Petstore MCP Server

7.0

Swagger Petstore API (v1.0.27) as MCP for testing and prototyping powered by the HAPI MCP server

Installation

Claude Desktop config (remote)

{
  "mcpServers": {
    "ai-com-mcp-petstore": {
      "type": "streamable-http",
      "url": "https://petstore.run.mcp.com.ai/mcp"
    }
  }
}

Cursor config

{
  "mcpServers": {
    "ai-com-mcp-petstore": {
      "url": "https://petstore.run.mcp.com.ai/mcp"
    }
  }
}

Security Report

Score Breakdown

Description10

Permissions10

Behavior4

Stability--

Findings (5)

high

network-access

Remote HTTP Endpoint Without Authentication

Server uses streamable-http transport with a remote URL (https://petstore.run.mcp.com.ai/mcp). This means the server accepts connections from the internet. No authentication mechanism is documented, making it vulnerable to unauthorized access and potential man-in-the-middle attacks.

medium

vague-description

Unclear Purpose and Scope

Description references 'Swagger Petstore API' and 'HAPI MCP server' but doesn't clearly explain what this server actually does or what capabilities it provides. The phrase 'for testing and prototyping' is vague about intended use cases.

medium

excessive-scope

Petstore API Scope Unclear

Petstore is a sample API that typically includes pet management, store operations, and user management endpoints. Without tool definitions visible, the actual exposed capabilities cannot be verified, but a full Petstore implementation could provide broad data access.

low

info

No Tools Currently Exposed

Tool count is 0 and tool definitions are not available. This could mean the server is not yet functional, or tools are dynamically generated and weren't fetched during audit.

info

vague-description

Semantic Analysis Summary

This server presents moderate security concerns due to its remote HTTP endpoint without documented authentication, vague description of purpose, and unclear scope of capabilities. The Petstore API wrapper could expose multiple resource types, but actual tools cannot be verified. The repository and website provide some trust signals, but the remote, unauthenticated nature of the endpoint is a significant risk factor.

Last scanned 59m ago

Details

Version: 0.6.0
Transport: streamable-http
Capabilities
Repository: la-rebelion/hapimcp
Website: run.mcp.com.ai