← MCP Security Catalog

Node Runner MCP Server 1.2.2

npm · mcp-node · latest release

Confirmed vulnerable
Security result
11
Observed tools
32
Version rating
100
Change risk

Independent inventory

Observed 2026-08-15T21:11:23.401Z using mcpSecurity-inventory. Protocol 2025-06-18.

ToolCategoryRisk
get-node-versionGet the version of Node.js the scripts will be executed with
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {}
}
get-server-logsGet the last N lines of logs from a running server
Input schema
{
  "type": "object",
  "properties": {
    "serverId": {
      "type": "string",
      "description": "ID of the server to get logs from"
    },
    "lines": {
      "type": "number",
      "description": "Number of log lines to retrieve (default: 50)"
    },
    "filter": {
      "type": "string",
      "description": "Optional string to filter logs (case-insensitive)"
    },
    "stdout": {
      "type": "boolean",
      "description": "Show stdout logs (default: true)"
    },
    "stderr": {
      "type": "boolean",
      "description": "Show stderr logs (default: true)"
    }
  },
  "required": [
    "serverId"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
list-node-versionsGet available Node.js versions installed via NVM
Input schema
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "type": "object",
  "properties": {}
}
list-serversList all running Node.js servers started via MCP
Input schema
{
  "type": "object",
  "properties": {
    "showLogs": {
      "type": "boolean",
      "description": "Whether to include recent logs (default: false)"
    },
    "serverId": {
      "type": "string",
      "description": "Optional server ID to get details for a specific server"
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
run-node-evalExecute JavaScript code directly with Node.js eval. Optionally specify a directory to execute in.
Input schema
{
  "type": "object",
  "properties": {
    "code": {
      "type": "string",
      "description": "JavaScript code to execute"
    },
    "evalDirectory": {
      "type": "string",
      "description": "Directory to execute the code in (must be an allowed directory)"
    },
    "stdin": {
      "type": "string",
      "description": "Optional input to provide to the script's standard input"
    },
    "timeout": {
      "type": "number",
      "description": "Timeout in milliseconds after which the process is killed"
    }
  },
  "required": [
    "code"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
run-node-scriptExecute a Node.js script file locally
Input schema
{
  "type": "object",
  "properties": {
    "scriptPath": {
      "type": "string",
      "description": "Path to the Node.js script to execute, this should be present on disk"
    },
    "nodeArgs": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Optional arguments to pass to the Node.js executable itselfm, like --test"
    },
    "args": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Optional arguments to pass to the script"
    },
    "stdin": {
      "type": "string",
      "description": "Optional input to provide to the script's standard input"
    },
    "cwd": {
      "type": "string",
      "description": "Directory to run the script in (current working directory)"
    },
    "timeout": {
      "type": "number",
      "description": "Timeout in milliseconds after which the process is killed"
    }
  },
  "required": [
    "scriptPath"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
run-npm-installExecute npm install to install all dependencies or a specific package
Input schema
{
  "type": "object",
  "properties": {
    "packageDir": {
      "type": "string",
      "description": "Directory containing package.json"
    },
    "dependency": {
      "type": "string",
      "description": "Optional specific dependency to install (leave empty to install all dependencies from package.json)"
    }
  },
  "required": [
    "packageDir"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
run-npm-scriptExecute an npm script from package.json
Input schema
{
  "type": "object",
  "properties": {
    "packageDir": {
      "type": "string",
      "description": "Directory containing package.json"
    },
    "scriptName": {
      "type": "string",
      "description": "Name of the script to run"
    },
    "args": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Optional arguments to pass to the script"
    },
    "stdin": {
      "type": "string",
      "description": "Optional input to provide to the script's standard input"
    }
  },
  "required": [
    "packageDir",
    "scriptName"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
select-node-versionSelect a specific Node.js version to use for subsequent script executions
Input schema
{
  "type": "object",
  "properties": {
    "version": {
      "type": "string",
      "description": "Node.js version to use (e.g., 'v18.20.5', 'system', 'lts/*', or other NVM aliases)"
    }
  },
  "required": [
    "version"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
start-node-serverStart a Node.js server that continues running in the background
Input schema
{
  "type": "object",
  "properties": {
    "scriptPath": {
      "type": "string",
      "description": "Path to the Node.js server script to execute"
    },
    "cwd": {
      "type": "string",
      "description": "Directory to run the server in"
    },
    "serverName": {
      "type": "string",
      "description": "Optional friendly name for the server (defaults to filename)"
    },
    "nodeArgs": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Optional arguments to pass to the Node.js executable itself"
    },
    "args": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Optional arguments to pass to the server script"
    }
  },
  "required": [
    "scriptPath",
    "cwd"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
stop-serverStop a running Node.js server
Input schema
{
  "type": "object",
  "properties": {
    "serverId": {
      "type": "string",
      "description": "ID of the server to stop"
    },
    "force": {
      "type": "boolean",
      "description": "Whether to force kill the server (SIGKILL instead of SIGTERM)"
    }
  },
  "required": [
    "serverId"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}

Resources 1

Resource templates 0

Prompts 0

Changes from previous version

Compared with initial baseline using full_baseline.

RiskChangeSubject
No material changes recorded.

Confirmed vulnerabilities

SeverityFindingAdvisory
No confirmed vulnerability is published for this version.

Provenance

Artifact SHA-256: 20625809160abe50ad736cfd49e0e623591122e0de5a286cf1d587d64068b388

Scanner: mcp-proof-engine 0.1.0.

Let’s talk about MCP security.

Share your details and our security team will contact you.