io.github.sweesama/favicondl is an MCP server that extract a website's favicon URL (any size 16-512) via the free FaviconDL API. No API key. Its tool list has not been published yet over stdio, requires no API key, and scores 59/100 on MCPpedia's security, maintenance and efficiency rubric.
Step 1
Install in your client
Config is the same across clients - only the file and path differ.
CD
Supported in Claude Desktopstdio · Node 18+
Paste into ~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"io-github-sweesama-favicondl": {
"args": [
"-y",
"serve"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Embed in your READMEAbout badges →
[](https://mcppedia.org/s/io-github-sweesama-favicondl)
Read me
What io.github.sweesama/favicondl does
Extract a website's favicon URL (any size 16-512) via the free FaviconDL API. No API key.
Test This Server
Run this in your terminal to verify the server starts. Then let us know if it worked - your result helps other developers.
npx -y 'serve' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Loading README…
Scored, not listed
Why this score
Five weighted categories - click any category to see the underlying evidence.
Score breakdown
59/100across 5 weighted dimensions
0255075100
22
12
15
10
−41
Security
Maintenance
Efficiency
Documentation
Compatibility
Categoriesclick a row to see evidence
Security
OSV.dev9 fixed
CVE-2018-3718medium · fixedCVSS 5.3
vercel/serve allows access to restricted files if filename is URL encoded.
serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.
GHSA-cpgr-wmr9-qxv4medium · fixed
Cross-Site Scripting in serve
Versions of `serve` prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. ## Recommendation Upgrade to version 10.0.2 or later.
GHSA-xw79-hhv6-578chigh · fixed
Cross-Site Scripting in serve
Versions of `serve` prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package does not encode output, allowing attackers to execute arbitrary JavaScript in the victim's browser if user-supplied input is rendered. ## Recommendation Upgrade to version 10.0.2 or later.
GHSA-48gc-5j93-5cfqhigh · fixed
Path Traversal in serve
Versions of `serve` prior to 10.1.2 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through relative paths, which allows attackers to access hidden folders and files. ## Recommendation Upgrade to version 10.1.2 or later.
GHSA-wm7q-rxch-43mxhigh · fixed
Byass due to validation before canonicalization in serve
Versions of `serve` before 6.5.2 are vulnerable to the bypass of the ignore functionality. The bypass is possible because validation happens before canonicalization of paths and filenames. Example: Here we have a server that ignores the file test.txt. ``` const serve = require('serve') const server = serve(__dirname, { port: 1337, ignore: ['test.txt'] }) ``` Using the URL encoded form of a letter (%65 instead of e) attacker can bypass the ignore control accessing the file. `cur
Community
Reviews
Be the first to review
Have you used this server?
Share your experience - it helps other developers decide.
How easy was setup?Did it work reliably?How was the documentation?
Sign in to write a review.
Frequently Asked Questions
- Is io.github.sweesama/favicondl safe to use?
- io.github.sweesama/favicondl has no known CVEs as of the latest MCPpedia security scan. Authentication requirements were not detected automatically - check the project's documentation before connecting in a shared environment. Licensed under MIT.
- How do I install io.github.sweesama/favicondl?
- io.github.sweesama/favicondl supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
- What AI clients work with io.github.sweesama/favicondl?
- io.github.sweesama/favicondl is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
- Is io.github.sweesama/favicondl actively maintained?
- io.github.sweesama/favicondl is actively maintained - last commit was 1 day ago. It has 5 GitHub stars.
Related
Similar servers
Others in other
I
io.github.vshulcz/deja-vu95deja-vu: local memory over the session histories of forty-three coding agents.
1.5k 6
W
MCP Wordpress Remote95MCP WordPress Remote proxy server
188 10
Argo95专门为 agent 打造的 agent 搜索工具，具备多语言搜索能力，覆盖中文/英文/学术/代码/购物/金融/新闻/百科。
260 1
Football Docs94Searchable football data provider documentation for AI coding agents. Like Context7 for football data.
228 8
MCP Security Weekly
Get CVE alerts and security updates for io.github.sweesama/favicondl and similar servers.
Community
Discussion
Start a conversation
Ask a question, share a tip, or report an issue.
Has anyone used this with Cursor?How do you handle auth?Any alternatives?
Sign in to join the discussion.