[GH-ISSUE #295] Security scan results for mcpo — MCPSafe AIVSS 84/100 (Grade B) #131

New issue

Closed

opened 2026-10-18 21:12:03 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-18 21:12:03 +00:00

Owner

Originally created by @mcpsafe-gh on GitHub (May 12, 2026).
Original GitHub issue: https://github.com/open-webui/mcpo/issues/295

Hi team 👋

I ran a free deep security scan of open-webui/mcpo using MCPSafe — a purpose-built scanner for MCP servers using a 5-LLM consensus panel to detect prompt injection risks, over-scoped tool schemas, supply chain issues, and more.

Results: 84/100 · Grade B

Severity	Count
🔴 Critical	0
🟠 High	1
🟡 Medium	20
🟢 Low	3

Summary: 1 high-severity finding in the proxy configuration layer, plus 20 medium-severity findings around tool routing and schema validation.

📋 Full report with findings and evidence: https://mcpsafe.io/registry/github/open-webui/mcpo

Add a security badge to your README

[![MCPSafe](https://api.mcpsafe.io/badge/github/open-webui/mcpo.svg)](https://mcpsafe.io/registry/github/open-webui/mcpo)

This badge auto-updates whenever a new scan runs — great for showing users and enterprise customers your security posture at a glance.

Feel free to close this if you're already tracking these findings. Happy to answer any questions about specific findings.

— Truong BUI · mcpsafe.io

Originally created by @mcpsafe-gh on GitHub (May 12, 2026). Original GitHub issue: https://github.com/open-webui/mcpo/issues/295 Hi team 👋 I ran a free deep security scan of **open-webui/mcpo** using [MCPSafe](https://mcpsafe.io) — a purpose-built scanner for MCP servers using a 5-LLM consensus panel to detect prompt injection risks, over-scoped tool schemas, supply chain issues, and more. ## Results: 84/100 · Grade B | Severity | Count | |----------|-------| | 🔴 Critical | 0 | | 🟠 High | 1 | | 🟡 Medium | 20 | | 🟢 Low | 3 | **Summary:** 1 high-severity finding in the proxy configuration layer, plus 20 medium-severity findings around tool routing and schema validation. 📋 **Full report with findings and evidence:** https://mcpsafe.io/registry/github/open-webui/mcpo --- ## Add a security badge to your README ```markdown [![MCPSafe](https://api.mcpsafe.io/badge/github/open-webui/mcpo.svg)](https://mcpsafe.io/registry/github/open-webui/mcpo) ``` This badge auto-updates whenever a new scan runs — great for showing users and enterprise customers your security posture at a glance. --- Feel free to close this if you're already tracking these findings. Happy to answer any questions about specific findings. — Truong BUI · [mcpsafe.io](https://mcpsafe.io)

bsakaguchi closed this issue

2026-10-18 21:12:03 +00:00

bsakaguchi referenced this issue

2026-10-18 21:12:31 +00:00

[PR #136] [MERGED] Issues/73 #185

bsakaguchi referenced this issue

2026-10-18 21:12:31 +00:00

[PR #131] [MERGED] dev #186