Guides for using mcp servers skills like 12306-mcp.

• Best MCP Servers in 2026

  Category-by-category picks: databases, dev tools, productivity, browser automation.
• What is an AI Skills Marketplace?

  Definitions, how marketplaces work, and how to choose between them in 2026.
• Getting Started with AI Skills

  First-time install walkthrough for Claude Code, Codex CLI, and ChatGPT.

Last scanned: 5/6/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@modelcontextprotocol/inspector: MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "@modelcontextprotocol/sdk: Anthropic's MCP TypeScript SDK has a ReDoS vulnerability",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "ajv: ajv has ReDoS when using `$data` option",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "axios: Axios is vulnerable to DoS attack through lack of data size check",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "body-parser: body-parser is vulnerable to denial of service when url encoding is used",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "diff: jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "follow-redirects: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "lodash: Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "qs: qs's arrayLimit bypass in comma parsing allows denial of service",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "serve-handler: Vulnerability found",
      "severity": "high"
    }
  ],
  "status": "WARNING",
  "scannedAt": "2026-05-06T06:29:59.563Z",
  "semgrepRan": false,
  "npmAuditRan": true,
  "pipAuditRan": true
}