mcp-contextforge-gateway@1.1.0
CAUTION· not startedPublisher claims: "ContextForge AI Gateway — an AI gateway, registry, and proxy for MCP, A2A, and REST/gRPC APIs. Exposes a unified control plane with centralized governance, discovery, and observability. Optimizes agent and tool calling, and supports plugins." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry PyPI (MCP server)Publisher ibm · publishing for 525 daysInstalls 28,913Last detonated 25 h ago
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
AUTH_REQUIREDCI_DEFAULT_USER_PASSWORDCI_ENC_SECRETCI_JWT_SECRETCI_PLATFORM_ADMIN_PASSWORDDATABASE_URLDETECT_SECRETS_FILES_EXCLUDEDETECT_SECRETS_PATHDETECT_SECRETS_SPECDOCKER_PASSWORDJWT_SECRET_KEYKEY_FILE_PASSWORDMCPGATEWAY_BEARER_TOKENTOKENTOKEN_EXPIRYor--jwt-secretConfiguration, not credentials: BENCHMARK_ITERATIONS, CONTAINERFILE_PATH, CONTEXTFORGE_URL, DB_MAX_OVERFLOW, DB_PATH, DB_POOL_RECYCLE, DB_POOL_SIZE, DB_POOL_TIMEOUT, FORGE_CONTENT_TYPE, LOOPBACK_CLIENT_KEY, MCG_HOST, MCG_PORT, MCPGATEWAY_URL, NGINX_DOCKERFILE_PATH, PLATFORM_ADMIN_EMAIL, SQLALCHEMY_ECHO, TRACKED_PATHS, VENV_DIR, VIRTUAL_ENV, WHEELS_CONTAINERFILE_PATH- Where it talks to
- no vendor host named in the codeAlso docker.com, sqlalchemy.org, cohere.ai, mistral.ai, groq.com, together.xyz, ibm.com, brew.sh, graphviz.org, pandoc.org, redhat.com, duckduckgo.com, astral.sh, httpbin.org — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names docker.com, sqlalchemy.org, cohere.ai, mistral.ai, groq.com, together.xyz, ibm.com, brew.sh, graphviz.org, pandoc.org, redhat.com, duckduckgo.com, astral.sh, httpbin.org as well as its own vendor. The guard injects AUTH_REQUIRED, CI_DEFAULT_USER_PASSWORD, CI_ENC_SECRET, CI_JWT_SECRET, CI_PLATFORM_ADMIN_PASSWORD, DATABASE_URL, DETECT_SECRETS_FILES_EXCLUDE, DETECT_SECRETS_PATH, DETECT_SECRETS_SPEC, DOCKER_PASSWORD, JWT_SECRET_KEY, KEY_FILE_PASSWORD, MCPGATEWAY_BEARER_TOKEN, TOKEN, TOKEN_EXPIRY only into requests to the host you bind (and its subdomains) and refuses the rest.
$vet-skills run --net declared -- uvx mcp-contextforge-gateway
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 64/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Collapsed <details> block carrying instructions; Collapsed <details> block carrying instructions; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.2sprocessdependency install exit 1 ·
0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run
Static findings
HIGH
Collapsed <details> block carrying instructionsREADME.md:140 · Collapsed <details> block carrying instructions
AST01<summary><strong>🔍 OpenTelemetry Observability</strong></summary> * **Vendor-agnostic tracing** with OpenTelemetry (OTLP) protocol support * **Multiple backendFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Collapsed <details> block carrying instructionsREADME.md:183 · Collapsed <details> block carrying instructions
AST01<summary><strong>📋 Prerequisites</strong></summary> * **Python ≥ 3.11** * **curl + jq** - only for the last smoke-test stepFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Access to sensitive file pathsplugins/AGENTS.md:97 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05### 4. Enable in .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.CRITICAL
Pipe-to-shell patternscripts/lib/common.sh:80 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06curl -LsSf https://astral.sh/uv/install.sh | sh >&2Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathsmcpgateway/cli.py:134 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05path (str): Path to the .env file to validate. Defaults to ".env".Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsmcpgateway/cli.py:140 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05>>> _handle_validate_config(".env.example") # doctest: +SKIPFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsmcpgateway/cli.py:125 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05def _handle_validate_config(path: str = ".env") -> None:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsmcpgateway/cli.py:129 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05Attempts to load settings from the specified .env file using Pydantic.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandscripts/lib/rhel.sh:93 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo dnf remove -y docker \Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsscripts/testing-web-ui-port.sh:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# .env files and exported variables take the same precedence as they do forFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandscripts/tune-loadtest.sh:97 · Privileged sudo command — agent may execute with elevated privileges
AST05echo " sudo sysctl -w net.core.somaxconn=65535"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Credential pass-through configurationscripts/mask-secrets-test.sh:86 · Credential pass-through configuration — agent relays sensitive credentials
AST02# Generate admin bypass token (teams=null + is_admin=true) via Python scriptFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Destructive file system command detectedscripts/ci/run_upgrade_validation.sh:747 · Destructive file system command detected
AST05docker run --rm \Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsscripts/lib/common.sh:247 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [[ -f .env ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandscripts/lib/rhel.sh:57 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo dnf remove -y podman runc 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandscripts/lib/debian.sh:77 · Privileged sudo command — agent may execute with elevated privileges
