gns3-mcp@0.60.0
CAUTION· not startedPublisher claims: "GNS3 lab automation MCP server with AI agent integration" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry PyPI (MCP server)Publisher chistokhinsv · publishing for 378 daysInstalls 1,337Last detonated 28 min ago
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
GNS3_PASSWORDMCP_API_KEYPASSWORDConfiguration, not credentials: GNS3_HOST, GNS3_MCP_ENV_FILE, GNS3_PORT, GNS3_USE_HTTPS, GNS3_USER, GNS3_VERIFY_SSL, SSH_PROXY_URL- Where it talks to
- no vendor host named in the codeAlso python.org — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names python.org as well as its own vendor. The guard injects GNS3_PASSWORD, MCP_API_KEY, PASSWORD only into requests to the host you bind (and its subdomains) and refuses the rest.
$vet-skills run --net declared -- uvx gns3-mcp
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-14 and scored it 72/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run
Static findings
HIGH
Access to sensitive file pathsgns3_mcp/cli.py:5 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05It loads environment variables from .env files and starts the server with theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsgns3_mcp/cli.py:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05return Path(os.getenv("GNS3_MCP_ENV_FILE") or Path.home() / ".gns3-mcp" / ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsgns3_mcp/cli.py:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"""User-level .env shared by every client (plugin, uvx, pip install)"""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Collapsed <details> block carrying instructionsREADME.md:420 · Collapsed <details> block carrying instructions
AST01<summary><b>HTTP Mode (Always-Running Service)</b></summary> ### HTTP Mode Configuration **HTTP mode** requires a persistent service and API key authentication.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Access to sensitive file pathsgns3_mcp/cli.py:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Settings that may come from the environment or .env filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsgns3_mcp/configure.py:56 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05- GNS3 settings are in `~/.gns3-mcp/.env`; `uvx gns3-mcp configure <agent>` changes them.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagegns3_mcp/configure.py:3 · npx invocation of non-well-known package — may execute untrusted code
AST06Modelled on `npx webiny-mcp configure <agent>`: asks for the GNS3 settings, checks the login,Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathsgns3_mcp/server/app.py:157 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# USER stays as a fallback for older .env files and the Windows service config.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.LOW
URL to a private-network addressgns3_mcp/server/tools/ssh_tools.py:84 · URL to a private-network address — a LAN or development target
AST07# we need "http://192.168.1.20:5004" (GNS3 host IP)Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.HIGH
Access to sensitive file pathsgns3_mcp/configure.py:783 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"""Update the GNS3 keys of the user .env; other keys (MCP_API_KEY, ...) stay"""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsgns3_mcp/cli.py:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"""Load settings: plugin options > process env > --env-file (or ./.env) > user-level .env.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.LOW
URL to a private-network addressgns3_mcp/server/tools/ssh_tools.py:59 · URL to a private-network address — a LAN or development target
AST07Proxy URL (e.g., "http://192.168.1.20:8022" or "http://localhost:5004")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
Access to sensitive file pathstests/test_mcp_console.py:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Load .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.LOW
URL to a private-network addressgns3_mcp/server/main.py:2001 · URL to a private-network address — a LAN or development target
AST07>>> http_client(action="status", url="https://10.1.1.2:443", verify_ssl=False)Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.HIGH
Access to sensitive file pathsgns3_mcp/configure.py:711 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"""Flags > GNS3_* environment > saved ~/.gns3-mcp/.env > built-in defaults.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File permission modification commandgns3_mcp/server/tools/project_tools.py:294 · File permission modification command — agent changes file ownership/permissions
AST05# `chown -R` does not follow symbolic links (coreutils forces -P), so container links that pointFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.LOW
URL to a private-network addressgns3_mcp/server/main.py:1991 · URL to a private-network address — a LAN or development target
AST07>>> http_client(action="get", url="http://10.1.1.1")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.HIGH
Access to sensitive file pathsgns3_mcp/server/main.py:2471 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"Set it in .env or the environment; clients send it in the 'MCP_API_KEY' header."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsgns3_mcp/configure.py:672 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# GNS3 settings: ~/.gns3-mcp/.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.LOW
URL to a private-network addressgns3_mcp/server/notification_manager.py:59 · URL to a private-network address — a LAN or development target
AST07base_url: GNS3 server base URL (e.g., http://192.168.1.20:80)Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.HIGH
Privileged sudo commandgns3_mcp/server/tools/project_tools.py:311 · Privileged sudo command — agent may execute with elevated privileges
AST05fix = f"sudo chown -Rh --reference={target} {target} && sudo chmod -R u+rwX {target}"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsgns3_mcp/server/exceptions.py:153 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"Check GNS3 username and password in .env file",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.LOW
URL to a private-network addressgns3_mcp/server/main.py:692 · URL to a private-network address — a LAN or development target
AST07{"connected": false, "server": "http://192.168.1.20:80",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
Access to sensitive file pathstests/test_mcp_console.py:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05env_path = Path(__file__).parent.parent / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedgns3_mcp/configure.py:590 · Python subprocess execution detected
AST05return subprocess.run([cli, *args], capture_output=True, text=True, timeout=60, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedgns3_mcp/configure.py:587 · Python subprocess execution detected
AST05return subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Access to sensitive file pathstests/test_port_field.py:25 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05load_dotenv(parent_dir / ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsgns3_mcp/configure.py:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05saves them in ~/.gns3-mcp/.env (the server reads that file, so agent configs hold no secrets),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File permission modification commandgns3_mcp/server/tools/project_tools.py:311 · File permission modification command — agent changes file ownership/permissions
AST05fix = f"sudo chown -Rh --reference={target} {target} && sudo chmod -R u+rwX {target}"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.LOW
URL to a private-network addressgns3_mcp/server/main.py:2012 · URL to a private-network address — a LAN or development target
AST07... url="http://10.1.1.3/api/v1/status",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.Cost to the agent
Instructions loaded
≈49 tok
1 file · 56 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
Not checked against OSV yet; the weekly check has not reached this version.
What would make this Verified
8 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim chistokhinsv: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
- File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim chistokhinsvPropose a patch to the maintainer