I
io.github.IncorporatedPartners/labelhead-artist-momentum
paperclipai
Trending hip-hop artist momentum scores across four cultural dimensions.
1 open CVE
No license
Actively maintained
Last commit 2d ago
Works with most clients
Transport: stdio, sse
10 tools · ~487 tok
Grade A · 0.2% of 200K ctx
Step 1
Install in your client
Config is the same across clients — only the file and path differ.
CD
Supported in Claude Desktopstdio, sse · Node 18+
Paste into ~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"io-github-incorporatedpartners-labelhead-artist-momentum": {
"args": [
"-y",
"paperclipai"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Embed in your READMEAbout badges →
[](https://mcppedia.org/s/io-github-incorporatedpartners-labelhead-artist-momentum)
Read me
What io.github.IncorporatedPartners/labelhead-artist-momentum does
If OpenClaw is an employee, Paperclip is the company
Test This Server
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
npx -y 'paperclipai' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Loading README…
Scored, not listed
Why this score
Five weighted categories — click any category to see the underlying evidence.
Score breakdown
83/100across 5 weighted dimensions
0255075100
23
20
20
10
10
−17
Security
Maintenance
Efficiency
Documentation
Compatibility
Categoriesclick a row to see evidence
Security
OSV.dev1 open1 fixed
GHSA-gqqj-85qm-8qhfhighCVSS 8.7
Paperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email
### Summary A Paperclip-managed `codex_local` runtime was able to access and use a Gmail connector that I had connected in the ChatGPT/OpenAI apps UI, even though I had not explicitly connected Gmail inside Paperclip or separately inside Codex. In my environment this enabled mailbox access and a real outbound email to be sent from my Gmail account. After I manually intervened to stop the workflow, follow-up retraction messages were also sent, confirming repeated outward write/send capability.
Affected:
>= 0source →CVE-2026-41679critical · fixedCVSS 10
paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass
## Summary An unauthenticated attacker can achieve full remote code execution on any network-accessible Paperclip instance running in `authenticated` mode with default configuration. No user interaction, no credentials, just the target's address. The entire chain is six API calls. I verified every step against the latest version. I have a fully automated PoC script and a video recording available. Discord: sagi03581 ## Steps to Reproduce The attack chains four independent flaws to escalate
Inventory
Tools (10)
Click any tool to inspect its schema.
~487 tokens total
Community
Reviews
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
How easy was setup?Did it work reliably?How was the documentation?
Sign in to write a review.
Frequently Asked Questions
- Is io.github.IncorporatedPartners/labelhead-artist-momentum safe to use?
- io.github.IncorporatedPartners/labelhead-artist-momentum has 1 known CVE tracked by MCPpedia. You can verify these on OSV.dev by searching for "paperclipai". Review the Security section above for details before installing.
- How do I install io.github.IncorporatedPartners/labelhead-artist-momentum?
- io.github.IncorporatedPartners/labelhead-artist-momentum supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
- What can io.github.IncorporatedPartners/labelhead-artist-momentum do?
- io.github.IncorporatedPartners/labelhead-artist-momentum provides 10 tools: Features, Quickstart, FAQ, Development, Roadmap and 5 more. See the full tools list on the server page for descriptions and parameters.
- What AI clients work with io.github.IncorporatedPartners/labelhead-artist-momentum?
- io.github.IncorporatedPartners/labelhead-artist-momentum is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse transport.
- Is io.github.IncorporatedPartners/labelhead-artist-momentum actively maintained?
- io.github.IncorporatedPartners/labelhead-artist-momentum is actively maintained — last commit was 2 days ago. It has 72,407 GitHub stars.
Related
Similar servers
Others in entertainment / analytics
Observability Mcp94MCP Server for GCP environment for interacting with various Observability APIs.
846 10
Unity MCP93AI Skills, MCP Tools, and CLI for Unity Engine. Full AI develop and test loop. Use cli for quick setup. Efficient token usage, advanced tools. Any C# method may be turned into a tool by a single line. Works with Claude Code, Gemini, Copilot, Cursor and any other absolutely for free.
3.4k 7
Sink93⚡ A Simple / Speedy / Secure Link Shortener with Analytics, 100% run on Cloudflare.
6.9k 3
Spotify Mcp Server91Lightweight MCP server for Spotify
378 17
MCP Security Weekly
Get CVE alerts and security updates for io.github.IncorporatedPartners/labelhead-artist-momentum and similar servers.
Community
Discussion
Start a conversation
Ask a question, share a tip, or report an issue.
Has anyone used this with Cursor?How do you handle auth?Any alternatives?
Sign in to join the discussion.
