Skills/Glama/server-mcp

server-mcp@2026.10.24.1

CAUTION· not started

Publisher claims: "Lets Claude manage Linux servers and Docker over SSH or locally, with previews and approval before every change." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher drmogie · publishing for 1 daysInstalls 0Last detonated 22 h ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
PIA_PASSWORD
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard. It asks for PIA_PASSWORD and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-15 and scored it 72/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Privileged sudo command; Privileged sudo command; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

HIGH
Privileged sudo commandserver_mcp/server.py:4 · Privileged sudo command — agent may execute with elevated privilegesnetworks, Compose stacks), files, services, logs, packages and power, with sudoFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandserver_mcp/server.py:35 · Privileged sudo command — agent may execute with elevated privilegesSERVER_MCP_<NAME>_SUDO "true" to run docker with sudoFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsserver_mcp/server.py:79 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesThe .env files are never read.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsserver_mcp/server.py:937 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesGood for finding a missing or wrong value in the .env file. Secret values are hidden.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsserver_mcp/server.py:915 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Show the compose file of a stack. Secret values are hidden. The .env file is never shown."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandserver_mcp/server.py:38 · Privileged sudo command — agent may execute with elevated privilegesSERVER_MCP_<NAME>_SUDO_PASSWORD sudo password (default: the SSH password)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandserver_mcp/server.py:36 · Privileged sudo command — agent may execute with elevated privilegesSERVER_MCP_<NAME>_REMOTE_DOCKER full path of the docker program on the host, for when sudoFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandserver_mcp/server.py:47 · Privileged sudo command — agent may execute with elevated privilegesSERVER_MCP_SUDO_PASSWORD one sudo password for all hosts (default: the SSH password)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_server.py:100 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescheck("key file is blocked", s._classify("cat ~/.ssh/id_ed25519") == "blocked")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandserver_mcp/server.py:1235 · File permission modification command — agent changes file ownership/permissionschown --reference="$f" -- "$t" 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandserver_mcp/server.py:1234 · File permission modification command — agent changes file ownership/permissionschmod --reference="$f" -- "$t" 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Privileged sudo commandtests/test_server.py:129 · Privileged sudo command — agent may execute with elevated privilegescheck("docker gets full path and sudo -n", s._sudo_wrap(h, ["docker", "ps"], False)[0] == ["sudo", "-n", "/usr/local/bin/docker", "ps"])Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandserver_mcp/server.py:1901 · File permission modification command — agent changes file ownership/permissionsJOB_START = r'''d=/var/tmp/server-mcp-jobs-$(id -u); mkdir -p "$d"; chmod 700 "$d"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedserver_mcp/server.py:462 · Python subprocess execution detectedp = subprocess.run(cmd, capture_output=True, timeout=timeout or _timeout(), **kw)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Reads credential paths from the home directorytests/test_server.py:100 · Reads credential paths from the home directorycheck("key file is blocked", s._classify("cat ~/.ssh/id_ed25519") == "blocked")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathsserver_mcp/server.py:1138 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesr"(^\.env|\.env$|\.(pem|key|p12|pfx|kdbx)$|^id_(rsa|dsa|ecdsa|ed25519)$|^authorized_keys$"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
References a credential file in the home directorytests/test_server.py:100 · References a credential file in the home directorycheck("key file is blocked", s._classify("cat ~/.ssh/id_ed25519") == "blocked")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Privileged sudo commandtests/test_server.py:170 · Privileged sudo command — agent may execute with elevated privilegescheck("SSH password is also the sudo password", hh["sudo_password"] == "pw123")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/test_server.py:199 · Python subprocess execution detectedr = subprocess.run(argv, input=feed + b"file data\n", capture_output=True, env=env)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandserver_mcp/server.py:1971 · Process kill command — agent can terminate processes…n "$d"/*.pid; do [ -e "$r" ] || continue; b="${r%.pid}"; if [ ! -e "$b.rc" ] && kill -0 "$(cat "$r")" 2>/dev/null && ! ps -o stat= -p "$(cat "$r")" 2>/dev/null | gre…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandserver_mcp/server.py:1963 · Process kill command — agent can terminate processesstop = _gate(h, "destructive", f"cancel job {job_id}", f"kill the process group of job {job_id}", confirm)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandserver_mcp/server.py:1967 · Process kill command — agent can terminate processesf'[ -n "$p" ] && kill -s TERM -- "-$p" 2>&1 && echo "stop signal sent to job {job_id}" || echo "could not stop it (already finished?)"', as_root)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandserver_mcp/server.py:1237 · File permission modification command — agent changes file ownership/permissionsif [ -n "$mode" ]; then chmod "$mode" -- "$t"; fiFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Privileged sudo commandtests/test_server.py:135 · Privileged sudo command — agent may execute with elevated privilegescheck("sudo password goes through stdin only", feed == b"pw\n" and "pw" not in " ".join(argv) and argv[-1] == "ls")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Privileged sudo commandtests/test_server.py:127 · Privileged sudo command — agent may execute with elevated privileges# ---------------------------------------------------------------- sudo and docker pathFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Privileged sudo commandtests/test_server.py:167 · Privileged sudo command — agent may execute with elevated privileges# ---------------------------------------------------------------- sudo password from the SSH passwordFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandserver_mcp/server.py:1914 · Process kill command — agent can terminate processeselif kill -0 "$(cat "$d/$id.pid" 2>/dev/null)" 2>/dev/null && ! ps -o stat= -p "$(cat "$d/$id.pid")" 2>/dev/null | grep -q Z; then st="running"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive file system command detectedtests/test_server.py:92 · Destructive file system command detectedcheck("rm is destructive", s._classify("rm -rf /tmp/x") == "destructive")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈34 tok
1 file · 10 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

8 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim drmogie: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. Reads credential paths from the home directory≈ +2 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim drmogiePropose a patch to the maintainer