AST05curl -fsSL "$docker_repo_base/gpg" | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpgFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsscripts/lib/common.sh:252 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if [[ -f .env.example ]]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandscripts/lib/debian.sh:37 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo apt updateFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Credential pass-through configurationscripts/mask-secrets-test.sh:135 · Credential pass-through configuration — agent relays sensitive credentials
AST02echo "FATAL: Could not generate admin bypass token"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandscripts/lib/rhel.sh:75 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo dnf remove -y podman runc 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandscripts/lib/common.sh:68 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo systemctl enable dockerFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandscripts/lib/rhel.sh:106 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo dnf -y install dnf-plugins-coreFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsrun.sh:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05ENV_FILE=${ENV_FILE:-.env}Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandscripts/tune-loadtest.sh:3 · Privileged sudo command — agent may execute with elevated privileges
AST05# Run with: sudo scripts/tune-loadtest.shFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandscripts/contextforge-setup.sh:18 · Privileged sudo command — agent may execute with elevated privileges
AST05# Then run this script as that user (or any user with sudo privileges).Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsscripts/testing-web-ui-port.sh:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# leaves this unset so Compose applies its default .env.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandscripts/contextforge-setup.sh:92 · Privileged sudo command — agent may execute with elevated privileges
AST05echo " usermod -aG sudo contextforge # Debian-family"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandscripts/lib/debian.sh:76 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo install -m 0755 -d /etc/apt/keyringsFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandscripts/lib/common.sh:20 · Privileged sudo command — agent may execute with elevated privileges
AST05log_error "Do not run this script as root. Run as a regular user with sudo privileges."Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsrun.sh:101 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Create default .env if it doesn't existFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/lib/common.sh:248 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05log_info ".env file already exists"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandpyproject.toml:221 · Privileged sudo command — agent may execute with elevated privileges
AST05# Install with: sudo apt-get install libpq-dev (or dnf install postgresql-devel)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandscripts/lib/debian.sh:78 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo chmod a+r /etc/apt/keyrings/docker.gpgFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Credential pass-through configurationscripts/mask-secrets-test.sh:138 · Credential pass-through configuration — agent relays sensitive credentials
AST02echo " Admin bypass token: ${ADMIN_T:0:40}..."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandscripts/lib/debian.sh:40 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo apt install -y \Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandscripts/lib/common.sh:59 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo usermod -aG docker "$USER"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Credential pass-through configurationscripts/mask-secrets-test.sh:132 · Credential pass-through configuration — agent relays sensitive credentials
AST02# Admin bypass token (teams=null + is_admin=true)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandscripts/lib/common.sh:67 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo systemctl start dockerFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandscripts/lib/rhel.sh:40 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo dnf install -y --allowerasing \Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Credential pass-through configurationscripts/mask-secrets-test.sh:144 · Credential pass-through configuration — agent relays sensitive credentials
AST02echo "FATAL: Could not generate admin-no-bypass token"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Destructive file system command detectedscripts/ci/run_upgrade_validation.sh:639 · Destructive file system command detected
AST05docker run --rm \Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandscripts/contextforge-setup.sh:15 · Privileged sudo command — agent may execute with elevated privileges
AST05# usermod -aG sudo contextforge # Debian-familyFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsrun.sh:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05echo " -e, --env FILE Use specific env file (default: .env)"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/lib/common.sh:253 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05log_info "Creating .env from .env.example..."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File permission modification commandscripts/lib/debian.sh:78 · File permission modification command — agent changes file ownership/permissions
AST05sudo chmod a+r /etc/apt/keyrings/docker.gpgFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Python subprocess execution detectedscripts/test_mcp_client.py:16 · Python subprocess execution detected
