I wrote this sample go-live audit of a public open-source MCP server (MIT license, commit 9b38727). It is not a client project, and the maintainers did not commission it. I traced the read-only query guard through the source, ran the offline suite (1,870 tests passed, 99% coverage), and wrote up four findings with file and line references and fixes. The top finding: the query timeout is client-side only, so a heavy query can keep running on the database.
0 likes · 0 views · Nov 1, 2026
I wrote this sample go-live audit of a public open-source MCP server. It is not a client project.
