PraisonAI MCP Server

PraisonAI documents its MCP support as three separately packaged layers: a client (praisonaiagents[mcp]), a light config-driven server (praisonai-code), and this heavy host, praisonai-mcp, installed with pip install "praisonai-mcp[all]". The heavy host runs via praisonai-mcp serve (equivalently praisonai mcp serve), defaulting to a stdio transport or, with --transport http-stream, an HTTP endpoint at /mcp by default. Its documented CLI output lists 86 tools, 7 resources (examples include praisonai://memory/sessions and praisonai://workflows), and 7 prompts (examples include deep-research and code-review). Access is gated by a single wildcard-scoped --api-key or a --keys-file of per-key scopes, with a configurable --allowed-origins allowlist (default localhost) and --cors-origins setting. Specific tool names beyond the documented count were not found in the vendor pages fetched this session, so key_tools is left empty rather than reconstructed.

The repository, docs, and package metadata all agree this is MervinPraison's own code, and the GitHub owner is an individual User account rather than an organization, so authority is recorded as first_party under an individual publisher. The one Official MCP Registry record found, io.github.MervinPraison/praisonai at version 2.3.42 with a stdio-only transport, describes the older monolithic praisonai package rather than this praisonai-mcp package, and is stale next to the current PyPI releases (praisonai 4.7.8, praisonai-mcp 0.1.7). No page fetched for the server role names an MCP spec revision; the client transports page's "Protocol Revision: 2025-11-25" statement is specific to the praisonaiagents client class and was not treated as covering this package, so spec_status is unknown here.

Six CVE records have been filed against PraisonAI's MCP-adjacent code since 2026-08-25, across three distinct surfaces rather than one. Three target the pip praisonai package's HTTP-stream transport, the code current docs place in this praisonai-mcp heavy host: CVE-2026-55532 (7.6 high, origin-allowlist bypass), CVE-2026-55529 (6.9 medium, the same bypass's browser-mediated variant), and CVE-2026-55531 (6.5 medium, unbounded per-initialize session accumulation), all fixed in praisonai

=4.6.58. A fourth, CVE-2026-57124 (9.8 critical), hit the pip praisonai UI host application's client-role code, where an unauthenticated POST /api/mcp/connect passed caller-controlled command and arguments to a stdio MCP client, fixed in praisonai 4.6.59. The remaining two hit a separate implementation entirely, the npm praisonai package's TypeScript MCPServer: CVE-2026-57134 (8.2 high, a Basic/OAuth authentication policy that accepted any non-empty Authorization header) and CVE-2026-57139 (9.8 critical, MCPServer.startHttp() binding without a host restriction and serving every request unauthenticated), both fixed in npm praisonai 1.7.2. None of the six advisories is filed under the praisonai-mcp package coordinate itself. Full per-record sourcing is in the first three-CVE story and the September 3-15 security roundup.