Is mcp-authscan@1.1.20 safe to install?

mcp-authscan@1.1.20

CAUTION· not started

Publisher claims: "MCP AuthScan" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher lhmisme420 · publishing for 41 daysInstalls 482Last detonated 8d ago

What would fix this Watch Dispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.

Tested: the dependency install step · every file read, file written and host contacted by what ran
Not tested: server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

Code inventory arrives with this version's next honeypot run.

It will ask for: unknown until the next run
Where it talks to: unknown until the next run
What the honeypot saw: no credential files read · no network
What we could not test: server startup · the tool list · tool behavior

Not enough was observed to say yet. Not started: dependency install failed; the server itself was not observed. This version's code has not been inventoried for credentials and hosts either; both arrive with its next honeypot run (popular servers first). `vet-skills try mcp-authscan` runs it now and prints the full answer.

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-06 and scored it 74/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Credential pass-through configuration; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.1sprocessdependency install exit 1

0.2sprocessexec /usr/bin/date

0.2sprocessexec /usr/bin/timeout

0.2sprocessexec .venv/bin/mcp-authscan

0.2sclaimedno tools/list reply (exit 0)

0.2sprocessscript backend runs setup only

0.2sprocessno install scripts to re-run

Static findings

MEDIUM

Access to sensitive file pathstests/test_cli_packaging.py:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".venv", ".env", ".env.*", "*.db*", "*.sqlite*", "*.key", "*.pem",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

URL using raw IP addresstests/test_egress_guard.py:33 · URL using raw IP address — may bypass domain-based filtering"http://100.64.0.1/token", # CGNAT / TailscaleFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Python subprocess execution detectedmcp_authscan/monolith.py:662 · Python subprocess execution detectedcommit_sha = subprocess.check_output(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL using raw IP addresstests/test_egress_guard.py:11 · URL using raw IP address — may bypass domain-based filteringor `"http://100.64.0.1/..."` (Tailscale/CGNAT) made the scanner issue thatFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

HIGH

Credential pass-through configurationmcp_authscan/authorized_scan.py:100 · Credential pass-through configuration — agent relays sensitive credentials# No proxy credentials, cookie jar, netrc authentication, or redirect scopeFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST02

MEDIUM

Python subprocess execution detectedmcp_authscan/monolith.py:2468 · Python subprocess execution detected

commit_hash = subprocess.check_output(["git", "rev-parse", "--short", "HEAD"], cwd="/home/lhmisme/mcp-authscan", text=True).strip()

Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_debug_output.py:18 · Python subprocess execution detectedreturn subprocess.run(cmd, cwd=str(ROOT), stdin=subprocess.DEVNULL, capture_output=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedmcp_authscan/repository_scan.py:71 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Access to sensitive file pathstests/test_authorized_scan.py:136 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfor target in ("file:///etc/passwd", "https://user:[email protected]",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Python subprocess execution detectedmcp_authscan/monolith.py:650 · Python subprocess execution detectedrepo_url = subprocess.check_output(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL to the cloud instance metadata addresstests/test_egress_guard.py:32 · URL to the cloud instance metadata address — reads the VM's credentials"http://169.254.169.254/latest/meta", # cloud metadata (link-local)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

URL with embedded credentialstests/test_authorized_scan.py:136 · URL with embedded credentials — may be phishing or credential leakingfor target in ("file:///etc/passwd", "https://user:[email protected]",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

Python subprocess execution detectedmcp_authscan/repository_scan.py:51 · Python subprocess execution detectedclone = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_dcr_client_source.py:126 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_cli_packaging.py:45 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_coverage_testable.py:25 · Python subprocess execution detectedreturn subprocess.run(cmd, cwd=str(ROOT), capture_output=True, text=True, env=env,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL to the cloud instance metadata addresstests/test_egress_guard.py:10 · URL to the cloud instance metadata address — reads the VM's credentialsA server that answers 401 with `resource_metadata="http://169.254.169.254/..."`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

