Aguara Watch

SSharePoint MCP Server Node.js-Based REST API. The Most Powerful SharePoint MCP to DateThis MCP server for Claude Desktop allows you to interact with SharePoint Online using the SharePoint REST API. It is designed to be used with the Claude Desktop app, but can also be used by other MCP clients. A lot of supported operations

mcp-so:SharePoint MCP Server_Zerg00s

View source
B
84/100

First Seen

Feb 19, 2026

Last Scanned

Feb 20, 2026

Findings

4

Score

84/100

MEDIUM 2
LOW 2

Findings (4)

MEDIUM
Auto-confirm flag bypassing user verification
L96

Detects -y, --yes, or --auto-approve flags in MCP/skill install commands that bypass user confirmation

"-y"
FIX

Remove the -y/--yes auto-confirm flag from MCP server launch arguments. This flag bypasses user confirmation prompts and allows unattended execution of potentially dangerous operations.

FP?

Likely FP if the matched text is an isolated flag (-y or --yes) in documentation describing command-line options, not in an actual MCP config.

MEDIUM
Auto-confirm flag bypassing user verification
L126

Detects -y, --yes, or --auto-approve flags in MCP/skill install commands that bypass user confirmation

"-y"
FIX

Remove the -y/--yes auto-confirm flag from MCP server launch arguments. This flag bypasses user confirmation prompts and allows unattended execution of potentially dangerous operations.

FP?

Likely FP if the matched text is an isolated flag (-y or --yes) in documentation describing command-line options, not in an actual MCP config.

LOW
npx MCP server without version pin
L89

Detects MCP server configs using npx to run packages without version pinning

"command"
:
"npx"
FIX

Pin the npx package in the MCP config to an exact version (e.g., @scope/server@1.2.3). Unpinned npx commands can silently fetch a compromised package version.

FP?

Likely FP if the MCP config is a local development setup example, though unpinned npx in production configs is a real supply chain risk.

LOW
npx MCP server without version pin
L124

Detects MCP server configs using npx to run packages without version pinning

"command": "npx"
FIX

Pin the npx package in the MCP config to an exact version (e.g., @scope/server@1.2.3). Unpinned npx commands can silently fetch a compromised package version.

FP?

Likely FP if the MCP config is a local development setup example, though unpinned npx in production configs is a real supply chain risk.