MCP Scanner

mcp-server-neon

https://neon.tech/docs/mcp · scanned 2026-10-17

1 of 3 tools can change data, send it out or run code. That's normal for a useful server, and it's where an approval step helps.

38/ 100 · heuristic risk · Medium

3 tools · 1 flagged

  • Runs code or commands0
  • Moves money0
  • Touches credentials0
  • Deletes0
  • Sends data out1
  • Exports data0
  • Writes or changes0
  • send_feedback38 · Medium

    Sends data out

    Send anonymous feedback about Neon or this MCP server to the Neon team. Only call this when the user asks to give feedback. Sends only the feedback text, not account, project, or connection details.

    • Name contains “send” → sends data out
    • Server annotation openWorldHint → sends data out
  • get_doc_resource0 · Low

    Fetch one Neon documentation page as markdown. Pass a slug from list_docs_resources (for example docs/guides/prisma.md).

  • list_docs_resources0 · Low

    List Neon documentation page slugs from neon.com/docs/llms.txt. Call this before get_doc_resource; do not guess slugs.

Vulnify checks each tool call before it runs: ALLOW, REVIEW or BLOCK, with the reason logged.

Badge for your README

Scanned by Vulnify
Markdown
[![Scanned by Vulnify](https://api.vulnify.io/public/mcp-scanner/servers/neon-tech-docs-mcp.svg)](https://www.vulnify.io/scanner/neon-tech-docs-mcp?utm_source=badge&utm_medium=readme&utm_campaign=scanner-badge)

Automated heuristic result, scanned on 2026-10-17. It is based only on the tool names, descriptions, schemas and annotations this server publishes; no tool was called. It is not a security audit or certification, and not an endorsement of or accusation against the server or its operator. A high score is not a vulnerability finding, and a low score does not mean the server is safe. Vulnify is not affiliated with this server or its operator; names and marks belong to their owners. Server owner? Write to security@vulnify.io from an address at the server's domain to remove or correct this page, or scan it again to update it. We reply within 5 business days.

To exclude your server (and its subdomains) from the scanner and remove its public page, write to security@vulnify.io from an address at its domain. We process requests within 5 business days: the page stops being shown and its stored result is deleted. To fix an error instead, tell us what's wrong or scan the server again.