About ni-c/mcp-hub
ni-c/mcp-hub is an MCP server published by ni-c in the Security category: hub`.
The repository has 2 stars and 0 forks, with the last commit 10 days ago. Recent commit activity is the strongest signal that reported issues will get attention.
Install
From source
git clone https://github.com/ni-c/mcp-hubThis server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.
Ask AI
✦
Ask AI about ni-c/mcp-hub
Powered by Claude · Grounded in docs
I know everything about ni-c/mcp-hub. Ask me about installation, configuration, usage, or troubleshooting.
Security checks
6 checks have not been run yet.
Releases
v0.11.6v0.11.6 · 7 Oct 2026Security Upstream credentials stay with the authorization server that issued them** (GHSA-6qxp-vccf-f47h, high). An upstream names its authorization server on every discovery, which happens at least once an hour, and the hub refreshes,…
v0.11.5v0.11.5 · 6 Oct 2026Security `proxy-addr` 2.0.8 (was 2.0.7, GHSA-jqcg-44mw-7w3h, critical). A trust subnet written as an IPv4-mapped IPv6 block with a short prefix, such as `::ffff:10.0.0.0/8`, matched every IPv4 address. `trustedProxies` is handed to Express…
v0.11.4v0.11.4 · 27 Sep 2026Security An approval for one server was an approval for all of them.** The login and consent pages name the resource a client asks for under *Requested access*, but the approval was stored for the client and its redirect URI only. While…
v0.11.3v0.11.3 · 12 Sep 2026Security A remote upstream could redirect the hub anywhere.** The MCP requests to a remote server — `tools/call`, the event stream, `subscriptions/listen` — went out with the platform's default of following every redirect, and neither the…
v0.11.2v0.11.2 · 7 Sep 2026Security An unset password was an open login.** With neither `PASSWORD` nor `PASSWORD_HASH` configured, `checkPassword` compared the form field with an empty buffer — which matches an empty field — so anyone who could reach the port…