MCP Scanner

huggingface.co/mcp

https://huggingface.co/mcp · scanned 2026-10-17

1 of 4 tools can change data, send it out or run code. That's normal for a useful server, and it's where an approval step helps.

• hf_fs56 · Medium

  Runs code or commands · Sends data out

  When to use: Hugging Face Hub models, datasets, Spaces, collections, papers, daily papers, today's trending models, current paper leaderboard, docs, and repository files. Examples: {"operations":[{"cmd":"ls","args":["hf://models/trending","--limit","10"]}]} {"operations":[{"cmd":"ls","args":["hf://…

  • Input field “cmd” → runs code or commands
  • Server annotation openWorldHint → sends data out
• hf_whoami0 · Low

  Inspect the current Hugging Face authentication context, including the account, visible organization memberships, and credential access details. Read-only and never returns credential values.

• hub_repo_details0 · Low

  Get details for one or more Hugging Face repos (model, dataset, or space). Auto-detects type unless specified. For datasets, use operations: overview, dataset_structure, dataset_preview. Use dataset_structure first to discover configs, splits, sizes, and schema. Use dataset_preview only when config…

• hub_repo_search0 · Low

  Search Hugging Face repositories with a shared query interface. You can target models, datasets, spaces, or aggregate across multiple repo types in one call. Include links to repositories in your response.

Badge for your README

MarkdownCopy

[![Scanned by Vulnify](https://api.vulnify.io/public/mcp-scanner/servers/huggingface-co-mcp.svg)](https://www.vulnify.io/scanner/huggingface-co-mcp?utm_source=badge&utm_medium=readme&utm_campaign=scanner-badge)

Automated heuristic result, scanned on 2026-10-17. It is based only on the tool names, descriptions, schemas and annotations this server publishes; no tool was called. It is not a security audit or certification, and not an endorsement of or accusation against the server or its operator. A high score is not a vulnerability finding, and a low score does not mean the server is safe. Vulnify is not affiliated with this server or its operator; names and marks belong to their owners. Server owner? Write to security@vulnify.io from an address at the server's domain to remove or correct this page, or scan it again to update it. We reply within 5 business days.

To exclude your server (and its subdomains) from the scanner and remove its public page, write to security@vulnify.io from an address at its domain. We process requests within 5 business days: the page stops being shown and its stored result is deleted. To fix an error instead, tell us what's wrong or scan the server again.