Is axm-mcp@0.8.0 safe to install?

axm-mcp@0.8.0

CAUTION

Publisher claims: "AXM MCP Server — Runtime execution for the axm-protocols ecosystem" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher axm-protocols · joined 7 days agoInstalls 315Last detonated 7d ago

What would fix this Watch Dispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-10-27 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Auto-update or dynamic fetch configuration. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.3sprocessdependency install exit 1

0.3sprocessexec /usr/bin/timeout

0.3sprocessexec .venv/bin/axm-mcp

0.3sprocessexited 127: timeout: failed to run command '.venv/bin/axm-mcp': No such file or directory

0.3sclaimedno tools/list reply (exit 127)

0.3sprocessscript backend runs setup only

Static findings

MEDIUM

Process kill commandpyproject.toml:183 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

HIGH

Auto-update or dynamic fetch configurationsrc/axm_mcp/web_fetch.py:40 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Python subprocess execution detectedsrc/axm_mcp/lifecycle.py:109 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL using raw IP addresstests_axm_mcp/e2e/test_serve.py:322 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Python subprocess execution detectedsrc/axm_mcp/lifecycle.py:80 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests_axm_mcp/e2e/conftest.py:110 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL using raw IP addresstests_axm_mcp/e2e/test_serve.py:226 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Python subprocess execution detectedtests_axm_mcp/e2e/test_serve.py:38 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/axm_mcp/lifecycle.py:87 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL using raw IP addresstests_axm_mcp/e2e/test_serve.py:304 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Python subprocess execution detectedsrc/axm_mcp/cli.py:105 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests_axm_mcp/e2e/test_serve.py:137 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL using raw IP addresstests_axm_mcp/e2e/test_serve.py:577 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Python subprocess execution detectedtests_axm_mcp/e2e/test_serve.py:166 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests_axm_mcp/e2e/test_serve.py:98 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

MCP server using network transport (SSE/HTTP)src/axm_mcp/server.py:3 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

MCP server using network transport (SSE/HTTP)src/axm_mcp/mcp_app.py:192 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

Python subprocess execution detectedtests_axm_mcp/e2e/test_serve.py:64 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Outbound HTTP to raw IP addresstests_axm_mcp/e2e/test_serve.py:226 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

URL using raw IP addresstests_axm_mcp/unit/test_daemon.py:66 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Outbound HTTP to raw IP addresstests_axm_mcp/e2e/test_serve.py:577 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

URL using raw IP addresstests_axm_mcp/unit/test_daemon.py:67 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

URL using raw IP addresstests_axm_mcp/unit/test_cli.py:359 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Outbound HTTP to raw IP addresstests_axm_mcp/unit/test_daemon.py:95 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Python subprocess execution detectedtests_axm_mcp/e2e/test_status.py:24 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Outbound HTTP to raw IP addresstests_axm_mcp/e2e/test_serve.py:322 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

URL using raw IP addresstests_axm_mcp/unit/test_daemon.py:95 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Outbound HTTP to raw IP addresstests_axm_mcp/unit/test_cli.py:359 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

URL using raw IP addresstests_axm_mcp/unit/test_cli.py:358 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Outbound HTTP to raw IP addresstests_axm_mcp/e2e/test_serve.py:304 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Python subprocess execution detectedtests_axm_mcp/e2e/test_stop.py:30 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Outbound HTTP to raw IP addresstests_axm_mcp/unit/test_daemon.py:67 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Outbound HTTP to raw IP addresstests_axm_mcp/unit/test_daemon.py:66 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Outbound HTTP to raw IP addresstests_axm_mcp/unit/test_cli.py:358 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%

Unclaimed publisher≈ +8 on the totalClaim axm-protocols: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
URL using raw IP address≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim axm-protocols