Is MCP X safe to use?

MCP X has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under Apache-2.0.

How do I install MCP X?

MCP X supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

MCP X provides 3 tools: fetch, filesystem, youtubedl. See the full tools list on the server page for descriptions and parameters.

What AI clients work with MCP X?

MCP X is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.

Is MCP X actively maintained?

MCP X is less actively maintained — last commit was 243 days ago. It has 140 GitHub stars.

MCP X

Name: MCP X
Author: TimeCyber

uvx · by TimeCyber

这是一个MCP客户端，让你轻松配置各个大模型，对接各种MCP Server而开发。This is an MCP client that allows you to easily configure various large models and develop interfaces with various MCP servers.

140 3 tools GitHub npm PyPI

No known CVEs

Apache-2.0 license

Stale

Last commit 243d ago

Works with most clients

Transport: stdio, sse, http

3 tools · ~145 tok

Grade A · 0.1% of 200K ctx

Edit this pageView history

AI / ML

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "MCP_SERVER_NAME": {
      "url": "YOUR_SSE_SERVER_URL",
      "enabled": true,
      "transport": "sse"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/mcp-x)](https://mcppedia.org/s/mcp-x)

Read me

What MCP X does

MCP-X is an open-source MCP Host Desktop Application that seamlessly integrates with any LLMs supporting function calling capabilities. ✨

Test This Server

This server supports HTTP transport. Be the first to test it — help the community know if it works.

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

80/100across 5 weighted dimensions

How we score →

0255075100

−20

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

11 fixed

GHSA-69qj-pvh9-c5wghigh · fixedCVSS 7.5

yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp

### Summary yt-dlp's `--exec` option is vulnerable to arbitrary command injection when handling untrusted metadata if the argument uses standard string formatting (e.g. `%(title)s`) or other unsafe conversions. An attacker could achieve remote code execution on the user's machine via maliciously crafted metadata containing quotes or other special shell characters. ### Details Since yt-dlp version 2021.04.11, the `--exec` option has supported "output template syntax", which is a superset of Pyth

Affected: >= 2021.4.11Fixed in 2026.6.9source →

CVE-2026-50574high · fixedCVSS 8.3

yt-dlp: Arbitrary code execution via manifest downloads with aria2c

### Summary If aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp. ### Details When downloading a fragmented manifest format such as an HLS or DASH strea

Affected: >= 0Fixed in 2026.6.9source →

CVE-2026-50023high · fixedCVSS 8.3

yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

### Summary A vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as `.desktop`, `.url`, `.webloc`) to the user's filesystem, bypassing the remediation for `CVE-2024-38519`. ### Details The fix for `CVE-2024-38519` enforced an allowlist for file extensions, in order to prevent writing files with unsafe extensions (such as `.exe` or `.sh`) during file downloads. However, this allowlist explicitly included the unsafe extensions `.desktop`, `.ur

Affected: >= 0Fixed in 2026.6.9source →

CVE-2026-50019medium · fixedCVSS 6.1

yt-dlp: File Downloader cookie leak with curl

### Summary If curl is used an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. This is the equivalent to [GHSA-v8mc-9377-rwjj](<https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-v8mc-9377-rwjj>) for the `curl` downloader. The vulnerable behavior is present in [yt-dlp](https://github.com/yt-dlp/yt-dlp) released since 2023.09.24. ### Details At the file download st

Affected: >= 2023.9.24Fixed in 2026.6.9source →

CVE-2026-26331high · fixedCVSS 8.8

yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

### Summary When yt-dlp's `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter) is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL. ### Impact yt-dlp maintainers assume the impact of this vulnerability to be high for anyone who uses `--netrc-cmd` in their command/configuration or `netrc_cmd` in their Python scripts. Even though the maliciously crafted URL itself will look very suspicious to many users, it would be

Affected: >= 2023.06.21Fixed in 2026.02.21source →

Inventory

Tools (3)

Click any tool to inspect its schema.

~145 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is MCP X safe to use?: MCP X has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under Apache-2.0.
How do I install MCP X?: MCP X supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can MCP X do?: MCP X provides 3 tools: fetch, filesystem, youtubedl. See the full tools list on the server page for descriptions and parameters.
What AI clients work with MCP X?: MCP X is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is MCP X actively maintained?: MCP X is less actively maintained — last commit was 243 days ago. It has 140 GitHub stars.

Similar servers

Others in ai-ml

View all →

Sequential Thinking MCP Server98

Dynamic problem-solving through sequential thought chains

87.8k 1

Memory MCP Server96

Persistent memory using a knowledge graph

87.8k 5

Context Mode95

Privacy-first. MCP is the protocol for tool access. We're the virtualization layer for context.

18.3k 6

Gemini Cli95

An open-source AI agent that brings the power of Gemini directly into your terminal.

