VValyu MCP ServerTypescript implementation of MCP server for Valyu Network API (

mcp-so:valyu-mcp-js_valyu-network

View source

92/100

First Seen

Feb 18, 2026

Last Scanned

Feb 20, 2026

Findings

Score

92/100

MEDIUM 1

Findings (1)

MEDIUM

Docker pull and run untrusted image EXTDL_015

external-download L43

Detects pulling and running Docker images from external registries

docker pull ghcr.io/tiovikram/valyu-mcp-server

FIX

Pin Docker images to a specific digest (e.g., image@sha256:abc...) instead of using mutable tags like :latest. Use trusted base images from verified publishers.

FP?

Likely FP if the Docker command pulls a well-known official image (e.g., docker pull python:3.11) in setup documentation.