Skillget

mslearn-mcp-chat

mcp
Guvenlik Denetimi
Basarisiz
Health Uyari
  • License — License: MIT
  • Description — Repository has a description
  • Active repo — Last push 0 days ago
  • Low visibility — Only 7 GitHub stars
Code Basarisiz
  • process.env — Environment variable access in pages/api/mcp-gemini.js
  • network request — Outbound network request in pages/api/mcp-gemini.js
  • process.env — Environment variable access in pages/api/mcp.js
  • network request — Outbound network request in pages/api/mcp.js
  • exec() — Shell command execution in pages/index.js
  • network request — Outbound network request in pages/index.js
Permissions Gecti
  • Permissions — No dangerous permissions requested
Purpose
This tool is a Next.js web application that acts as a chat interface. It connects to an external Microsoft Learn Docs MCP to retrieve information and provides a stylish UI for the user.

Security Assessment
Overall Risk: High. The audit raised a critical failure due to shell command execution (`exec()`) located inside the frontend `pages/index.js` file. Running shell commands from the client-side context is highly irregular and poses a severe risk of remote code execution, making the application highly vulnerable to exploitation. Additionally, the tool makes multiple outbound network requests and accesses environment variables to communicate with external AI services (Gemini and MS Learn). While standard for connecting to APIs, there are no obvious hardcoded secrets.

Quality Assessment
The project is very new and has minimal community traction, evidenced by a low visibility warning with only 7 GitHub stars. However, it is licensed under the standard MIT license, and the repository appears to be actively maintained based on recent push activity. The provided README is just a default Next.js boilerplate and lacks any specific instructions, environment variable guides, or architectural documentation for this custom implementation.

Verdict
Not recommended due to the highly dangerous client-side shell execution vulnerability.
SUMMARY

An AI Assistant that talks with MS Learn Docs MCP and offers a stylish Web UI for the user

README.md

This is a Next.js project bootstrapped with create-next-app.

Getting Started

First, run the development server:

npm run dev
# or
yarn dev
# or
pnpm dev
# or
bun dev

Open http://localhost:3000 with your browser to see the result.

You can start editing the page by modifying pages/index.js. The page auto-updates as you edit the file.

API routes can be accessed on http://localhost:3000/api/hello. This endpoint can be edited in pages/api/hello.js.

The pages/api directory is mapped to /api/*. Files in this directory are treated as API routes instead of React pages.

This project uses next/font to automatically optimize and load Geist, a new font family for Vercel.

Learn More

To learn more about Next.js, take a look at the following resources:

You can check out the Next.js GitHub repository - your feedback and contributions are welcome!

Deploy on Vercel

The easiest way to deploy your Next.js app is to use the Vercel Platform from the creators of Next.js.

Check out our Next.js deployment documentation for more details.

Yorumlar (0)

Sonuc bulunamadi