# io.github.alex-feel/mcp-context-server > An MCP server that provides persistent multimodal context storage for LLM agents. - name: io.github.alex-feel/mcp-context-server - version: 2.2.2 - connection class: L0 (run_local_package) - trust: 74/100 - quality: –/100 (not scored) - owner: not claimed - descriptor: https://api.protogrid.dev/v1/servers/io.github.alex-feel%2Fmcp-context-server - tools: https://api.protogrid.dev/v1/servers/io.github.alex-feel%2Fmcp-context-server/tools **Runs on your machine: something must execute the package.** Only local packages are published (npm, PyPI, OCI, …). The registry never executes them, so tools are unknown until you run it. ## Connection (mcpServers) ```json { "mcpServers": { "mcp-context-server": { "command": "uvx", "args": [ "mcp-context-server==2.2.2" ], "env": { "POSTGRESQL_CONNECTION_STRING": "${POSTGRESQL_CONNECTION_STRING}", "POSTGRESQL_PASSWORD": "${POSTGRESQL_PASSWORD}", "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}", "OPENAI_API_KEY": "${OPENAI_API_KEY}", "AZURE_OPENAI_API_KEY": "${AZURE_OPENAI_API_KEY}", "HUGGINGFACEHUB_API_TOKEN": "${HUGGINGFACEHUB_API_TOKEN}", "VOYAGE_API_KEY": "${VOYAGE_API_KEY}", "LANGSMITH_API_KEY": "${LANGSMITH_API_KEY}", "MCP_AUTH_TOKEN": "${MCP_AUTH_TOKEN}" } } } } ``` Placeholders to fill: `${POSTGRESQL_CONNECTION_STRING}`, `${POSTGRESQL_PASSWORD}`, `${ANTHROPIC_API_KEY}`, `${OPENAI_API_KEY}`, `${AZURE_OPENAI_API_KEY}`, `${HUGGINGFACEHUB_API_TOKEN}`, `${VOYAGE_API_KEY}`, `${LANGSMITH_API_KEY}`, `${MCP_AUTH_TOKEN}`. ## Trust - hygiene: 95 - liveness: n/a - freshness: 45 - provenance: 80 - drivers: +repository +namespace-matches-repo ~liveness-unmeasured -stale-206d -unpinned-packages(1) - Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. ## Quality –/100 (not scored) Not scored: fewer than three checks apply, usually because no remote answered a credential-free probe or the server is a local package. ### protocol: n/a (weight 25) - n/a `protocol.modern`, `protocol.stateless`, `protocol.transport`, `protocol.list_ttl`: no remote answered a protocol handshake (not probed yet, unreachable, or local-only) ### authorization: n/a (weight 15) - n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth - n/a `auth.secret_in_url`: no templated URL ### tool hygiene: n/a (weight 30) - n/a `tools.descriptions`, `tools.description_length`, `tools.schemas`, `tools.annotations`, `tools.directory_hints`, `tools.token_cost`, `tools.api_dump`: tool list unknown (behind auth, not probed, or empty) ### stability: n/a (weight 15) - n/a `stability.changes`, `stability.rug_pull`: tool list unknown ### dependencies: 67 (weight 15) - fail `deps.known_vulns`: 3 advisories to act on (malicious, or rated high or critical with a fix available): GHSA-82r6-8w77-94w6 in anyio@4.12.1 (direct, fixed in 4.14.2), GHSA-rww4-4w9c-7733 in fastmcp@3.1.0 (direct, fixed in 3.2.0), GHSA-vv7q-7jx5-f767 in fastmcp@3.1.0 (direct, fixed in 3.2.0); 4 more of lower severity or without a fix - pass `deps.mcp_sdk_version`: mcp 1.30.0, no known advisory - pass `deps.resolvable`: mcp-context-server@2.2.2 resolved: 69 packages - tools: unknown - badge: [![protogrid quality](https://protogrid.dev/badge/io.github.alex-feel/mcp-context-server.svg)](https://protogrid.dev/servers/io.github.alex-feel/mcp-context-server) - Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. ### Tool changes _No tool definition changes recorded._ ## Dependencies - pypi mcp-context-server@2.2.2: resolved, 68 dependencies, MCP SDK mcp 1.30.0 - GHSA-82r6-8w77-94w6 (critical) in `` anyio@4.12.1 ``, direct, fixed in `` 4.14.2 ``, advisory summary: "AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing" https://osv.dev/vulnerability/GHSA-82r6-8w77-94w6 - GHSA-vv7q-7jx5-f767 (critical) in `` fastmcp@3.1.0 ``, direct, fixed in `` 3.2.0 ``, advisory summary: "FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability" https://osv.dev/vulnerability/GHSA-vv7q-7jx5-f767 - GHSA-rww4-4w9c-7733 (high) in `` fastmcp@3.1.0 ``, direct, fixed in `` 3.2.0 ``, advisory summary: "FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities" https://osv.dev/vulnerability/GHSA-rww4-4w9c-7733 - GHSA-5p39-cfhj-2xmp (moderate) in `` anyio@4.12.1 ``, direct, fixed in `` 4.14.2 ``, advisory summary: "AnyIO process-pool workers can block indefinitely on undrained stderr" https://osv.dev/vulnerability/GHSA-5p39-cfhj-2xmp - GHSA-m8x7-r2rg-vh5g (moderate) in `` fastmcp@3.1.0 ``, direct, fixed in `` 3.2.0 ``, advisory summary: "FastMCP has a Command Injection vulnerability - Gemini CLI" https://osv.dev/vulnerability/GHSA-m8x7-r2rg-vh5g - GHSA-4xgf-cpjx-pc3j (moderate) in `` pydantic-settings@2.12.0 ``, direct, fixed in `` 2.14.2 ``, advisory summary: "pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets\_dir, enabling local file read and bypassing secrets\_dir\_max\_size" https://osv.dev/vulnerability/GHSA-4xgf-cpjx-pc3j - GHSA-mf9w-mj56-hr94 (moderate) in `` python-dotenv@1.2.1 ``, direct, fixed in `` 1.2.2 ``, advisory summary: "python-dotenv: Symlink following in set\_key allows arbitrary file overwrite via cross-device rename fallback" https://osv.dev/vulnerability/GHSA-mf9w-mj56-hr94 Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0. ## Remotes _none_ ## Packages - pypi mcp-context-server@2.2.2 secrets: POSTGRESQL_CONNECTION_STRING, POSTGRESQL_PASSWORD, ANTHROPIC_API_KEY, OPENAI_API_KEY, AZURE_OPENAI_API_KEY, HUGGINGFACEHUB_API_TOKEN, VOYAGE_API_KEY, LANGSMITH_API_KEY, MCP_AUTH_TOKEN - oci ghcr.io/alex-feel/mcp-context-server:2.2.2 secrets: POSTGRESQL_CONNECTION_STRING, POSTGRESQL_PASSWORD, ANTHROPIC_API_KEY, OPENAI_API_KEY, AZURE_OPENAI_API_KEY, HUGGINGFACEHUB_API_TOKEN, VOYAGE_API_KEY, LANGSMITH_API_KEY, MCP_AUTH_TOKEN ## Tools (0) _none observed_