Is quantconnect@0.1.0 safe to install?

quantconnect@0.1.0

VERIFIED

Publisher claims: "The QuantConnect MCP Server is a bridge for AIs (such as Claude and OpenAI o3 Pro) to interact with our cloud platform. When equipped with our MCP, the AI can perform tasks on your behalf through our API such as updating projects, writing strategies, backtesting, and deploying strategies to production live-trading." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry Docker MCP CatalogPublisher quantconnect · joined 0 days agoInstalls 36,636Last detonated 2 h ago

$docker run -i --rm mcp/quantconnect

Watch Report an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-26 and scored it 90/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

MEDIUM

Destructive file system command detected.github/workflows/run_live_trading_tests.yml:20 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Destructive file system command detected.github/workflows/run_tests.yml:41 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Destructive file system command detected.github/workflows/update_models.yml:20 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05