MMCP GitHub Issue ServerAn MCP server that provides LLMs with the ability to use GitHub issues as tasks

mcp-so:mcp-github-issue_sammcj

View source

100/100

First Seen

Feb 18, 2026

Last Scanned

Feb 20, 2026

Findings

Score

100/100

LOW 1

Findings (1)

LOW

npx auto-install without confirmation EXTDL_003

external-download L36

Detects npx with -y flag that bypasses user confirmation for package installation

npx -y

FIX

Replace npx -y with an explicit npm install step that pins the package to a specific version, then run it. Remove the -y flag to require user confirmation.

FP?

Likely FP if the npx command runs a well-known, trusted tool (e.g., create-react-app) in documentation context with no version pinning concern.