OOpenai Deep Research McpOpenAI Deep Research MCP Server enables AI assistants to conduct comprehensive, multi-step research through intelligent web search and content synthesis. Transforms complex research queries into structured, citation-backed reports without writing custom search logic. Features iterative exploration, automatic knowledge gap identification, and seamless integration with OpenAI's Deep Research models for scholarly-quality research automation.

mcp-so:openai-deep-research-mcp_fbettag

View source
A
92/100

First Seen

Feb 18, 2026

Last Scanned

Feb 20, 2026

Findings

3

Score

92/100

MEDIUM 1
LOW 2

Findings (3)

MEDIUM
Benign heading "'@openai/agents:*'\n;\n// Verbose logging\n..." followed by dangerous content (category: credential_access)
L24

Benign heading "'@openai/agents:*'\n;\n// Verbose logging\n..." followed by dangerous content (category: credential_access)

report-generation
OpenAI Deep Research MCP Server enables AI assistants to conduct comprehensive, multi-step research through intelligent web search and content synthesis. Transforms complex research ...
FIX

Ensure section headings accurately reflect the content that follows. Remove headings that could mislead an LLM into treating content differently than intended.

FP?

Likely FP if the heading mismatch is due to inconsistent markdown formatting or a benign section title that happens to contain keywords like system or config.

LOW
npx MCP server without version pin
L59

Detects MCP server configs using npx to run packages without version pinning

"command": "npx"
FIX

Pin the npx package in the MCP config to an exact version (e.g., @scope/server@1.2.3). Unpinned npx commands can silently fetch a compromised package version.

FP?

Likely FP if the MCP config is a local development setup example, though unpinned npx in production configs is a real supply chain risk.

LOW
Hardcoded secrets in MCP env block
L63

Detects hardcoded API keys, tokens, or passwords in MCP server environment configuration

"env": { + "OPENAI_API_KEY": "sk-your-openai-api-key-here"
FIX

Remove shell metacharacters (semicolons, pipes, ampersands, backticks) from MCP server arguments. Use explicit argument arrays and avoid shell expansion in MCP configurations.

FP?

Likely FP if the metacharacter is a literal part of a non-shell argument (e.g., a regex pattern or a URL query parameter containing ampersands).