AST05token_result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
MCP server using network transport (SSE/HTTP)mcp-catalog.yml:586 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04url: "https://mcp-server.egnyte.com/sse"Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
File permission modification commandscripts/ci/run_upgrade_validation.sh:371 · File permission modification command — agent changes file ownership/permissions
AST05touch "${db_file}" && chmod 666 "${db_file}"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Remote installer piped to shellscripts/lib/common.sh:80 · Remote installer piped to shell
AST07curl -LsSf https://astral.sh/uv/install.sh | sh >&2Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packagemcp-catalog.yml:1983 · npx invocation of non-well-known package — may execute untrusted code
AST06install: "npx -y @microsoft/devbox-mcp@latest"Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Python subprocess execution detectedrun_mutmut.py:22 · Python subprocess execution detected
AST05result = subprocess.run(cmd, shell=True, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commanddocker-compose.yml:2469 · File permission modification command — agent changes file ownership/permissions
AST05chmod 640 /certs/key.pemFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Privileged sudo commanddocker-compose.yml:8 · Privileged sudo command — agent may execute with elevated privileges
AST05…ting/performance.md for full details # # One-liner (TCP + VM + I/O tuning): # sudo sysctl -w net.core.somaxconn=65535 net.core.netdev_max_backlog=65535 net.ipv4.tc…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedscripts/license_checker.py:742 · Python subprocess execution detected
AST05return subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Privileged sudo commanddocker-compose.yml:10 · Privileged sudo command — agent may execute with elevated privileges
AST05# Make persistent: sudo tee /etc/sysctl.d/99-mcp-loadtest.conf (see docs)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Privileged sudo commanddocker-compose.yml:666 · Privileged sudo command — agent may execute with elevated privileges
AST05- no-new-privileges:true # Prevent privilege escalation via setuid/sudoFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsscripts/verify_otel_plugin_e2e.sh:79 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# secret the already-running gateway is using (JWT_SECRET_KEY in its .env),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathsdocker-compose.yml:273 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05- "JWT_SECRET_KEY=${JWT_SECRET_KEY:?JWT_SECRET_KEY is not set. Run: make setup (if .env does not exist) or make init-secrets-patch-env (if .env exists)}"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File permission modification commandscripts/ci/run_upgrade_validation.sh:328 · File permission modification command — agent changes file ownership/permissions
AST05touch "${db_file}" && chmod 666 "${db_file}"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Process kill commandscripts/cleanup-dev.sh:27 · Process kill command — agent can terminate processes
AST05lsof -ti:$PORT | xargs kill -9 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandscripts/tune-loadtest.sh:100 · Privileged sudo command — agent may execute with elevated privileges
AST05echo " sudo sysctl -w net.ipv4.ip_local_port_range='1024 65535'"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commanddocker-compose.yml:2491 · File permission modification command — agent changes file ownership/permissions
AST05chmod 640 /certs/key.pemFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandos_deps.sh:27 · File permission modification command — agent changes file ownership/permissions
AST05$(sudo_if) chmod +x /usr/local/bin/sccFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Credential pass-through configurationdocker-compose.yml:2575 · Credential pass-through configuration — agent relays sensitive credentials
AST02- DANGEROUSLY_OMIT_AUTH=true # Skip proxy token (safe: local dev only)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File permission modification commandscripts/ci/run_upgrade_validation.sh:368 · File permission modification command — agent changes file ownership/permissions
AST05chmod 777 "${db_dir}"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
npx invocation of non-well-known packagemcp-catalog.yml:1960 · npx invocation of non-well-known package — may execute untrusted code
AST06install: "npx @playwright/mcp@latest"Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File permission modification commanddocker-compose.yml:2490 · File permission modification command — agent changes file ownership/permissions
AST05chmod 644 /certs/cert.pemFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Destructive file system command detecteddocker-compose.yml:2452 · Destructive file system command detected
AST05rm -rf /var/lib/apt/lists/*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagemcp-catalog.yml:1923 · npx invocation of non-well-known package — may execute untrusted code
AST06install: "npx -y @azure-devops/mcp"Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Privileged sudo commandscripts/tune-loadtest.sh:98 · Privileged sudo command — agent may execute with elevated privileges
AST05echo " sudo sysctl -w net.core.netdev_max_backlog=65535"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Access to sensitive file pathsscripts/test_sqlite.py:312 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Check .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Process kill commandrun-gunicorn.sh:92 · Process kill command — agent can terminate processes
