Coroot
Coroot is an MCP server published by Coroot; its MCP spec-revision support has not been verified yet. It is the first-party server from Coroot. Last verified 2026-09-15.
Does Coroot support the current MCP specification (2026-07-28)?
Undetermined. We have not verified which MCP specification revision Coroot supports (as of 2026-09-15).
Is Coroot a first-party (official) MCP server?
Yes. Coroot is the first-party MCP server published by Coroot (last verified 2026-09-15).
How do I connect to Coroot?
Coroot is available via the package docker:ghcr.io/coroot/coroot, the source repository at https://github.com/coroot/coroot. Authentication: oauth. Transports: streamable-http.
What tools does Coroot expose?
Coroot exposes 19 tools (last verified 2026-09-15).
When were Coroot's facts last verified?
2026-09-15. Each fact on this page links to the sources used to verify it.
Coroot exposes a built-in MCP surface, rather than shipping it as a separate server package, giving connected AI assistants access to application topology, health signals and alerts, distributed traces, and raw telemetry (PromQL queries, log search, metric discovery) from a customer's own Coroot instance. The endpoint is served at /mcp, secured with OAuth 2.0 using dynamic client registration, and documented as supporting Claude Code, Cursor and Codex. The docs list 19 tools, two of them restricted to the commercial Enterprise Edition. Because the surface lives in Coroot's own product repository and is documented on Coroot's own docs domain, authority is first-party.
The MCP OAuth surface carries an unresolved vulnerability. VulnCheck published CVE-2026-79786 on 2026-08-25 (CVSS 3.1 7.1, high), describing how the client-registration endpoint accepts any redirect URI that passes Go's url.Parse, with no scheme or host allowlist, letting an attacker register a client that redirects an authenticated user's authorization response to an attacker-controlled host. Affected versions run 1.20.2 through 1.24.5. As confirmed directly against the source this session, the flaw remains unpatched: api/mcp_oauth.go is unchanged at the newest release, v1.26.1 (published 2026-09-14), and on the current main branch (pushed 2026-09-15), with its last modification dating to 2026-05-05, when the MCP server was added. A fix was proposed in pull request #960, opened 2026-08-13, but the pull request was closed without merging, and the public tracking issue, coroot/coroot#929, opened 2026-07-01, remains open. The published story covers the disclosure in full.
How widely adopted is Coroot?
Not ranked in The MCP 500: insufficient public data (coverage floor not met) (snapshot ). The Adoption Index measures public signals only; it says nothing about quality.
How was this verified, and what are the sources?
Verified · method: vendor-docs
· confidence 0.85 (Good).
- Coroot MCP overview docs, fetched 2026-09-15 - "The endpoint is served at /mcp on your Coroot instance"; "The MCP endpoint uses OAuth 2.0. Each user signs in with their own Coroot account on first connect, and the agent runs with that user's RBAC permissions"; documents 19 tools, 2 Enterprise-Edition-only, and clients Claude Code, Cursor, Codex - accessed
- Source file api/mcp.go at HEAD, fetched 2026-09-15 - instantiates mcpserver.NewStreamableHTTPServer(...) from github.com/mark3labs/mcp-go/server, confirming the /mcp endpoint runs streamable-http - accessed
- Source file api/mcp_oauth.go at tag v1.26.1, fetched 2026-09-15 - the entire redirect_uri check in MCPOAuthRegister is `if _, err := url.Parse(ru); err != nil { ... }`, a syntax check only with no scheme or host allowlist; byte-identical to the same file on the main branch fetched the same session - accessed
- CVE-2026-79786 CNA record, fetched 2026-09-15 - state PUBLISHED, reserved and published 2026-08-25, updated 2026-08-28; affected coroot/coroot versions 1.20.2 through 1.24.5; CWE-601 URL Redirection to Untrusted Site; CVSS 3.1 7.1 high; assigner VulnCheck - accessed
- Pull request #960, fetched 2026-09-15 - "fix: validate redirect_uri at MCP OAuth client registration," description "Fixes #929 ... Now redirect_uri must be https, loopback-only http, or a non-dangerous scheme"; merged false, merged_at null, state closed - accessed
- Issue #929, fetched 2026-09-15 - "Open Redirect via Unvalidated OAuth Redirect URI in MCP OAuth Flow," opened 2026-07-01, state open, last comment 2026-08-25 confirming the registration gap was still live - accessed
- Coroot Docker installation docs, fetched 2026-09-15 - names the Community Edition image ghcr.io/coroot/coroot and the Enterprise Edition image ghcr.io/coroot/coroot-ee:1.5.4 - accessed