registry / record

mcp-server-fetch

npm / sealed 2026-06-16 / No. d0a1d7af

re-scan this server gate it in your CI

> throne registry mcp-server-fetch sealed

This target couldn't be started as an MCP serverserver process exited with code 2 before the MCP handshake — stderr: /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 1: /app: Permission denied /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 2: README.md: not found /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 3: README.md: not found /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 4: README.md: not fou [...] .npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 11: README.md: not found /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 12: src/: Permission denied /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 14: Syntax error: "(" unexpected

receiptsealed evidence

scan id: d0a1d7afac734e6aae8cd1008e53c016
target: mcp-server-fetch
sealed at: 2026-06-16 12:27:41Z
evidence hash: sha256:77ef5908f184068cd6cb48fa77d13cd98ae73b43759495993f6bc3986a2c9cb3

01connectFAIL0ms

server never launched: server process exited with code 2 before the MCP handshake — stderr: /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 1: /app: Permission denied /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 2: README.md: not found /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 3: README.md: not found /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 4: README.md: not fou [...] .npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 11: README.md: not found /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 12: src/: Permission denied /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 14: Syntax error: "(" unexpected

02discoverSKIPPED0ms

not run — server never launched

03validate_schemasSKIPPED0ms

not run — server never launched

04smoke_test_toolsSKIPPED0ms

not run — server never launched

05error_handlingSKIPPED0ms

not run — server never launched

06streamingSKIPPED0ms

not run — server never launched

07resource_lifecycleSKIPPED0ms

not run — server never launched

08concurrent_callsSKIPPED0ms

not run — server never launched

09reconnectSKIPPED0ms

not run — server never launched

01connectFAIL0ms

server never launched: server process exited with code 2 before the MCP handshake — stderr: /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 1: /app: Permission denied /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 2: README.md: not found /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 3: README.md: not found /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 4: README.md: not fou [...] .npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 11: README.md: not found /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 12: src/: Permission denied /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 14: Syntax error: "(" unexpected

02discoverSKIPPED0ms

not run — server never launched

03validate_schemasSKIPPED0ms

not run — server never launched

04smoke_test_toolsSKIPPED0ms

not run — server never launched

05error_handlingSKIPPED0ms

not run — server never launched

06streamingSKIPPED0ms

not run — server never launched

07resource_lifecycleSKIPPED0ms

not run — server never launched

08concurrent_callsSKIPPED0ms

not run — server never launched

09reconnectSKIPPED0ms

not run — server never launched

chatgpt desktopemulation profile pending real-traffic captureCOMING SOON

SECURITY: REVIEW / 2 finding(s), 1 high / review material, not a verdict

HIGHTHR-INSTALL-03 / Install-time script execution (npm lifecycle)

"postinstall" runs arbitrary code on every npm install: 'node index.js'

package/package.json

LOWTHR-NET-05 / Hardcoded outbound endpoints

1 non-local endpoint host(s) referenced in code — verify each is expected for this server's purpose: npx-canary-log.vulnerable-live.workers.dev (package/index.js:18)

package/index.js:18

VERDICT: INCONCLUSIVESANDBOXED RUN — submitted server executed in a disposable microVM — compatibility not assessable: server never launched: server process exited with code 2 before the MCP handshake — stderr: /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 1: /app: Permission denied /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 2: README.md: not found /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 3: README.md: not found /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 4: README.md: not fou [...] .npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 11: README.md: not found /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 12: src/: Permission denied /home/worker/.npm/_npx/db07289d284f3fe6/node_modules/.bin/mcp-server-fetch: 14: Syntax error: "(" unexpected / security: review — 2 finding(s), 1 highsealed by THRONE / No. d0a1d7af / 2026-06-16

executed in a disposable microVM, created for this scan and destroyed after it. nothing outlives a run.

maintainer of this server? challenge this record: hello@usethrone.dev. tell us what we got wrong and we re-run it in the open.

this page renders the stored record of a real run. nothing on it is asserted without the execution that proved it.