barryyip0625-mcp-discord

Security Findings (43)

• HighAS-012

  🔄Tool Drift

  Tool set changed silently at v1.3.9: 22 tool(s) added, 128 tool(s) removed without a version bump.

  + 22 added

  discord_add_multiple_reactionsdiscord_add_reactiondiscord_create_categorydiscord_create_forum_postdiscord_create_text_channeldiscord_create_webhookdiscord_delete_categorydiscord_delete_channeldiscord_delete_forum_postdiscord_delete_messagediscord_delete_webhookdiscord_edit_categorydiscord_edit_webhookdiscord_get_forum_channelsdiscord_get_forum_postdiscord_get_server_infodiscord_logindiscord_read_messagesdiscord_remove_reactiondiscord_reply_to_forumdiscord_senddiscord_send_webhook_message

  − 128 removed

  applications.commands.createapplications.commands.deleteapplications.commands.getapplications.commands.listapplications.commands.updateapplications.emojis.createapplications.emojis.deleteapplications.emojis.getapplications.emojis.listapplications.emojis.updateapplications.entitlements.consume.createapplications.entitlements.createapplications.entitlements.deleteapplications.entitlements.getapplications.entitlements.listapplications.getapplications.guilds.commands.createapplications.guilds.commands.deleteapplications.guilds.commands.getapplications.guilds.commands.listapplications.guilds.commands.permissions.by_guild_id.listapplications.guilds.commands.permissions.listapplications.guilds.commands.permissions.updateapplications.guilds.commands.updateapplications.me.listapplications.role_connections.metadata.listchannels.deletechannels.followers.createchannels.getchannels.invites.createchannels.invites.listchannels.messages.createchannels.messages.crosspost.createchannels.messages.deletechannels.messages.getchannels.messages.listchannels.messages.pins.listchannels.messages.reactions.by_emoji_name.deletechannels.messages.reactions.deletechannels.messages.reactions.getchannels.messages.reactions.me.deletechannels.messages.reactions.me.updatechannels.messages.threads.createchannels.messages.updatechannels.polls.answers.getchannels.polls.expire.createchannels.thread_members.deletechannels.thread_members.getchannels.thread_members.listchannels.thread_members.me.deletechannels.thread_members.me.updatechannels.thread_members.updatechannels.threads.archived.public.listchannels.threads.createchannels.threads.search.listchannels.typing.createchannels.updatechannels.users.me.threads.archived.private.listchannels.webhooks.createchannels.webhooks.listgateway.listguilds.audit_logs.listguilds.bans.getguilds.bans.listguilds.channels.createguilds.channels.listguilds.emojis.createguilds.emojis.deleteguilds.emojis.getguilds.emojis.listguilds.emojis.updateguilds.getguilds.invites.listguilds.members.by_user_id.updateguilds.members.getguilds.members.listguilds.members.me.updateguilds.members.roles.deleteguilds.members.roles.updateguilds.members.search.listguilds.members.updateguilds.onboarding.listguilds.preview.getguilds.regions.listguilds.roles.createguilds.roles.deleteguilds.roles.getguilds.roles.listguilds.roles.member_counts.listguilds.roles.updateguilds.scheduled_events.createguilds.scheduled_events.deleteguilds.scheduled_events.getguilds.scheduled_events.listguilds.scheduled_events.updateguilds.scheduled_events.users.listguilds.soundboard_sounds.createguilds.soundboard_sounds.deleteguilds.soundboard_sounds.getguilds.soundboard_sounds.listguilds.soundboard_sounds.updateguilds.templates.getguilds.threads.active.listguilds.welcome_screen.getinvites.getoauth2.keys.listoauth2.me.listsoundboard_default_sounds.liststicker_packs.listusers.getusers.me.applications.entitlements.listusers.me.channels.createusers.me.connections.listusers.me.guilds.listusers.me.guilds.member.getusers.me.listvoice.regions.listwebhooks.by_webhook_id.getwebhooks.by_webhook_id.updatewebhooks.createwebhooks.deletewebhooks.getwebhooks.github.createwebhooks.messages.deletewebhooks.messages.getwebhooks.messages.updatewebhooks.slack.createwebhooks.update

  Fix: The set of tools exposed by this server changed between scans of the same version — a sign the package was silently updated without a version bump. Audit the changelog and all tool definitions before trusting this server. Pin to a specific commit hash rather than a floating version tag.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×4

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  discord_create_webhookdiscord_send_webhook_messagediscord_edit_webhookdiscord_delete_webhook

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• InfoAS-002

  ⚠️Excessive Permissions ×12

  declared capabilities: filesystem access

  discord_create_categorydiscord_delete_categorydiscord_create_forum_postdiscord_create_text_channeldiscord_delete_channeldiscord_remove_reactiondiscord_delete_forum_postdiscord_delete_message

  declared capabilities: filesystem access, HTTP requests

  discord_create_webhookdiscord_delete_webhook

  declared capabilities: network access, HTTP requests

  discord_send_webhook_message

  declared capabilities: HTTP requests

  discord_edit_webhook

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×22

  No metadata.dependencies or repo_url were exposed by this MCP server, and no local project manifest could be inferred from the launch command.

  discord_create_categorydiscord_edit_categorydiscord_delete_categorydiscord_logindiscord_senddiscord_get_forum_channelsdiscord_create_forum_postdiscord_get_forum_postdiscord_reply_to_forumdiscord_create_text_channeldiscord_delete_channeldiscord_read_messagesdiscord_get_server_infodiscord_add_reactiondiscord_add_multiple_reactionsdiscord_remove_reactiondiscord_delete_forum_postdiscord_delete_messagediscord_create_webhookdiscord_send_webhook_messagediscord_edit_webhookdiscord_delete_webhook

  Fix: Review and remediate the identified issue.

• InfoAS-010

  🔑Insecure Secret Handling ×4

  input parameter "token" accepts a credential (informational; not evidence of insecure handling)

  discord_login

  input parameter "webhookToken" accepts a credential (informational; not evidence of insecure handling)

  discord_send_webhook_messagediscord_edit_webhookdiscord_delete_webhook

  Fix: Avoid accepting raw credentials as input parameters. Use secret managers (e.g. 1Password CLI, AWS Secrets Manager) and ensure credentials are never logged or stored in agent traces.