Sponsor MCPSafe10 founding slots
Registry/Core MCP Server

Core MCP Server

Verified

A framework helps you quickly build AI Native IDE products. MCP Client, supports Model Context Protocol (MCP) tools via MCP server.

MIT
other
other
3.7Kstars
451forks
Scanned Oct 2, 2026
WebsiteRepositoryGITHUB
Automated scan (limited checks) · Runs shell commands by design · scanned packages/addons, packages/ai-native and 28 more (1,738 of 2,738 files) · 2026-10-02

This grade comes from an automated MCPSafe scan of the server's JavaScript, TypeScript and Python source on 2026-10-02. The repository is too large to scan in full, so only the MCP server's own packages were scanned: packages/addons, packages/ai-native, packages/components, packages/connection, packages/core-browser, packages/core-common, packages/core-node, packages/debug, packages/design, packages/editor and 20 more (1,738 of 2,738 files). The grade says nothing about the rest of the repository. Runs shell commands by design: its run_terminal_cmd, terminal_execute_command, terminal_run_command tools run whatever shell command it is given, with the permissions of the user running it. That is its purpose, not a flaw, so it is not graded as command injection, but the grade is capped at C. It checks for leaked credentials, shell or code injection from function inputs, unsafe deserialization, malware signatures, install-time scripts, and weak password handling. It does not check for path traversal, server-side request forgery, prompt injection in tool descriptions, network exposure, SQL injection, cross-site scripting, or vulnerable dependencies. It has not been manually reviewed, and the code may have changed since the scan.

C65%
Scanned 10/2/2026

Fair Security

Vulnerabilities Found
0Crit
0High
1Med
0Low
0Info

Trust Score 57

Review required
Trust grade C

Trust is stricter than security: it combines reviewed security, MCP capability risk, supply-chain metadata, quality, popularity, freshness, and penalties for unknowns.

Security
65
MCP risk
52
Supply chain
74
Maintenance
45
Docs
100
Freshness
55
Risk traits
Runs shell commands
Filesystem access
Network/API access
Requires secrets
Why it scores well
  • • Good documentation surface
What reduces confidence
  • • Stale or missing recent scan
  • • MCP risk traits: Runs shell commands, Filesystem access, Network/API access

Security ScoreC

65
out of 100

Vulnerabilities Found

0
Crit
0
High
1
Medi
0
Low
0
Info
Last scanned: 10/2/2026

Quality ScoreC

67
out of 100
45
Maint.
54
Popular
100
Docs
72
Compat
Maintenance45%
Popularity54%
Documentation100%
Compatibility72%

Maintenance45

Unknown
Commit Frequency65%
Release Frequency35%
Issue Response25%

Popularity54

3.7K
Stars
0
Downloads
451
Forks
Stars Score100%
Downloads Score0%
Forks Score93%

Documentation100

README Quality100%

Available Documentation

API DocsExamplesChangelog

Compatibility72

MCP Spec Compliance80%
Transport Support75%

Features

TypeScript

Supported Transports

STDIO

Vulnerabilities(0)

This grade comes from an automated scan. Individual findings from automated scans are not published.

READMECore MCP Server

View source

<p align="center">

<a href="https://github.com/opensumi/core"><img src="https://img.alicdn.com/imgextra/i2/O1CN01dqjQei1tpbj9z9VPH_!!6000000005951-55-tps-87-78.svg" width="150" /></a>

</p>

<h1 align="center">OpenSumi</h1>

<p align="center">A framework helps you quickly build AI Native IDE products.</p>

<div align="center">

[![MCP][mcp-client-image]][mcp-client-url]

[![MCP Feature][mcp-client-feature-image]][mcp-client-feature-url]

[![CI][ci-image]][ci-url] [![E2E][e2e-image]][e2e-url] [![Test Coverage][test-image]][test-url] ![PRs Welcome](http://makeapullrequest.com) [![Issues need help][help-wanted-image]][help-wanted-url]

[![Discussions][discussions-image]][discussions-url] [![CLA assistant][cla-image]][cla-url] [![License][license-image]][license-url]

[![NPM Version][npm-image]][npm-url] [![NPM downloads][download-image]][download-url]

[![Open in CodeBlitz][codeblitz-image]][codeblitz-url]

[ci-image]: https://github.com/opensumi/core/actions/workflows/ci.yml/badge.svg

[ci-url]: https://github.com/opensumi/core/actions/workflows/ci.yml

[e2e-image]: https://github.com/opensumi/core/actions/workflows/e2e.yml/badge.svg

[e2e-url]: https://github.com/opensumi/core/actions/workflows/e2e.yml

[discussions-image]: https://img.shields.io/badge/discussions-on%20github-blue

[discussions-url]: https://github.com/opensumi/core/discussions

[npm-image]: https://img.shields.io/npm/v/@opensumi/ide-core-common.svg

[npm-url]: https://www.npmjs.com/package/@opensumi/ide-core-common

[download-image]: https://img.shields.io/npm/dm/@opensumi/ide-core-common.svg

[download-url]: https://npmjs.org/package/@opensumi/ide-core-common

[license-image]: https://img.shields.io/npm/l/@opensumi/ide-core-common.svg

[license-url]: https://github.com/opensumi/core/blob/main/LICENSE

[cla-image]: https://cla-assistant.io/readme/badge/opensumi/core

[cla-url]: https://cla-assistant.io/opensumi/core

[test-image]: https://codecov.io/gh/opensumi/core/branch/main/graph/badge.svg?token=07JAPLU957