AST05if kill -0 "${pid}" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Access to sensitive file pathsdocker-compose.yml:293 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05- "DEFAULT_USER_PASSWORD=${DEFAULT_USER_PASSWORD:?DEFAULT_USER_PASSWORD is not set. Run: make setup (if .env does not exist) or make init-secrets-patch-env (if .env exists)}"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandscripts/tune-loadtest.sh:99 · Privileged sudo command — agent may execute with elevated privileges
AST05echo " sudo sysctl -w net.ipv4.tcp_max_syn_backlog=65535"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Access to sensitive file pathsscripts/test_sqlite.py:313 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if os.path.exists(".env"):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathsdocker-compose.yml:286 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05- "AUTH_ENCRYPTION_SECRET=${AUTH_ENCRYPTION_SECRET:?AUTH_ENCRYPTION_SECRET is not set. Run: make setup (if .env does not exist) or make init-secrets-patch-env (if .env exists)}"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File permission modification commandscripts/ci/run_upgrade_validation.sh:582 · File permission modification command — agent changes file ownership/permissions
AST05chmod 777 "${db_dir}"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Python subprocess execution detectedscripts/test_sqlite.py:60 · Python subprocess execution detected
AST05result = subprocess.run(cmd, shell=True, capture_output=capture_output, text=True, timeout=timeout)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandrun-gunicorn.sh:99 · Process kill command — agent can terminate processes
AST05echo " To stop it: kill ${pid}"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
URL with suspicious TLDmcpgateway/db.py:6509 · URL with suspicious TLD — commonly used for phishing/malware
AST07"api_base": "https://us-south.ml.cloud.ibm.com",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
File permission modification commandscripts/ci/run_upgrade_validation.sh:325 · File permission modification command — agent changes file ownership/permissions
AST05chmod 777 "${db_dir}"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Access to sensitive file pathssmoketest.py:835 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05traversal_resource = {"uri": "../../etc/passwd", "name": "Test traversal", "content": "test"}Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedsmoketest.py:427 · Python subprocess execution detected
AST05pid = int(subprocess.check_output(["lsof", "-ti", f"TCP:{PORT_TIME_SERVER}"], text=True).strip())Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsmoketest.py:256 · Python subprocess execution detected
AST05return subprocess.check_output(cmd, text=True).strip().strip('"')Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Access to sensitive file pathsscripts/test_sqlite.py:318 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05print_info("DATABASE_URL configured in .env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathsscripts/test_sqlite.py:314 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05print_status(".env file present")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedsmoketest.py:351 · Python subprocess execution detected
AST05subprocess.run(MAKE_DOCKER_STOP, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandscripts/verify_otel_plugin_e2e.sh:154 · Process kill command — agent can terminate processes
AST05kill "$SERVER_PID" >/dev/null 2>&1 || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Access to sensitive file pathsscripts/test_sqlite.py:315 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05with open(".env", "r") as f:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actionsmoketest.py:1064 · File type combined with upload action — agent may exfiltrate local data files
AST07logging.error(" - Look for translate_*.log files for detailed output")Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.LOW
Authorization escalation languageCHANGELOG.md:2618 · Authorization escalation language · informational: not an instruction file
AST01…ng login provisioning, and restrict local password auth to admins when preserve-admin mode is enabled. * **L-10**: Security architecture docs now align with current token…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Authorization escalation languageCHANGELOG.md:2873 · Authorization escalation language · informational: not an instruction file
AST01* **Non-Admin Login Blocked** ([#2590](https://github.com/IBM/mcp-context-forge/issues/2590)) - Users without admin privileges can now login via UI and APIFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
Python subprocess execution detectedsmoketest.py:139 · Python subprocess execution detected
AST05proc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsmoketest.py:415 · Python subprocess execution detected
AST05uvx_check = subprocess.run(["uvx", "--version"], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.LOW
Context shift attemptDEVELOPING.md:553 · Context shift attempt — trying to change operational mode · informational: not an instruction file
AST01# Enable debug modeFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.Cost to the agent
Instructions loaded
≈2,135 tok
2 files · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for mcp-contextforge-gateway@1.1.0 as of 52 min ago. This is the package itself, not its dependencies.
What would make this Verified
16 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- Unclaimed publisher≈ +8 on the totalClaim ibm: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim ibmPropose a patch to the maintainer