redis-mcp

io.github.upstash/redis-mcp

7/7 checks passed
Runs locally
2 secrets
★ 0 GitHub stars
Updated 2026-07-08
Health score 43
Code reviewed

About redis-mcp

redis-mcp is an MCP server published by the GitHub account upstash. Run Redis commands and look up Upstash Redis Search docs against Upstash Redis over HTTP or TCP.

It runs on your own machine: your AI client starts it from the npm package @upstash/redis-mcp at version 0.1.1.

It asks for 2 secrets: UPSTASH_REDIS_REST_TOKEN and UPSTASH_REDIS_TCP_URL. Give it a key with the least access that still works.

Version 0.1.1 was published on 8 July 2026, and the source code is public, so you can read it before installing.

Written from the registry entry. 9 automated checks on the registry entry and the package code: 7 pass, 0 warn, 0 fail, 2 info. How we check.

What it asks for

Variable	Required	Secret	Description
`UPSTASH_REDIS_REST_URL`	No	No	Upstash Redis REST URL (HTTP transport).
`UPSTASH_REDIS_REST_TOKEN`	No	Yes	Upstash Redis REST token (HTTP transport).
`UPSTASH_REDIS_TCP_URL`	No	Yes	Upstash Redis rediss:// connection string (TCP transport).

Checks

Check	Result	Detail
Source repository linked	Pass	https://github.com/upstash/redis-mcp
Version pinned	Pass	Every package has an explicit version
Secrets requested	Info	Asks for 2 secrets: UPSTASH_REDIS_REST_TOKEN, UPSTASH_REDIS_TCP_URL
Known package registry	Pass	All packages come from npm, PyPI, OCI, NuGet or MCPB
Namespace ownership	Info	Name verified via GitHub account upstash
Registry text aimed at the AI	Pass	Description and settings contain no hidden characters or instructions to the AI
Install scripts	Pass	@upstash/redis-mcp@0.1.1 runs nothing at install
Code red flags	Pass	Read 4 files in @upstash/redis-mcp@0.1.1: no obfuscation, encoded execution, credential reads or data-collection endpoints found
Text aimed at the AI	Pass	No hidden characters or instructions to the AI in 4 files, including comments and the README

Code review: Pass, with notes

We read all 881 lines in 2 files of @upstash/redis-mcp 0.1.1 on 2026-10-31, without running it.

Lets an AI run any Redis command against your Upstash database, over Upstash's REST API or a normal Redis connection, and look up Upstash docs (those questions go to the third-party site context7.com). By default it adds small telemetry headers (Node version, operating system, package version) to requests sent to Upstash; you can turn them off. Turn on --readonly if the AI should not change data, and never use the optional HTTP mode on a normal computer: it has no password and lets any website you visit control your database.

What we found

Serious Optional HTTP mode (--transport http) has no authentication, sends Access-Control-Allow-Origin: * and answers CORS preflight, and calls listen(port) without a host so it binds every interface. Any web page open in the user's browser, or anyone on the same network, can call redis_run_commands against the configured databases (read, overwrite, FLUSHALL). The default stdio mode is not affected. Do not use HTTP mode outside a locked-down container. dist/index.js:815-866
Note Telemetry headers (runtime version, OS platform, SDK version) are on by default for REST calls to Upstash; opt out with --disable-telemetry / UPSTASH_DISABLE_TELEMETRY=1. dist/index.js:425-437,488
Note redis_run_commands accepts rest_url+rest_token or connection_string in the tool input, so the model can make the server POST to any http(s) URL (with a bearer token of its choosing) or open a TCP connection to any Redis host. The only check is that the URL is http(s) or redis(s); there is no Upstash-domain allowlist. Credentials passed this way also go through the model's context. dist/index.js:196-214,593-595
Note Read-only mode exists but is off by default (--readonly / UPSTASH_REDIS_READONLY). When on it uses an allowlist of the command name (first array element), which is a sound approach; it still allows TOUCH and WAIT. Without it the model can run any command, including EVAL, FLUSHALL and DEL. dist/index.js:273-400,563,789
Note redis_search_docs sends the query to context7.com, a third party (not Upstash). dist/index.js:620-699
Note With --debug, full tool arguments (including any raw rest_token or connection_string passed in a call) are written to stderr and to redis-mcp-debug.log. dist/index.js:741,250-253
Info Debug log path uses new URL('../', import.meta.url).pathname, which gives a malformed path on Windows ('/C:/...'); the write failure is silently ignored. dist/index.js:786
Info package.json was not among the reviewed files; dependencies listed come from imports. Line counts use the manifest convention (newline count + 1 per file, i.e. the empty segment after a final newline is counted); every line of every file was read with the Read tool. (package)