[test-url]: https://codecov.io/gh/opensumi/core

[codeblitz-image]: https://img.shields.io/badge/AntCodespaces-Openin_CodeBlitz-1677ff

[codeblitz-url]: https://codeblitz.cloud.alipay.com/github/opensumi/core

[github-issues-url]: https://github.com/opensumi/core/issues

[help-wanted-image]: https://flat.badgen.net/github/label-issues/opensumi/core/🤔%20help%20wanted/open

[help-wanted-url]: https://github.com/opensumi/core/issues?q=is%3Aopen+is%3Aissue+label%3A%22🤔+help+wanted%22

[mcp-client-image]: https://badge.mcpx.dev/?type=client

[mcp-client-url]: https://modelcontextprotocol.io

[mcp-client-feature-image]: https://badge.mcpx.dev/?type=client&features=tools

[mcp-client-feature-url]: https://modelcontextprotocol.io/clients

Changelog · [Report Bug][github-issues-url] · [Request Feature][github-issues-url] · English · 中文

</div>

perview

🌟 Getting Started

Here you can find some of our example projects and templates:

⚡️ Development

bash
$ yarn install
$ yarn run init
$ yarn run download-extension  # Optional
$ yarn run start

By default, the tools/workspace folder in the project would be opened, or you can run the project by specifying the directory in the following way:

bash
$ MY_WORKSPACE={local_path} yarn run start

Usually, you may still encounter some system-level environment dependencies. You can visit Development Environment Preparation to see how to install the corresponding environment dependencies.

📕 Documentation

For complete documentation: opensumi.com

📍 ReleaseNotes & BreakingChanges

You can see all the releasenotes and breaking changes here: CHANGELOG.md.

🔥 Contributing

Read through our Contributing Guide to learn about our submission process, coding rules and more.

🙋‍♀️ Want to Help?

Want to report a bug, contribute some code, or improve documentation? Excellent! Read up on our Contributing Guidelines for contributing and then check out one of our issues labeled as help wanted or good first issue.

🧑‍💻 Needs some help?

Go to our issues or discussions to create a topic, it will be resolved as soon as we can.

✨ Contributors

Let's build a better OpenSumi together.

<table>

<tr>

<td>

<a href="https://next.ossinsight.io/widgets/official/compose-recent-top-contributors?repoid=429104828" target="blank" style="display: block" align="center">

<picture>

<source media="(prefers-color-scheme: dark)" srcset="https://next.ossinsight.io/widgets/official/compose-recent-top-contributors/thumbnail.png?repoid=429104828&imagesize=auto&color_scheme=dark" width="280">

<img alt="Top Contributors of ant-design/ant-design - Last 28 days" src="https://next.ossinsight.io/widgets/official/compose-recent-top-contributors/thumbnail.png?repoid=429104828&imagesize=auto&color_scheme=light" width="280">

</picture>

</a>

</td>

<td rowspan="2">

<a href="https://next.ossinsight.io/widgets/official/compose-last-28-days-stats?repoid=429104828" target="blank" style="display: block" align="center">

<picture>

<source media="(prefers-color-scheme: dark)" srcset="https://next.ossinsight.io/widgets/official/compose-last-28-days-stats/thumbnail.png?repoid=429104828&imagesize=auto&color_scheme=dark" width="655" height="auto">

<img alt="Performance Stats of ant-design/ant-design - Last 28 days" src="https://next.ossinsight.io/widgets/official/compose-last-28-days-stats/thumbnail.png?repoid=429104828&imagesize=auto&color_scheme=light" width="655" height="auto">

</picture>

</a>

</td>

</tr>

<tr>

<td>

<a href="https://next.ossinsight.io/widgets/official/compose-org-active-contributors?period=past28days&activity=active&ownerid=90233428&repoids=429104828" target="_blank" style="display: block" align="center">

<picture>

<source media="(prefers-color-scheme: dark)" srcset="https://next.ossinsight.io/widgets/official/compose-org-active-contributors/thumbnail.png?period=past28days&activity=active&ownerid=90233428&repoids=429104828&imagesize=2x3&colorscheme=dark" width="273" height="auto">

<img alt="Active participants of opensumi - past 28 days" src="https://next.ossinsight.io/widgets/official/compose-org-active-contributors/thumbnail.png?period=past28days&activity=active&ownerid=90233428&repoids=429104828&imagesize=2x3&colorscheme=light" width="273" height="auto">

</picture>

</a>

</td>

</tr>

</table>

We warmly invite contributions from everyone. Before you get started, please take a moment to review our Contributing Guide. Feel free to share your ideas through Pull Requests or GitHub Issues.

📃 License

Copyright (c) 2019-present Alibaba Group Holding Limited, Ant Group Co. Ltd.

Licensed under the MIT license.

This project contains various third-party code under other open source licenses.

See the NOTICE.md file for more information.

Embed Security Badge

Add this badge to your README or documentation

Core MCP Server MCPSafe Security
[![Core MCP Server MCPSafe Security](https://api.mcpsafe.org/api/badge/opensumi-core.svg)](https://mcpsafe.org/registry/opensumi-core)
Need more customization options?Badge Documentation

Server Information

Source
GITHUB
Language
other
License
MIT
Transport
STDIO
Added
Aug 11, 2026
Updated
Oct 1, 2026