Anilist Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Anilist Mcp (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server that interfaces with the AniList API, allowing LLM clients to access and interact with anime, manga, character, staff, and user data from AniList.
mcp.json / claude_desktop_config.json:{
"mcpServers": {
"anilist": {
"command": "npx",
"args": ["-y", "anilist-mcp"],
"env": {
"ANILIST_TOKEN": "your_api_token"
}
}
}
}You may remove the env object entirely, if you are not planning to use the AniList Token for operations that require login.
Follow the Local Development instructions to set up the project locally, then run:
pnpm run start:httpThis will start the server on port 8081 by default. You can change the port by setting the PORT environment variable.
You can deploy this MCP server to any cloud platform that supports Node.js server applications.
You can also deploy via MCP platforms like Smithery.
When using the STDIO transport or hosting the HTTP transport server, you can pass configuration via environment variables:
ANILIST_TOKEN: (Optional) AniList API Token (Only needed for operations that require login)[!CAUTION] If you are hosting the HTTP transport server with token pre-configured, you should protect your endpoint and implement authentication before allowing users to access it. Otherwise, anyone can access your MCP server while using your AniList token.
When using the HTTP transport, user can pass configuration via HTTP headers:
Anilist-Token: (Optional) AniList API Token (Only needed for operations that require login)If the user provides the token in the header, while the server also has ANILIST_TOKEN set, the header value will take precedence.
To get an API token, follow these steps:
https://anilist.co/api/v2/oauth/pin{clientID} with the client ID you get. It will ask you to log in and then provide you with the token to use..env file or environment variables.Can you search for anime similar to "Bocchi the Rock!"?Can you tell me about the character Hitori Gotou? Use the AniList tools to find information.What anime has Studio Ghibli produced? Can you list their most popular works?This project uses pnpm as its package manager.
Clone the repository and install dependencies:
git clone https://github.com/yuna0x0/anilist-mcp.git
cd anilist-mcp
pnpm install.env file by copying the example:cp env.example .env.env file and add your AniList API token:ANILIST_TOKEN=your_api_tokenYou can use the MCP Inspector to test and debug the AniList MCP server:
npx @modelcontextprotocol/inspector -e ANILIST_TOKEN=your_api_token npx anilist-mcp
# Use this instead when Local Development
pnpm run inspectorThen open your browser to the provided URL (usually http://localhost:6274) to access the MCP Inspector interface. From there, you can:
This is particularly useful for testing your setup before connecting it to MCP clients like Claude Desktop.
Pull from GitHub Container Registry:
docker pull ghcr.io/yuna0x0/anilist-mcpDocker build (Local Development):
docker build -t ghcr.io/yuna0x0/anilist-mcp .Docker multi-platform build (Local Development):
docker buildx build --platform linux/amd64,linux/arm64 -t ghcr.io/yuna0x0/anilist-mcp .To create an MCP Bundle for this server, run:
pnpm run pack:mcpbThis MCP server accepts your AniList API token in the .env file, environment variable or HTTP header. Keep this information secure and never commit it to version control.
This project is licensed under the MIT License - see the LICENSE file for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.