105.6k 8

MCP Security Weekly

Get CVE alerts and security updates for MCP X and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

AI / ML

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "MCP_SERVER_NAME": {
      "url": "YOUR_SSE_SERVER_URL",
      "enabled": true,
      "transport": "sse"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/mcp-x)](https://mcppedia.org/s/mcp-x)

Read me

What MCP X does

MCP-X is an open-source MCP Host Desktop Application that seamlessly integrates with any LLMs supporting function calling capabilities. ✨

Test This Server

This server supports HTTP transport. Be the first to test it — help the community know if it works.

README

MCP-X Agent 🤿 🤖

English | 中文

MCP-X is an open-source MCP Host Desktop Application that seamlessly integrates with any LLMs supporting function calling capabilities. ✨

Use Cases 🎯

AI Agent

MCP-X good at agent and understanding various types of content through its powerful AI agents. Here's an example of food content agent:

Key Features Demonstrated:

🍽️ Food Content Analysis: Detailed breakdown of dishes, ingredients, and nutritional information
🎯 Targeted Recommendations: Personalized suggestions based on user preferences
📊 Structured Output: Well-organized information with clear categorization
💬 Interactive Chat: Natural conversation flow with comprehensive responses

Perfect for:

Food bloggers and content creators
Nutritionists and health professionals
Restaurant owners and chefs
Anyone interested in food analysis and recommendations

This showcases how MCP-X can transform simple queries into detailed, actionable insights across various domains.

What's New

We've just rolled out major updates to improve your experience:

📚 Brand New Knowledge Base Feature (v0.1.0)

MCP-X now supports powerful knowledge base management!

Knowledge Management: Upload, view, search, and delete knowledge documents (supports txt, md, json, csv, xml, html formats)
Smart Search: Full-text search by filename and content with highlighted matching results
Chat References: One-click reference to knowledge base documents in chat, AI can answer based on your knowledge base content
Document Preview: Real-time document content preview with file metadata display
Responsive Design: Perfect adaptation for desktop and mobile devices

🚀 AI Agent System

MCP-X as a full-fledged AI agent platform.

New Agent Sidebar: Discover, manage, and search for specialized AI agents.
One-Click Talk: Instantly talk to any agent for your current task.
Agent Profiles: See what each agent can do, with details on their skills and example uses.
Organized for You: Agents are sorted into categories like content creation, data analysis, and programming.

🎨 A Fresh New Look

We've redesigned the app to be cleaner and more intuitive.

New Side Navigation: A permanent sidebar gives you quick access to Chat, Agents, Knowledge Base, Tools, Models, and System settings.
Clearer Icons: Navigation icons now have text labels so you know exactly where you're going.
Consistent Design: We've unified the color scheme and layout for a more polished feel.

This update also includes a move to a more professional icon set (react-icons) and various under-the-hood CSS and component optimizations for better performance.

Features 🎯

🌐 Universal LLM Support: Compatible with ChatGPT, Anthropic, Ollama and OpenAI-compatible models
💻 Cross-Platform: Available for Windows, MacOS, and Linux
📚 Knowledge Base Management: Upload, search, and reference knowledge documents, let AI answer based on your materials
🔄 Model Context Protocol: Enabling seamless MCP AI agent integration on both stdio and SSE mode
🤖 AI Agent System: Rich professional AI agents covering various domain-specific needs
🌍 Multi-Language Support: Traditi

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

80/100across 5 weighted dimensions

How we score →

0255075100

−20

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

11 fixed

GHSA-69qj-pvh9-c5wghigh · fixedCVSS 7.5

yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp

Affected: >= 2021.4.11Fixed in 2026.6.9source →

CVE-2026-50574high · fixedCVSS 8.3

yt-dlp: Arbitrary code execution via manifest downloads with aria2c

Affected: >= 0Fixed in 2026.6.9source →

CVE-2026-50023high · fixedCVSS 8.3

yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

Affected: >= 0Fixed in 2026.6.9source →

CVE-2026-50019medium · fixedCVSS 6.1

yt-dlp: File Downloader cookie leak with curl

Affected: >= 2023.9.24Fixed in 2026.6.9source →

CVE-2026-26331high · fixedCVSS 8.8

yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

Affected: >= 2023.06.21Fixed in 2026.02.21source →

Inventory

Tools (3)

Click any tool to inspect its schema.

~145 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is MCP X safe to use?: MCP X has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under Apache-2.0.
How do I install MCP X?: MCP X supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can MCP X do?: MCP X provides 3 tools: fetch, filesystem, youtubedl. See the full tools list on the server page for descriptions and parameters.
What AI clients work with MCP X?: MCP X is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is MCP X actively maintained?: MCP X is less actively maintained — last commit was 243 days ago. It has 140 GitHub stars.