MMCP EChartsGenerate Apache ECharts diagram and chart with AI MCP dynamically. Using for chart generation and data analysis. ✨ Features - Fully support all features and syntax of ECharts, include data, style, theme and so on. - Support exporting to png, svg, and option formats, with validation for ECharts to facilitate the model's multi-round output of correct syntax and graphics. - Lightweight, we can install it with zero dependence. - Extremely secure, fully generated locally, without relying on any remote services. šŸ¤– Usage To use with Desktop APP, such as Claude, VSCode, Cline, Cherry Studio, and so on, add the MCP server config below. On Mac system: { "mcpServers": { "mcp-echarts": { "command": "npx", "args": [ "-y", "mcp-echarts" ] } } } On Window system: { "mcpServers": { "mcp-echarts": { "command": "cmd", "args": [ "/c", "npx", "-y", "mcp-echarts" ] } } } Also, you can use it on aliyun, modelscope, glama.ai, smithery.ai or others with HTTP, SSE Protocol.

mcp-so:mcp-echarts_hustcc

View source
B
76/100

First Seen

Feb 18, 2026

Last Scanned

Feb 20, 2026

Findings

7

Score

76/100

MEDIUM 3
LOW 4

Findings (7)

MEDIUM
Auto-confirm flag bypassing user verification
L37

Detects -y, --yes, or --auto-approve flags in MCP/skill install commands that bypass user confirmation

"-y"
FIX

Remove the -y/--yes auto-confirm flag from MCP server launch arguments. This flag bypasses user confirmation prompts and allows unattended execution of potentially dangerous operations.

FP?

Likely FP if the matched text is an isolated flag (-y or --yes) in documentation describing command-line options, not in an actual MCP config.

MEDIUM
Auto-confirm flag bypassing user verification
L52

Detects -y, --yes, or --auto-approve flags in MCP/skill install commands that bypass user confirmation

"-y"
FIX

Remove the -y/--yes auto-confirm flag from MCP server launch arguments. This flag bypasses user confirmation prompts and allows unattended execution of potentially dangerous operations.

FP?

Likely FP if the matched text is an isolated flag (-y or --yes) in documentation describing command-line options, not in an actual MCP config.

MEDIUM
Auto-confirm flag bypassing user verification
L94

Detects -y, --yes, or --auto-approve flags in MCP/skill install commands that bypass user confirmation

"-y"
FIX

Remove the -y/--yes auto-confirm flag from MCP server launch arguments. This flag bypasses user confirmation prompts and allows unattended execution of potentially dangerous operations.

FP?

Likely FP if the matched text is an isolated flag (-y or --yes) in documentation describing command-line options, not in an actual MCP config.

LOW
npx MCP server without version pin
L35

Detects MCP server configs using npx to run packages without version pinning

"command": "npx"
FIX

Pin the npx package in the MCP config to an exact version (e.g., @scope/server@1.2.3). Unpinned npx commands can silently fetch a compromised package version.

FP?

Likely FP if the MCP config is a local development setup example, though unpinned npx in production configs is a real supply chain risk.

LOW
npx auto-install without confirmation
L67

Detects npx with -y flag that bypasses user confirmation for package installation

npx -y 
FIX

Replace npx -y with an explicit npm install step that pins the package to a specific version, then run it. Remove the -y flag to require user confirmation.

FP?

Likely FP if the npx command runs a well-known, trusted tool (e.g., create-react-app) in documentation context with no version pinning concern.

LOW
npx auto-install without confirmation
L69

Detects npx with -y flag that bypasses user confirmation for package installation

npx -y 
FIX

Replace npx -y with an explicit npm install step that pins the package to a specific version, then run it. Remove the -y flag to require user confirmation.

FP?

Likely FP if the npx command runs a well-known, trusted tool (e.g., create-react-app) in documentation context with no version pinning concern.

LOW
npx MCP server without version pin
L92

Detects MCP server configs using npx to run packages without version pinning

"command": "npx"
FIX

Pin the npx package in the MCP config to an exact version (e.g., @scope/server@1.2.3). Unpinned npx commands can silently fetch a compromised package version.

FP?

Likely FP if the MCP config is a local development setup example, though unpinned npx in production configs is a real supply chain risk.