Market Space security directory

Hugging Face MCP Server

Published by huggingface

Low risk

Official remote MCP server from Hugging Face, hosted at https://huggingface.co/mcp (also reachable via hf.co/mcp). Connects MCP-compatible AI assistants (Claude Desktop, Cursor, VS Code, Zed, Codex, ChatGPT, etc.) directly to the Hugging Face Hub. Provides built-in tools for searching models, datasets, Spaces, papers, and documentation, running and managing Jobs on Hugging Face infrastructure, and surfacing community tools through MCP-compatible Gradio Spaces. Uses a stateless Streamable HTTP transport with per-request credential lookup; authenticates via HF_TOKEN or OAuth login (https://huggingface.co/mcp?login), and also supports a limited anonymous tool set.

Security assessment

Plutonium assessed this mcp for permissions, capabilities, and security-relevant behavior.

No detailed security findings are recorded for this add-on.

The interactive security report will load automatically.