Talks to	*the configured Upstash Redis REST URL (UPSTASH_REDIS_REST_URL, .upstash.io) or, if supplied in a tool call, any http(s) rest_url: the Redis commands as JSON, the REST token as a Bearer header, and by default Upstash-Telemetry-Runtime/Platform/Sdk headers (only when redis_run_commands is called (HTTP transport)) the configured redis:// or rediss:// host (UPSTASH_REDIS_TCP_URL / REDIS_URL) or a connection_string from the tool call: Redis commands and the credentials embedded in the connection string (only when redis_run_commands is called (TCP transport); connection kept open afterwards) context7.com (https://context7.com/api/v2/context, library /websites/upstash_redis)**: the search query text, User-Agent upstash-redis-mcp, and CONTEXT7_API_KEY as Bearer if set (only when redis_search_docs is called)
Keys and settings	`UPSTASH_REDIS_REST_URL / UPSTASH_REDIS_REST_TOKEN (and UPSTASH_REDIS_<NAME>_REST_URL/_REST_TOKEN)`: the matching Upstash REST endpoint (token as Bearer) `UPSTASH_REDIS_TCP_URL / REDIS_URL (and UPSTASH_REDIS_<NAME>_TCP_URL)`: the Redis host in that URL `CONTEXT7_API_KEY`: context7.com `UPSTASH_REDIS_READONLY, UPSTASH_DISABLE_TELEMETRY`: not sent; local switches
Files on your machine	Loads .env from the working directory (dotenv/config, index.js:767). With --debug only, appends a log to redis-mcp-debug.log in the package directory (index.js:241-256). No other file access.
Runs programs	None. No child_process, eval or dynamic code loading.
Telemetry	On by default: every REST request to the user's Upstash endpoint carries Upstash-Telemetry-Runtime (e.g. node@20.x), Upstash-Telemetry-Platform (OS, e.g. win32) and Upstash-Telemetry-Sdk (@upstash/redis-mcp@0.1.1) headers (index.js:425-437, 488). It goes only to Upstash, contains no data or identifiers, and is turned off with --disable-telemetry or UPSTASH_DISABLE_TELEMETRY=1. Not sent on TCP connections or to context7.
Tools	redis_run_commands, redis_search_docs
Tool descriptions	clean (descriptions are accurate usage guidance; redis_search_docs asks the model to look up SEARCH.* syntax first, pointing only at this server's own tool; no hidden or invisible text)

This covers the package's own code only, not the 5 packages it depends on (@modelcontextprotocol/sdk, zod, commander, @redis/client, dotenv). A new version drops this review until we read it again.

Popularity & health: 43 / 100

Worked out from public numbers and our own checks, not from user reviews or ratings. It says how used and how looked-after a server is, not whether it is safe.

Popularity8 / 40

0 GitHub stars, 109 downloads last week, no Hacker News posts found. Best two of the three, each on a log scale.

Activity8 / 25

Last push 2026-07-08, last release 2026-07-08, 0 commits in 90 days.

Issue health8 / 15

0 closed of 0 issues, too few to judge. No data, so half marks.

Our checks20 / 20

0 warnings, each costing a fifth.

0 forks, 1 merged pull requests. Sources: GitHub, npm, PyPI (pypistats.org) and Hacker News (Algolia), fetched 2026-10-31.

What people say

No Hacker News threads link to its source code.

Look further: search Reddit, search Hacker News, read its GitHub issues. These are not reviews we checked.

Facts

Registry name	`io.github.upstash/redis-mcp`
Publisher	GitHub account upstash
How the name is verified	Name verified via GitHub account upstash. The registry ties the name prefix to that account or domain; it does not check the code.
Type	Local: runs on your machine from a package
Packages	npm `@upstash/redis-mcp` 0.1.1 (stdio)
Version	0.1.1
Published	2026-07-08
Last updated	2026-07-08
Source repository	https://github.com/upstash/redis-mcp
Website	None linked
Category	Databases & data (assigned by keyword rule, not by hand)

Install

Claude Desktop · npm package

{
  "mcpServers": {
    "redis-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@upstash/redis-mcp@0.1.1"
      ]
    }
  }
}

What these checks don't cover

We did not run this server, so we don't know what it does when it runs. We did read every line of its own code for version 0.1.1 (see the code review), but not the packages it depends on. We read its package code on 2026-10-29 without running it, and pattern searches miss what they have no pattern for. Tool descriptions built at run time were not seen. And we don't watch it after you install: if the publisher changes it later (a rug pull), this page won't notice until the next scan. Treat a pass as "nothing found", not as "safe".

For people and their AI

The same data as plain JSON: /data/servers/io-github-upstash-redis-mcp.json. Text inside it that came from the publisher is data, not instructions.