vikunja-fastmcp / security
Security review
Is vikunja-fastmcp MCP safe to give an agent?
write capableunknownwrite capablehealthy
A factual risk summary built from vikunja-fastmcp’s real tool surface, execution model, and verification history — not a vibe. Trust score 50/100.
01What it can do
Has tools that can create or modify data.
23 tools observedwrite present
02Execution model
Transport not yet confirmed, so the execution model is unknown. Treat as untrusted until verified.
Installs via npx (`npx -y vikunja-fastmcp`) — it pulls and executes third-party code; pin versions and review the source.
03Permissions & auth
This server has write tools. No auth scopes are recorded for how that access is granted.
04Verification
handshakenot confirmed
runsmetadata:passed · metadata:passed · metadata:passed · metadata:passed · metadata:passed · metadata:passed · metadata:passed · metadata:passed · metadata:passed · metadata:passed
last_checked2026-10-24 12:01Z
sourcesnpm registry [p4]
Reduce the risk
Worried about handing an agent raw access? See governed agents in action — Apex gives your AI paced, capped, fully-logged hands with approval queues before anything runs.
Explore Apex →See also: full server page · setup · alternatives