Adminapi Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Adminapi Mcp (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 29 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 29 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A comprehensive Model Context Protocol (MCP) server that enables AI assistants like Claude to manage CData Arc flows, messages, and application behavior through natural language interactions. Built with TypeScript and the MCP SDK, providing secure access to Arc's Admin API.
This MCP server provides complete administrative access to your CData Arc instance through natural language interactions. Claude can now create connectors, monitor transactions, manage configurations, troubleshoot issues, and perform administrative actions using conversational commands.
git clone https://github.com/your-username/cdata-arc-mcp-server.git
cd cdata-arc-mcp-server npm install npm run buildThis creates the compiled JavaScript files in the dist/ directory that Claude Desktop needs to run the MCP server.
Add to your Claude Desktop claude_desktop_config.json:
{
"mcpServers": {
"cdata-arc-server": {
"command": "node",
"args": ["C:/path/to/cdata-arc-mcp-server/dist/index.js"],
"env": {
"CDATA_BASE_URL": "http://localhost:8001/api.rsc",
"CDATA_AUTH_TOKEN": "your-api-token-here"
}
}
}
}Important Configuration Notes:
/ or escaped backslashes \\ in Windows pathslocalhost:8001 with your actual CData Arc instance URLdist/index.js file exists by running npm run build firstRequired:
CDATA_BASE_URL: Base URL for your CData Arc instance (e.g., http://localhost:8001/api.rsc)CDATA_AUTH_TOKEN: Your authtoken for your CData Arc instance (e.g., username:1234567890)Optional:
MCP_TRANSPORT_MODE: Transport mode - stdio (default) or httpMCP_HTTP_PORT: Port for HTTP transport (default: 3000)This MCP server supports two communication modes:
#### STDIO Mode (Default)
npm run start to test the server manually in stdio mode (it will wait for JSON-RPC messages on stdin)#### HTTP Mode
/health endpoint currently available (MCP protocol endpoints coming soon)MCP_TRANSPORT_MODE=http and optionally MCP_HTTP_PORT=3000npm run start:http with environment variables, then test the health endpoint at http://localhost:3000/health npm install
npm run build# Install and build
npm install
npm run build
# Run in development mode with file watching
npm run dev
# Start the server directly (for testing)
npm run startnpm run dev # Development mode with file watching and auto-restart
npm run build # Build TypeScript to JavaScript
npm run start # Start server in stdio mode (for manual testing - Claude Desktop normally handles this)
npm run start:http # Start server in HTTP mode on the port defined by `MCP_HTTP_PORT`
npm run typecheck # Type checking onlysrc/
├── index.ts # Main server entry point
├── services/
│ └── arc-client.ts # Arc API client with comprehensive error handling
├── tools/
│ ├── connector-tools.ts # Connector management and file operations
│ ├── monitoring-tools.ts # Logs, transactions, and message monitoring
│ ├── workspace-tools.ts # Workspace management operations
│ ├── certificate-tools.ts # Certificate creation and exchange
│ ├── vault-tools.ts # Vault/secrets management
│ ├── report-tools.ts # Report management
│ ├── request-tools.ts # API request monitoring
│ ├── action-tools.ts # Administrative actions (cleanup, export/import)
│ └── config-tools.ts # Profile and configuration management
├── types/
│ └── arc-api.ts # Complete TypeScript type definitions
└── admin_api_swagger.json # OpenAPI specificationCDATA_BASE_URL is correct and CData Arc instance is runningCDATA_AUTH_TOKEN is valid and has proper permissions/api.rsc is accessiblenpm run build to ensure TypeScript is compiledcurl -H "x-cdata-authtoken: YOUR_TOKEN" http://localhost:8001/api.rsc/connectorsSet NODE_ENV=development for additional debug logging:
{
"mcpServers": {
"cdata-arc-server": {
"command": "node",
"args": ["C:/path/to/dist/index.js"],
"env": {
"CDATA_BASE_URL": "http://localhost:8001/api.rsc",
"CDATA_AUTH_TOKEN": "your-token",
"NODE_ENV": "development"
}
}
}
}The server includes a complete OpenAPI specification (admin_api_swagger.json) with:
git checkout -b feature/amazing-feature)npm run lintnpm run build && npm run testgit commit -m 'Add amazing feature')git push origin feature/amazing-feature)MIT License - see LICENSE file for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.