I

io.github.sevalla-hosting/mcp

Official

pnpm

Official Sevalla MCP — full PaaS API access through just 2 tools.

7 172.3M/wk 2 tools GitHub npm

No known CVEs

MIT license

Actively maintained

Last commit 1d ago

Works with most clients

Transport: http

2 tools · ~149 tok

Grade A · 0.1% of 200K ctx

MCPpedia last refreshed this data 18h ago

Edit this pageView history

io.github.sevalla-hosting/mcp is an MCP server that official Sevalla MCP — full PaaS API access through just 2 tools. Its tool list has not been published yet over http, requires no API key, and scores 84/100 on MCPpedia's security, maintenance and efficiency rubric.

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

CD

Supported in Claude Desktophttp · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "sevalla": {
      "url": "https://mcp.sevalla.com/mcp"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

MCPpedia Score badge

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-sevalla-hosting-mcp)](https://mcppedia.org/s/io-github-sevalla-hosting-mcp)

Read me

What io.github.sevalla-hosting/mcp does

Give AI agents full access to the Sevalla PaaS API. Just 2 tools.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y 'pnpm' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

84/100across 5 weighted dimensions

How we score →

0255075100

27

12

20

15

10

−16

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

31 fixed

CVE-2026-59195high · fixedCVSS 8.2

pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

## Summary `pnpm` accepts package names from the env lockfile `configDependencies` section and uses those names directly when creating config dependency symlinks under `node_modules/.pnpm-config`. A malicious repository can commit a crafted `pnpm-lock.yaml` whose env-lockfile document contains a traversal-shaped config dependency name such as `../../PWNED_CFGDEP`. During `pnpm install`, pnpm installs the config dependency and creates a symlink at a path derived from that name. In local testin

Affected: >= 0Fixed in 10.34.4source →

GHSA-qrv3-253h-g69chigh · fixedCVSS 8.2

pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

## Summary `pnpm` accepts package names from the env lockfile `configDependencies` section and uses those names directly when creating config dependency symlinks under `node_modules/.pnpm-config`. A malicious repository can commit a crafted `pnpm-lock.yaml` whose env-lockfile document contains a traversal-shaped config dependency name such as `../../PWNED_CFGDEP`. During `pnpm install`, pnpm installs the config dependency and creates a symlink at a path derived from that name. In local testin

Affected: >= 0Fixed in 10.34.4source →

GHSA-72r4-9c5j-mj57high · fixedCVSS 7.1

pnpm: `patch-remove` could delete project-selected files outside the patches directory

## Summary The `patch-remove` deletion-scope issue tracked as GHSA-72r4-9c5j-mj57 / CAND-PNPM-030 has been addressed in pnpm. A crafted patch entry could resolve outside the configured patches directory and cause `pnpm patch-remove` to delete an arbitrary reachable file. This patch validates the configured directory and every resolved target before unlinking anything, then deletes the final directory entry without following it. ## Security boundary - Traversal and absolute paths that resolve

Affected: >= 0Fixed in 10.34.4source →

CVE-2026-59194high · fixedCVSS 7.1

pnpm: `patch-remove` could delete project-selected files outside the patches directory

## Summary The `patch-remove` deletion-scope issue tracked as GHSA-72r4-9c5j-mj57 / CAND-PNPM-030 has been addressed in pnpm. A crafted patch entry could resolve outside the configured patches directory and cause `pnpm patch-remove` to delete an arbitrary reachable file. This patch validates the configured directory and every resolved target before unlinking anything, then deletes the final directory entry without following it. ## Security boundary - Traversal and absolute paths that resolve

Affected: >= 0Fixed in 10.34.4source →

GHSA-fr4h-3cph-29xvhigh · fixedCVSS 7.1

pnpm: Hoisted install imports lockfile alias outside node_modules

## Summary The hoisted dependency alias issue tracked as GHSA-fr4h-3cph-29xv / CAND-PNPM-059 has been addressed in both pnpm and pacquet. A crafted lockfile alias could be joined directly under a hoisted `node_modules` directory. Traversal aliases could escape that directory, while reserved aliases such as `.bin` or `.pnpm` could overwrite pnpm-owned layout. This patch validates package-name semantics and path containment before graph insertion or filesystem work. ## Security boundary - The

Affected: >= 0Fixed in 10.34.4source →

Inventory

Tools (2)

Click any tool to inspect its schema.

~149 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Sign in to write a review.

Frequently Asked Questions

Is io.github.sevalla-hosting/mcp safe to use?: io.github.sevalla-hosting/mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.
How do I install io.github.sevalla-hosting/mcp?: io.github.sevalla-hosting/mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can io.github.sevalla-hosting/mcp do?: io.github.sevalla-hosting/mcp provides 2 tools: search, execute. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.sevalla-hosting/mcp?: io.github.sevalla-hosting/mcp is compatible with claude-desktop, cursor, claude-code. It uses http transport.
Is io.github.sevalla-hosting/mcp actively maintained?: io.github.sevalla-hosting/mcp is actively maintained — last commit was 1 day ago. It has 7 GitHub stars.

Related

Similar servers

Others in cloud

Observability MCP94

MCP Server for GCP environment for interacting with various Observability APIs.

io.github.RamaAditya49/titen-memory92

Evidence-grounded agent memory with mandatory provenance, on local SQLite or Cloudflare D1

io.github.dockndevai/mcp-azure-devops89

Azure DevOps boards, repos, pipelines & projects for AI agents — governed.

io.github.BlazingCDN/blazingcdn-mcp89

Manage BlazingCDN from AI agents: CDN zones, cache, metrics, domains, cloud storage and video CDN

MCP Security Weekly

Get CVE alerts and security updates for io.github.sevalla-hosting/mcp and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Sign in to join the discussion.