Python subprocess execution detectedmcp_authscan/monolith.py:656 · Python subprocess execution detectedbranch = subprocess.check_output(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

HIGH

Access to sensitive file pathsmcp_authscan/content_probe.py:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesr"(?i)(~/\.ssh|id_rsa|/etc/passwd|/etc/shadow|\.env\b"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Python subprocess execution detectedtests/test_cli_packaging.py:105 · Python subprocess execution detectedoutput = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_cli_packaging.py:103 · Python subprocess execution detectedsubprocess.run([str(pip), "install", "-q", str(editable)], check=True, cwd=temp)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

HIGH

Access to sensitive file pathsmcp_authscan/monolith.py:945 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

if "@" not in ev and any(seg in pl for seg in (".config.", "/scripts/", "tsdown", "vite.config", "webpack", "rollup", "/config/", ".env.example")):

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Python subprocess execution detectedtests/test_exit_codes.py:86 · Python subprocess execution detectedhelp_out = subprocess.run(["mcp-authscan", "-h"], capture_output=True).stdoutFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Outbound HTTP to raw IP addresstests/test_egress_guard.py:33 · Outbound HTTP to raw IP address — may bypass domain-based monitoring"http://100.64.0.1/token", # CGNAT / TailscaleFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Access to sensitive file pathstests/test_egress_guard.py:37 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"file:///etc/passwd", # not an HTTP fetch at allFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

AST07

MEDIUM

Python subprocess execution detectedtests/test_exit_codes.py:43 · Python subprocess execution detected

result = subprocess.run(["mcp-authscan", "http://127.0.0.1:9999", "--authorized-by", "Test", "--auth-basis", "Test", "--contact", "[email protected]"], capture_output=True)

Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

AST07

MEDIUM

Python subprocess execution detectedtests/test_verdict_contract.py:82 · Python subprocess execution detectedr = subprocess.run(cmd, cwd=str(ROOT), capture_output=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_verdict_contract.py:287 · Python subprocess execution detectedr = subprocess.run(cmd, cwd=str(ROOT), stdin=subprocess.DEVNULL, capture_output=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_verdict_contract.py:66 · Python subprocess execution detectedp = subprocess.Popen(cmd, cwd=str(ROOT),Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_module_entry.py:14 · Python subprocess execution detectedreturn subprocess.run(cmd, capture_output=True, env=ENV, stdin=subprocess.DEVNULL, timeout=60)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_version_parity.py:63 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_halted_scan_exit.py:28 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_exit_codes.py:37 · Python subprocess execution detected

result = subprocess.run(["mcp-authscan", "http://127.0.0.1:9003", "--authorized-by", "Test", "--auth-basis", "Test", "--contact", "[email protected]"], capture_output=True)

Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_verdict_contract.py:186 · Python subprocess execution detectedp = subprocess.Popen(cmd, cwd=str(ROOT), stdin=subprocess.PIPE,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_json_output_file.py:18 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Outbound HTTP to raw IP addresstests/test_egress_guard.py:11 · Outbound HTTP to raw IP address — may bypass domain-based monitoringor `"http://100.64.0.1/..."` (Tailscale/CGNAT) made the scanner issue thatFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Python subprocess execution detectedtests/test_exit_codes.py:72 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_readme_commands.py:48 · Python subprocess execution detectedr = subprocess.run([sys.executable, "-m", "mcp_authscan", "--help"], capture_output=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_exit_codes.py:52 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

Cost to the agent

Instructions loaded

≈40 tok

1 file · 81 in bundle

Tool list per prompt

≈0 tok

0 tools · 0 per tool

Handshake

no reply

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp-authscan@1.1.20 as of 10 h ago. This is the package itself, not its dependencies.

What would make this Verified

6 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%

Unclaimed publisher≈ +8 on the totalClaim lhmisme420: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
Access to sensitive file paths≈ +2 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
URL using raw IP address≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim lhmisme420 Propose a patch to the maintainer