Is io.github.wwwwujl/yuque-mcp safe to use?

io.github.wwwwujl/yuque-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.

How do I install io.github.wwwwujl/yuque-mcp?

io.github.wwwwujl/yuque-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What AI clients work with io.github.wwwwujl/yuque-mcp?

io.github.wwwwujl/yuque-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.

Is io.github.wwwwujl/yuque-mcp actively maintained?

io.github.wwwwujl/yuque-mcp is less actively maintained — last commit was 134 days ago.

io.github.wwwwujl/yuque-mcp

npm

Yuque MCP server with safe read/write tools for groups, group members, repositories, docs, and TOC.

14.8M/wk GitHub npm

No known CVEs

No license

Maintained

Last commit 134d ago

Works with most clients

Transport: stdio

0 tools

Grade F

Edit this pageView history

Productivity

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-wwwwujl-yuque-mcp": {
      "args": [
        "-y",
        "npm"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-wwwwujl-yuque-mcp)](https://mcppedia.org/s/io-github-wwwwujl-yuque-mcp)

Read me

What io.github.wwwwujl/yuque-mcp does

This folder is prepared for building a custom MCP server for Yuque.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y 'npm' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

52/100across 5 weighted dimensions

How we score →

0255075100

−48

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

8 fixed

CVE-2022-29244high · fixedCVSS 7.5

Packing does not respect root-level ignore files in workspaces

### Impact `npm pack` ignores root-level `.gitignore` & `.npmignore` file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` with workspaces, as of [v7.9.0](https://github.com/npm/cli/releases/tag/v7.9.0) & [v7.13.0](https://github.com/npm/cli/releases/tag/v7.13.0) respectively, may be affected and have published files into the npm registry they did not intend to include. ### Patch - Up

Affected: >= 7.9.0Fixed in 8.11.0source →

CVE-2018-7408high · fixedCVSS 7.8

Incorrect Permission Assignment for Critical Resource in NPM

An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's blog without mention of pre-release status). It might allow local users to bypass intended filesystem access restrictions because ownerships of /etc and /usr directories are being changed unexpectedly, related to a "correctMkdir" issue.

Affected: >= 0Fixed in 5.7.1source →

CVE-2013-4116info · fixed

Local Privilege Escalation in npm

Affected versions of `npm` use predictable temporary file names during archive unpacking. If an attacker can create a symbolic link at the location of one of these temporary file names, the attacker can arbitrarily write to any file that the user which owns the `npm` process has permission to write to, potentially resulting in local privilege escalation. ## Recommendation Update to version 1.3.3 or later.

Affected: >= 0Fixed in 1.3.3source →

CVE-2020-15095medium · fixedCVSS 4.4

npm CLI exposing sensitive information through logs

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like `<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>`. The password value is not redacted and is printed to stdout and also to any generated log files.

Affected: >= 0Fixed in 6.14.6source →

CVE-2019-16777high · fixedCVSS 7.7

npm Vulnerable to Global node_modules Binary Overwrite

Versions of the npm CLI prior to 6.13.4 are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a `serve` binary, any subsequent installs of packages that also create a `serve` binary would overwrite the first binary. This will not overwrite system binaries but only binaries put into the global node_modules directory. This b

Affected: >= 0Fixed in 6.13.4source →

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.wwwwujl/yuque-mcp safe to use?: io.github.wwwwujl/yuque-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.wwwwujl/yuque-mcp?: io.github.wwwwujl/yuque-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with io.github.wwwwujl/yuque-mcp?: io.github.wwwwujl/yuque-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is io.github.wwwwujl/yuque-mcp actively maintained?: io.github.wwwwujl/yuque-mcp is less actively maintained — last commit was 134 days ago.

Similar servers

Others in productivity

View all →

Memory MCP Server98

Persistent memory using a knowledge graph

87.9k 5

Sequential Thinking MCP Server95

Dynamic problem-solving through sequential thought chains

87.9k 1

Monday Api Mcp94

MCP server for using the monday.com API

412 4

com.monday/monday.com94

MCP server for monday.com integration.

412 4

MCP Security Weekly

Get CVE alerts and security updates for io.github.wwwwujl/yuque-mcp and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Productivity

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-wwwwujl-yuque-mcp": {
      "args": [
        "-y",
        "npm"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-wwwwujl-yuque-mcp)](https://mcppedia.org/s/io-github-wwwwujl-yuque-mcp)

Read me

What io.github.wwwwujl/yuque-mcp does

This folder is prepared for building a custom MCP server for Yuque.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y 'npm' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

README

yuque-mcp

中文说明: README.zh-CN.md

This folder is prepared for building a custom MCP server for Yuque.

