Is congressional-explorer-mcp@0.6.7 safe to install?

Skills/PyPI/congressional-explorer-mcp

congressional-explorer-mcp@0.6.7

CAUTION· not started

Publisher claims: "Local Congress research over immutable archive releases" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher civictechdc · publishing for 15 daysInstalls 1,542Last detonated 32 h ago

What would fix this Watch Dispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.

Tested: the dependency install step · every file read, file written and host contacted by what ran
Not tested: server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: no credential variables read in the code
Where it talks to: no vendor host named in the codeAlso congress.gov, spicygov.ai — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: server startup · the tool list · tool behavior

Connect it under the guard. Not started: dependency install failed; the server itself was not observed. The code names no credential variable; the guard pins the network to what the honeypot saw and logs every call.

$vet-skills run --net declared -- uvx congressional-explorer-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 78/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: README links to an external installer. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.1sprocessdependency install exit 1 ·

0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed

0.1sprocessscript backend runs setup only

0.1sprocessno install scripts to re-run

Static findings

HIGH

README links to an external installerREADME.md → https://github.com/civictechdc/congressional-tech/releases/download/congress-mcp-v0.6.7/congress-explorer-web-0.6.7.plugin.zip

https://github.com/civictechdc/congressional-tech/releases/download/congress-mcp-v0.6.7/congress-explorer-web-0.6.7.plugin.zip

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Python subprocess execution detectedsrc/congressional_explorer_mcp/body_reader.py:275 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/congressional_explorer_mcp/index_builder.py:233 · Python subprocess execution detectedobservation=subprocess.run(['ps','-axo','pid=,pgid=,rss='],capture_output=True,text=True,timeout=3,check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/congressional_explorer_mcp/index_builder.py:227 · Python subprocess execution detectedprocess=subprocess.Popen(command,stdout=subprocess.DEVNULL,stderr=diagnostics,start_new_session=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/congressional_explorer_mcp/index_storage.py:29 · Python subprocess execution detectedsubprocess.run(['cp','--reflink=always','--',str(source),str(target)],check=True,capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_pdf_decoder.py:338 · Python subprocess execution detectedstatus = subprocess.run(['ps', '-o', 'stat=', '-p', str(parser['pid'])],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_pdf_decoder.py:403 · Python subprocess execution detectedstatus = subprocess.run(['ps', '-axo', 'pid=,pgid=,stat='],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

File type combined with upload actionsrc/congressional_explorer_mcp/index_storage.py:153 · File type combined with upload action — agent may exfiltrate local data filesatomic_json(work/'freeze-intent.json',dict(mutable=str(work/'work.sqlite'),path=str(frozen),output=str(output),Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

Python subprocess execution detectedtests/test_pdf_decoder.py:85 · Python subprocess execution detectedstatus = subprocess.run(['ps', '-o', 'stat=', '-p', str(pid)], capture_output=True, text=True).stdout.strip()Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_http.py:32 · Python subprocess execution detectedprocess = subprocess.Popen(args, stdout=log, stderr=log)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

File type combined with upload actiontests/test_text_index.py:361 · File type combined with upload action — agent may exfiltrate local data filesassert (work/'work.sqlite').stat().st_ino!=output.stat().st_inoFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

Python subprocess execution detectedsrc/congressional_explorer_mcp/large_body_reader.py:65 · Python subprocess execution detectedproc = subprocess.run([path, '-v'], capture_output=True, timeout=5, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_large_body_reader.py:74 · Python subprocess execution detectedchild=subprocess.run([sys.executable,'-c',code,json.dumps(value),str(tmp_path),json.dumps(BOUNDS)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_recovery.py:42 · Python subprocess execution detectedparent = subprocess.Popen([sys.executable, str(helper), str(cache), str(status)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_http.py:132 · Python subprocess execution detectedprocess = subprocess.Popen(args, stdout=log, stderr=log)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/congressional_explorer_mcp/pdf_decoder.py:119 · Python subprocess execution detectedwith subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_pdf_decoder.py:386 · Python subprocess execution detectedowner = subprocess.Popen([sys.executable, '-c', owner_code], stdout=subprocess.DEVNULL,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/congressional_explorer_mcp/large_body_reader.py:294 · Python subprocess execution detectedprocess = subprocess.Popen(command, stdout=out, stderr=err, preexec_fn=cap_file)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_recovery.py:64 · Python subprocess execution detectedstate = subprocess.run(['ps','-o','stat=','-p',str(worker['pid'])], capture_output=True, text=True).stdout.strip()Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

MCP server using network transport (SSE/HTTP)tests/test_http.py:80 · MCP server using network transport (SSE/HTTP) — data sent over networkassert config['mcpServers']['congress']['type'] == 'streamable-http'Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

Python subprocess execution detectedsrc/congressional_explorer_mcp/pdf_decoder.py:37 · Python subprocess execution detectedprocess = subprocess.Popen(sys.argv[3:])Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Process kill commandsrc/congressional_explorer_mcp/pdf_decoder.py:114 · Process kill command — agent can terminate processes# A new session would leave that owner's accounting and kill group.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Python subprocess execution detectedtests/test_pdf_decoder.py:426 · Python subprocess execution detectedresult = subprocess.run(command, start_new_session=True, timeout=2)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_recovery.py:58 · Python subprocess execution detectedassert subprocess.run(['ps','-o','stat=','-p',str(worker['pid'])], capture_output=True, text=True).stdout.strip()Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Access to sensitive file pathstests/test_reader.py:206 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"SELECT * FROM read_text('/etc/passwd')", "SELECT * FROM read_csv('https://example.com/a.csv')",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Python subprocess execution detectedtests/test_desktop.py:109 · Python subprocess execution detectedsubprocess.run([sys.executable, str(root / 'scripts/build_desktop.py'), '--check',Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_recovery.py:237 · Python subprocess execution detectedparent = subprocess.Popen([sys.executable,str(helper),str(cache),str(phase2),str(status)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

Cost to the agent

Instructions loaded

≈57 tok

1 file · 55 in bundle

Tool list per prompt

≈0 tok

0 tools · 0 per tool

Handshake

no reply

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for congressional-explorer-mcp@0.6.7 as of 31 h ago. This is the package itself, not its dependencies.

What would make this Verified

2 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%

Unclaimed publisher≈ +8 on the totalClaim civictechdc: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
README links to an external installer≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim civictechdc Propose a patch to the maintainer