Back to MCP Trust Indexm8ven
0
/ 100
10 days ago
glama

claude-code-hwp-mcp

An MCP server for AI-powered automatic editing of HWP documents in Claude Code and Claude Desktop, offering 94 tools for document analysis, table editing, text formatting, layout, and PDF verification.

→ gmlcjf0326/claude-code-hwp-mcp· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Tool descriptions don’t match what handlers do
1 tool describes read intent but its handler mutates — hwp_form_workflow (line 1090: fs.mkdirSync(STATE_DIR, { recursive: true }))
⚠️
Known vulnerabilities in dependencies: 8 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
// known CVEs in dependencies8 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.0GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

high@xmldom/xmldom@0.8.11GHSA-2v35-w6hq-6mfw

xmldom: Uncontrolled recursion in XML serialization leads to DoS

high@xmldom/xmldom@0.8.11GHSA-f6ww-3ggp-fr8h

xmldom has XML injection through unvalidated DocumentType serialization

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configHWP_SKIP_AUTO_INSTALL
configPYTHON_PATH— "": "C:\\Users\\사용자이름\\AppData\\Local\\Programs\\Python\\Python313\\python.exe"
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 10 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/gmlcjf0326-claude-code-hwp-mcp-13f5i2)](https://m8ven.ai/mcp/gmlcjf0326-claude-code-hwp-mcp-13f5i2)
commit: 9385e039532627c31818cb145d33efabaa3ef7ce
code hash: 994efe92e73932aa209c6eb331077151366af5031ed6ecd0bcc2c9b0bc92c28f
verified: 7/21/2026, 9:30:41 AM
view raw JSON →