Is Esa Mcp Server safe to install?

SaferSkills independently audited Esa Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md6.5 KB · Markdown

[!IMPORTANT] An official MCP server has been released. Please use the official server going forward.

- esa公式のローカルMCPサーバーを公開しました - ReleaseNotes/2025/09/17 - docs.esa.io

esa MCP Server

A Model Context Protocol (MCP) server for esa.io.

Usage
Prerequisites
Configuration
Using npx
Using Docker
Read-only Mode
MCP Tools
Posts
Tags
Comments
License

Usage

Prerequisites

Before using this MCP server, you need to generate a personal access token from your esa.io team:

Go to https://<TEAM_NAME>.esa.io/user/applications
Create a new personal access token
Copy the token for configuration

Configuration

You can run the server either via npx or Docker.

#### Using npx

Add the following configuration to your MCP client:

{
  "mcpServers": {
    "esa": {
      "command": "npx",
      "args": [
        "-y",
        "@koki-develop/esa-mcp-server@latest"
      ],
      "env": {
        "ESA_TEAM": "<your-team-name>",
        "ESA_ACCESS_TOKEN": "<your-personal-access-token>"
      }
    }
  }
}

Replace <your-team-name> and <your-personal-access-token> with your team name and personal access token.

#### Using Docker

If you prefer Docker, use the following configuration:

{
  "mcpServers": {
    "esa": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "ESA_TEAM",
        "-e",
        "ESA_ACCESS_TOKEN",
        "ghcr.io/koki-develop/esa-mcp-server:latest"
      ],
      "env": {
        "ESA_TEAM": "<your-team-name>",
        "ESA_ACCESS_TOKEN": "<your-personal-access-token>"
      }
    }
  }
}

#### Read-only Mode

To enable read-only mode that only allows read operations, add the --readonly flag.

Using npx:

{
  "mcpServers": {
    "esa": {
      "command": "npx",
      "args": [
        "-y",
        "@koki-develop/esa-mcp-server@latest",
        "--readonly"
      ],
      "env": {
        "ESA_TEAM": "<your-team-name>",
        "ESA_ACCESS_TOKEN": "<your-personal-access-token>"
      }
    }
  }
}

Using Docker:

{
  "mcpServers": {
    "esa": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "ESA_TEAM",
        "-e",
        "ESA_ACCESS_TOKEN",
        "ghcr.io/koki-develop/esa-mcp-server:latest",
        "--readonly"
      ],
      "env": {
        "ESA_TEAM": "<your-team-name>",
        "ESA_ACCESS_TOKEN": "<your-personal-access-token>"
      }
    }
  }
}

In read-only mode, only the following operations are available:

get_posts - retrieve posts
get_post - retrieve a specific post
get_tags - retrieve tags
get_post_comments - retrieve post comments

Write operations (create_post, update_post, delete_post, create_post_comment, update_comment, delete_comment) are disabled.

Posts

Tool	Description
`get_posts`	Retrieve a list of posts from the esa team. Supports search queries, filtering, sorting, and pagination. Returns post metadata including title, content, tags, categories, author information, and engagement metrics (comments, stars, watches). Optionally includes comments and stargazers with the include parameter. Supports nested inclusion like 'comments,comments.stargazers'. Note: Post content (body_md) is truncated to 300 characters with a body_truncated field indicating if truncation occurred to reduce context size.
`get_post`	Retrieve a specific post from the esa team by post number. Returns complete post details including title, content (markdown), tags, category, author information, revision history, and engagement metrics. Optionally includes comments and stargazers. Supports nested inclusion like 'comments,comments.stargazers'.
`create_post`	Create a new post in the esa team. Requires a title and optionally accepts content, tags, category, WIP status, and other metadata. Returns the created post information including the assigned post number and URL.
`update_post`	Update an existing post in the esa team. Requires a post number and optionally accepts updated content, tags, category, WIP status, and other metadata. Returns the updated post information including revision details.
`delete_post`	Delete an existing post from the esa team. Requires a post number. The post will be permanently deleted and cannot be recovered. Returns a confirmation message upon successful deletion.

Tool	Description
`get_tags`	Get a list of all tags used in the esa team. Returns tags with their names and the number of posts they are attached to, sorted by post count in descending order. Supports pagination.

Comments

Tool	Description
`get_post_comments`	Retrieve a list of comments for a specific post from the esa team. Requires a post number and supports pagination. Returns comment metadata including content, author information, timestamps, and engagement metrics (stars).
`create_post_comment`	Create a new comment on an existing post in the esa team. Requires a post number and comment content in Markdown format. Returns the created comment information including ID, content, timestamps, and author details.
`update_comment`	Update an existing comment on a post in the esa team. Requires a comment ID and new content in Markdown format. Returns the updated comment information including content, timestamps, and author details.
`delete_comment`	Delete an existing comment from the esa team. Requires a comment ID. The comment will be permanently deleted and cannot be recovered. Returns a confirmation message upon successful deletion.

License

This project is licensed under the MIT License - see the LICENSE file for details.

Esa Mcp Server— agent skill

Is Esa Mcp Server safe to install?

esa MCP Server

Table of Contents

Usage

Prerequisites

Configuration

MCP Tools

Posts

Tags

Comments

License

Audit the pieces. Scan the whole. Decide.