LLimelink Mcp ServerMCP server for managing Limelink dynamic links. Create short links with platform-specific deep linking (iOS/Android), social media previews, and UTM tracking. Retrieve link details by suffix or full URL. Includes documentation resources and guided prompts for link creation and deep linking setup.ㅌ

mcp-so:limelink-mcp-server_hellovelop

View source
D
31/100

First Seen

Feb 18, 2026

Last Scanned

Feb 20, 2026

Findings

12

Score

31/100

HIGH 3
MEDIUM 3
LOW 6

Findings (12)

HIGH
MCP server auto-registration
L173

Detects automatic registration of MCP servers into agent configuration

claude mcp add
FIX

Pin the curl/wget download to a specific URL with version and verify the downloaded file's SHA-256 checksum before using it. Prefer package manager installs over raw downloads.

FP?

Likely FP if the download is from a well-known canonical source (e.g., official GitHub release) and the documentation includes checksum verification steps.

HIGH
MCP server auto-registration
L176

Detects automatic registration of MCP servers into agent configuration

claude mcp
add
FIX

Pin the curl/wget download to a specific URL with version and verify the downloaded file's SHA-256 checksum before using it. Prefer package manager installs over raw downloads.

FP?

Likely FP if the download is from a well-known canonical source (e.g., official GitHub release) and the documentation includes checksum verification steps.

HIGH
MCP server auto-registration
L185

Detects automatic registration of MCP servers into agent configuration

claude mcp
add
FIX

Pin the curl/wget download to a specific URL with version and verify the downloaded file's SHA-256 checksum before using it. Prefer package manager installs over raw downloads.

FP?

Likely FP if the download is from a well-known canonical source (e.g., official GitHub release) and the documentation includes checksum verification steps.

MEDIUM
Auto-confirm flag bypassing user verification
L102

Detects -y, --yes, or --auto-approve flags in MCP/skill install commands that bypass user confirmation

"-y"
FIX

Remove the -y/--yes auto-confirm flag from MCP server launch arguments. This flag bypasses user confirmation prompts and allows unattended execution of potentially dangerous operations.

FP?

Likely FP if the matched text is an isolated flag (-y or --yes) in documentation describing command-line options, not in an actual MCP config.

MEDIUM
Auto-confirm flag bypassing user verification
L129

Detects -y, --yes, or --auto-approve flags in MCP/skill install commands that bypass user confirmation

"-y"
FIX

Remove the -y/--yes auto-confirm flag from MCP server launch arguments. This flag bypasses user confirmation prompts and allows unattended execution of potentially dangerous operations.

FP?

Likely FP if the matched text is an isolated flag (-y or --yes) in documentation describing command-line options, not in an actual MCP config.

MEDIUM
Auto-confirm flag bypassing user verification
L444

Detects -y, --yes, or --auto-approve flags in MCP/skill install commands that bypass user confirmation

"-y"
FIX

Remove the -y/--yes auto-confirm flag from MCP server launch arguments. This flag bypasses user confirmation prompts and allows unattended execution of potentially dangerous operations.

FP?

Likely FP if the matched text is an isolated flag (-y or --yes) in documentation describing command-line options, not in an actual MCP config.

LOW
npx MCP server without version pin
L95

Detects MCP server configs using npx to run packages without version pinning

"command"
:
"npx"
FIX

Pin the npx package in the MCP config to an exact version (e.g., @scope/server@1.2.3). Unpinned npx commands can silently fetch a compromised package version.

FP?

Likely FP if the MCP config is a local development setup example, though unpinned npx in production configs is a real supply chain risk.

LOW
npx MCP server without version pin
L122

Detects MCP server configs using npx to run packages without version pinning

"command"
:
"npx"
FIX

Pin the npx package in the MCP config to an exact version (e.g., @scope/server@1.2.3). Unpinned npx commands can silently fetch a compromised package version.

FP?

Likely FP if the MCP config is a local development setup example, though unpinned npx in production configs is a real supply chain risk.

LOW
Global package installation
L145

Detects global installation of packages which affects the host system

npm
install
-g
l
FIX

Replace npm install -g with a local install (npm install --save-dev) or use npx with a pinned version. Global installs modify the system and risk supply chain attacks.

FP?

Likely FP if the global install is for a well-known CLI tool (e.g., typescript, eslint) in setup documentation, though the supply chain risk remains real.

LOW
npx auto-install without confirmation
L181

Detects npx with -y flag that bypasses user confirmation for package installation

npx
-y
FIX

Replace npx -y with an explicit npm install step that pins the package to a specific version, then run it. Remove the -y flag to require user confirmation.

FP?

Likely FP if the npx command runs a well-known, trusted tool (e.g., create-react-app) in documentation context with no version pinning concern.

LOW
npx auto-install without confirmation
L197

Detects npx with -y flag that bypasses user confirmation for package installation

npx
-y
FIX

Replace npx -y with an explicit npm install step that pins the package to a specific version, then run it. Remove the -y flag to require user confirmation.

FP?

Likely FP if the npx command runs a well-known, trusted tool (e.g., create-react-app) in documentation context with no version pinning concern.

LOW
npx MCP server without version pin
L442

Detects MCP server configs using npx to run packages without version pinning

"command": "npx"
FIX

Pin the npx package in the MCP config to an exact version (e.g., @scope/server@1.2.3). Unpinned npx commands can silently fetch a compromised package version.

FP?

Likely FP if the MCP config is a local development setup example, though unpinned npx in production configs is a real supply chain risk.