MCP Remote
v0.0.18
Remote MCP server connection over HTTP with SSE transport. WARNING: Critical command injection vulnerability (CVE-2025-6514).
By Glen MaddernMIT
typescript
developer tools
1.9Kstars
42.0Kdownloads
245forks
Scanned Feb 1, 2026
F25%
Scanned 6d ago
Critical Issues
Vulnerabilities Found
3Crit
3High
3Med
3Low
4Info
Security ScoreF
25
out of 100
Vulnerabilities Found
3
Crit
3
High
3
Medi
3
Low
4
Info
Last scanned: 2/1/2026
Quality ScoreF
45
out of 100
45
Maint.
47
Popular
50
Docs
48
Compat
Maintenance45%
Popularity47%
Documentation50%
Compatibility48%
Maintenance45
Active
6 days agoCommit Frequency45%
Release Frequency41%
Issue Response45%
Popularity47
1.9K
Stars
42.0K
Downloads
245
Forks
Stars Score59%
Downloads Score71%
Forks Score62%
Documentation50
README Quality84%
Available Documentation
API DocsExamplesChangelog
Compatibility48
MCP Spec Compliance50%
Transport Support100%
Features
TypeScript
Supported Transports
SSEHTTP
Vulnerabilities(16)
3Critical
3High
3Medium
3Low
4Info
Filter:
READMEMCP Remote
View sourceMCP Remote
⚠️ SECURITY VULNERABILITY ⚠️
This package has a critical command injection vulnerability (CVE-2025-6514) with a CVSS score of 9.3.
Vulnerability Details
The mcp-remote package allows connecting to remote MCP servers over HTTP. However, versions prior to 0.0.19 have a critical command injection vulnerability where unsanitized server URLs can lead to arbitrary command execution.
Impact
An attacker can execute arbitrary commands on the client machine by crafting a malicious server URL.
Mitigation
Update to version 0.0.19 or later which includes input sanitization.
Original Features
- Connect to remote MCP servers
- SSE transport support
- URL-based server discovery
Embed Security Badge
Add this badge to your README or documentation
[](https://mcpsafe.org/registry/mcp-remote)Need more customization options?Badge Documentation
Server Information
- Source
- NPM
- Package
- mcp-remote
- Version
- 0.0.18
- Language
- typescript
- License
- MIT
- Transport
- SSEHTTP
- Added
- Jan 20, 2026
- Updated
- Feb 1, 2026