SSidemailSidemail.io's official MCP Server. Provides Model Context Protocol (MCP) integration for Sidemail.io, enabling programmatic access to Sidemail's transactional emails, contacts, domains, and Messenger features for product updates and newsletters via MCP agent mode (in VS Code, Claude, Cursor and other MCP clients).
mcp-so:sidemail_Sidemail
View sourceFirst Seen
Feb 18, 2026
Last Scanned
Feb 20, 2026
Findings
17
Score
0/100
Findings (17)
Detects zero-width characters used to hide content
Remove hidden directives embedded in markdown, HTML comments, or encoded text. All agent-facing text should be explicit and visible in the skill definition.
Likely FP if the match is a standard markdown formatting pattern or HTML comment used for documentation rather than concealing directives.
Detects zero-width characters used to hide content
Remove hidden directives embedded in markdown, HTML comments, or encoded text. All agent-facing text should be explicit and visible in the skill definition.
Likely FP if the match is a standard markdown formatting pattern or HTML comment used for documentation rather than concealing directives.
Detects zero-width characters used to hide content
Remove hidden directives embedded in markdown, HTML comments, or encoded text. All agent-facing text should be explicit and visible in the skill definition.
Likely FP if the match is a standard markdown formatting pattern or HTML comment used for documentation rather than concealing directives.
Detects zero-width characters used to hide content
Remove hidden directives embedded in markdown, HTML comments, or encoded text. All agent-facing text should be explicit and visible in the skill definition.
Likely FP if the match is a standard markdown formatting pattern or HTML comment used for documentation rather than concealing directives.
Detects zero-width characters used to hide content
Remove hidden directives embedded in markdown, HTML comments, or encoded text. All agent-facing text should be explicit and visible in the skill definition.
Likely FP if the match is a standard markdown formatting pattern or HTML comment used for documentation rather than concealing directives.
Detects zero-width characters used to hide content
Remove hidden directives embedded in markdown, HTML comments, or encoded text. All agent-facing text should be explicit and visible in the skill definition.
Likely FP if the match is a standard markdown formatting pattern or HTML comment used for documentation rather than concealing directives.
Detects zero-width characters used to hide content
Remove hidden directives embedded in markdown, HTML comments, or encoded text. All agent-facing text should be explicit and visible in the skill definition.
Likely FP if the match is a standard markdown formatting pattern or HTML comment used for documentation rather than concealing directives.
Detects zero-width characters used to hide content
Remove hidden directives embedded in markdown, HTML comments, or encoded text. All agent-facing text should be explicit and visible in the skill definition.
Likely FP if the match is a standard markdown formatting pattern or HTML comment used for documentation rather than concealing directives.
Detects -y, --yes, or --auto-approve flags in MCP/skill install commands that bypass user confirmation
"-y" Remove the -y/--yes auto-confirm flag from MCP server launch arguments. This flag bypasses user confirmation prompts and allows unattended execution of potentially dangerous operations.
Likely FP if the matched text is an isolated flag (-y or --yes) in documentation describing command-line options, not in an actual MCP config.
Detects -y, --yes, or --auto-approve flags in MCP/skill install commands that bypass user confirmation
"-y" Remove the -y/--yes auto-confirm flag from MCP server launch arguments. This flag bypasses user confirmation prompts and allows unattended execution of potentially dangerous operations.
Likely FP if the matched text is an isolated flag (-y or --yes) in documentation describing command-line options, not in an actual MCP config.
Detects -y, --yes, or --auto-approve flags in MCP/skill install commands that bypass user confirmation
"-y" Remove the -y/--yes auto-confirm flag from MCP server launch arguments. This flag bypasses user confirmation prompts and allows unattended execution of potentially dangerous operations.
Likely FP if the matched text is an isolated flag (-y or --yes) in documentation describing command-line options, not in an actual MCP config.
Detects -y, --yes, or --auto-approve flags in MCP/skill install commands that bypass user confirmation
"-y" Remove the -y/--yes auto-confirm flag from MCP server launch arguments. This flag bypasses user confirmation prompts and allows unattended execution of potentially dangerous operations.
Likely FP if the matched text is an isolated flag (-y or --yes) in documentation describing command-line options, not in an actual MCP config.
Detects MCP server configs using npx to run packages without version pinning
"command"
:
"npx" Pin the npx package in the MCP config to an exact version (e.g., @scope/server@1.2.3). Unpinned npx commands can silently fetch a compromised package version.
Likely FP if the MCP config is a local development setup example, though unpinned npx in production configs is a real supply chain risk.
Detects MCP server configs using npx to run packages without version pinning
"command": "npx" Pin the npx package in the MCP config to an exact version (e.g., @scope/server@1.2.3). Unpinned npx commands can silently fetch a compromised package version.
Likely FP if the MCP config is a local development setup example, though unpinned npx in production configs is a real supply chain risk.
Detects MCP server configs using npx to run packages without version pinning
"command"
:
"npx" Pin the npx package in the MCP config to an exact version (e.g., @scope/server@1.2.3). Unpinned npx commands can silently fetch a compromised package version.
Likely FP if the MCP config is a local development setup example, though unpinned npx in production configs is a real supply chain risk.
Detects npx executing packages from unverified sources without pinned versions
npx @sidemail/mcp
Pin the npx package to an exact version (e.g., npx @scope/package@1.2.3). Unversioned npx commands can silently install a different or malicious package version.
Likely FP if the npx command targets a well-known package in documentation context, though unpinned versions are a real supply chain concern.
Detects MCP server configs using npx to run packages without version pinning
"command": "npx" Pin the npx package in the MCP config to an exact version (e.g., @scope/server@1.2.3). Unpinned npx commands can silently fetch a compromised package version.
Likely FP if the MCP config is a local development setup example, though unpinned npx in production configs is a real supply chain risk.