Goal

Build a Yuque MCP server so Codex can:

discover Yuque repos and docs
read doc content in markdown/raw mode
create/update/delete docs when needed
create docs from local files and update docs from local files
create/update/delete repos (knowledge bases)
create/update/delete groups
manage group members (list/add/remove)
run combined operations (get_my_repositories, get_repository_overview, search_and_read, create_document_with_toc)
update repository TOC nodes
use Yuque content as a research knowledge base

Included Docs

docs/00-project-brief.md
docs/01-scope-v1.md
docs/02-architecture.md
docs/03-tool-contract.md
docs/04-api-mapping.md
docs/05-security.md
docs/06-implementation-plan.md
docs/07-test-plan.md
docs/08-codex-integration.md
docs/09-release-notes-zh.md
docs/10-registry-publish.md
docs/11-weekly-maintenance.md
docs/12-complaint-and-takedown.md
CHANGELOG.md
CONTRIBUTING.md
SECURITY.md
DISCLAIMER.md
tasks/TODO.md

Session Kickoff

In your new Codex session, start with:

Read docs/01-scope-v1.md and docs/03-tool-contract.md.
Scaffold Node + TypeScript MCP server.
Implement read-only tools.
Add write tools for group/repo/doc CRUD + TOC update.
Run tests and add Codex MCP config.

Quick Start (Local)

npm install
npm run build

Required env:

YUQUE_TOKEN
YUQUE_ENDPOINT (optional, default https://www.yuque.com/api/v2/)
YUQUE_TIMEOUT_MS (optional, default 10000)
YUQUE_MAX_RETRIES (optional, default 2, read-only retries only)
YUQUE_ALLOW_WRITE (optional, default false)
YUQUE_WRITE_NAMESPACE_ALLOWLIST (optional, comma-separated namespace allowlist for repo/doc/toc writes)
YUQUE_WRITE_GROUP_ALLOWLIST (optional, comma-separated group login allowlist for group writes)
YUQUE_ALLOW_DELETE (optional, default false)
YUQUE_DELETE_NAMESPACE_ALLOWLIST (optional, comma-separated delete allowlist targets; namespace for repo/doc, login for group)
YUQUE_FILE_ROOT (optional, default current working directory, used by file-based doc tools)
YUQUE_FILE_MAX_BYTES (optional, default 1048576)
YUQUE_FILE_ALLOWED_EXTENSIONS (optional, default .md,.markdown,.txt)

Write safety:

All write tools are blocked by default.
Set YUQUE_ALLOW_WRITE=true to enable writes.
Optional write allowlists:
- YUQUE_WRITE_NAMESPACE_ALLOWLIST=team/sandbox,team/test
- YUQUE_WRITE_GROUP_ALLOWLIST=sandbox-team

Delete safety:

yuque_delete_doc, yuque_delete_repo, and yuque_delete_group are blocked by default.
To enable delete for test repos only, set:
- YUQUE_ALLOW_WRITE=true
- YUQUE_ALLOW_DELETE=true
- YUQUE_DELETE_NAMESPACE_ALLOWLIST=your/test-namespace,your-test-group-login
Delete tools also require confirm: true and exact confirm_text:
- doc: DELETE DOC <namespace>/<docRef>
- repo: DELETE REPO <namespace>
- group: DELETE GROUP <login>

Latest highlights:

yuque_get_doc / yuque_update_doc / yuque_delete_doc support either slug or doc_id.
yuque_list_docs supports pagination (offset, limit).
yuque_search_docs now scans paginated docs across the full repository.
Doc format supports markdown, html, lake; visibility supports 0 | 1 | 2.
TOC update supports extra fields (editNode, url, open_window, visible).
Group member tools: yuque_list_group_users, yuque_add_group_user, yuque_remove_group_user.
File-based tools are constrained by root directory, extension allowlist, and max size.

Run in dev:

npm run dev

Run compiled server:

npm run start

Run local MCP smoke test (test namespace only):

YUQUE_SMOKE_NAMESPACE=your/test-namespace npm run smoke

Run write smoke suite with cleanup (create/update/toc/del

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

52/100across 5 weighted dimensions

How we score →

0255075100

−48

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

8 fixed

CVE-2022-29244high · fixedCVSS 7.5

Packing does not respect root-level ignore files in workspaces

Affected: >= 7.9.0Fixed in 8.11.0source →

CVE-2018-7408high · fixedCVSS 7.8

Incorrect Permission Assignment for Critical Resource in NPM

Affected: >= 0Fixed in 5.7.1source →

CVE-2013-4116info · fixed

Local Privilege Escalation in npm

Affected: >= 0Fixed in 1.3.3source →

CVE-2020-15095medium · fixedCVSS 4.4

npm CLI exposing sensitive information through logs

Affected: >= 0Fixed in 6.14.6source →

CVE-2019-16777high · fixedCVSS 7.7

npm Vulnerable to Global node_modules Binary Overwrite

Affected: >= 0Fixed in 6.13.4source →

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.wwwwujl/yuque-mcp safe to use?: io.github.wwwwujl/yuque-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.wwwwujl/yuque-mcp?: io.github.wwwwujl/yuque-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with io.github.wwwwujl/yuque-mcp?: io.github.wwwwujl/yuque-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is io.github.wwwwujl/yuque-mcp actively maintained?: io.github.wwwwujl/yuque-mcp is less actively maintained — last commit was 134 days ago.