentfront · mcp-from-openapi
medium6.3
CVE-2026-115750

mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects

mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwards them on cross-origin redirects. Attackers controlling a spec host or abusing an open redirect can redirect fromURL() spec requests to their own origin to steal bearer tokens or cookies.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

agentfront · mcp-from-openapi