Skills/PyPI/librus-mcp

librus-mcp@2.8.0

VERIFIED· not started

Publisher claims: "MCP server for Librus Synergia using the independent librus-python-api" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher krzysztofbury · publishing for 249 daysInstalls 2,720Last detonated 31 min ago
$claude mcp add librus-mcp -- uvx librus-mcp
WatchReport an issue

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
LIBRUS_MCP_TOKENLIBRUS_MCP_TOKEN_FILELIBRUS_PASSWORD or --generate-tokenConfiguration, not credentials: AGENT_SCRATCH_DIR, LIBRUS_ACCOUNTS, LIBRUS_ALIAS, LIBRUS_CONFIG, LIBRUS_FEATURES, LIBRUS_MCP_DIAGNOSE_FAILURES, LIBRUS_MCP_HOST, LIBRUS_MCP_LOG_OPERATIONS, LIBRUS_USERNAME, MUTANT_UNDER_TEST, NATIVE_MUTATION_REPORT_DIR, NATIVE_TEST_BUDGET_REQUESTS, NATIVE_TEST_ORIGIN
Where it talks to
no vendor host named in the codeAlso example.invalid — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names example.invalid as well as its own vendor. The guard injects LIBRUS_MCP_TOKEN, LIBRUS_MCP_TOKEN_FILE, LIBRUS_PASSWORD only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx librus-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-14 and scored it 90/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

MEDIUM
Python subprocess execution detectedrelease_verification/verify_image.py:52 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedrelease_verification/verify_wheel.py:104 · Python subprocess execution detectedprocess = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandDockerfile:45 · File permission modification command — agent changes file ownership/permissions&& chown -R 10001:10001 /data \Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedtests_native/test_migration.py:213 · Python subprocess execution detectedrejected = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedrelease_verification/verify_release.py:68 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedrelease_verification/verify_release.py:89 · Python subprocess execution detectedreturn subprocess.run(ancestor, check=False).returncode == 0Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedrelease_verification/verify_sdist.py:56 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandDockerfile:46 · File permission modification command — agent changes file ownership/permissions&& chmod -R 700 /dataFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedrelease_verification/verify_wheel.py:282 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedrelease_verification/verify_wheel.py:251 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedrelease_verification/verify_image.py:200 · Python subprocess execution detectedsubprocess.run(["docker", "volume", "rm", volume], check=False, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedrelease_verification/verify_image.py:199 · Python subprocess execution detectedsubprocess.run(["docker", "rm", "-f", container], check=False, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedrelease_verification/verify_release.py:53 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedrelease_verification/verify_wheel.py:257 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedrelease_verification/verify_wheel.py:230 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests_native/test_migration.py:224 · Python subprocess execution detectedrejected = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests_native/test_migration.py:267 · Python subprocess execution detectedexported = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests_native/test_migration.py:234 · Python subprocess execution detectedcompleted = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests_native/test_release_pipeline.py:63 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests_native/test_migration.py:247 · Python subprocess execution detectedrepeated = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈53 tok
1 file · 74 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Not checked against OSV yet; the weekly check has not reached this version.