Skills/PyPI/mcp-run-isolated-python

mcp-run-isolated-python@1.1.0

CAUTION· not started

Publisher claims: "A secure and sandboxed python code interpreter for LLMs. Accessable via MCP, or directly in code" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher kigstn · publishing for 282 daysInstalls 437Last detonated 4d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
no credential variables read in the code
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it under the guard. Not started: dependency install failed; the server itself was not observed. The code names no credential variable; the guard pins the network to what the honeypot saw and logs every call.

$vet-skills run --net declared -- uvx mcp_run_isolated_python

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-10 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Credential pass-through configuration; Privileged sudo command; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

MEDIUM
MCP server using network transport (SSE/HTTP)security_audits/2026-09-25_a80b830/coverage-ledger.json:1302 · MCP server using network transport (SSE/HTTP) — data sent over network…leanup/leak unit." ] }, { "coverage_id": "src%2Fmcp_run_isolated_python%2Fmcp_server.py%23Tool%20run_python_code%20%28unauthenticated%20HTTP%2C%20Docker%200.0.0.0%3A6400%29::src%2Fmcp_run_isolated_python%2Fcode_executor.…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)security_audits/2026-09-25_a80b830/coverage-ledger.json:1102 · MCP server using network transport (SSE/HTTP) — data sent over network…this path is unowned." }, { "coverage_id": "src%2Fmcp_run_isolated_python%2Fmcp_server.py%23Tool%20run_python_code%20%28sandboxed%20code%20as%20principal%3B%20Docker%20weaker-nested%20and%20macOS%20Seatbelt%20modes%29::default_srt_settings…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)security_audits/2026-09-25_a80b830/coverage-ledger.json:1001 · MCP server using network transport (SSE/HTTP) — data sent over network…y output instead." ] }, { "coverage_id": "src%2Fmcp_run_isolated_python%2Fmcp_server.py%23Tool%20run_python_code%20%28Docker%20mode%3A%20root%20server%2C%20code%20as%20nonroot%20via%20Popen%20user%3D%29::src%2Fmcp_run_isolated_python%2Fcod…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedsecurity_audits/2026-09-25_a80b830/coverage-ledger.json:1296 · Python subprocess execution detected…99 but gid=0 with supplementary group 0 (root), observed via id in Docker mode. subprocess.Popen(user=...) in code_executor.py:139-150 sets no group=/extra_groups=, so the root …Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionsecurity_audits/2026-09-25_a80b830/coverage-ledger.json:1956 · File type combined with upload action — agent may exfiltrate local data files…tput-file-bound: Independently reproduced (agents/ver-outagg/artifacts/evidence1.txt). code_timeout_seconds=8: 9,598 zero-byte files created; _collect_output_files then ran 9.82 s AFTER the code timeout (tool call wall 21.4 s vs 8 s advert…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Credential pass-through configurationsecurity_audits/2026-09-25_a80b830/coverage-ledger.json:1836 · Credential pass-through configuration — agent relays sensitive credentials…sts and the default srt settings content, which has no secrets. The srt per-run proxy credential is created inside srt and is never logged by this code. The Popen env is only P…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Python subprocess execution detectedsecurity_audits/2026-09-25_a80b830/coverage-ledger.json:1075 · Python subprocess execution detected…at grant access to protected resources", "method": "source", "result": "subprocess.run (code_executor.py:120-127) and Popen (139-150) pass only user=settings.user; no g…Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Privileged sudo commandsetup_host.sh:10 · Privileged sudo command — agent may execute with elevated privilegesecho "kernel.apparmor_restrict_unprivileged_userns = 0" | sudo tee /etc/sysctl.d/99-bwrap.conf >/dev/nullFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandsecurity_audits/2026-09-25_a80b830/coverage-ledger.json:309 · File permission modification command — agent changes file ownership/permissions…invariant": "Root-side cleanup of the sandbox-writable run dir (_remove_run_dir chmod walk, code_executor.py:59-71) must not follow sandbox-planted symlinks into root…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedsecurity_audits/2026-09-25_a80b830/coverage-ledger.json:1099 · Python subprocess execution detected…]." ], "critic_reason": "Popen (code_executor.py:139-150) and the pre-check subprocess.run (120-127) pass only user=settings.user. u20 and u18 both observed uid 999 with gi…Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Destructive file system command detectedDockerfile:52 · Destructive file system command detected&& rm -rf /var/lib/apt/lists/*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssecurity_audits/2026-09-25_a80b830/findings.json:197 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"import os\nos.mkdir('output/'+'\\x1b[1A\\x1b[2KVERLOGESC\\x1b]0;VTITLE\\x07')\nos.symlink('/etc/passwd','output/'+'\\x1bcSYM')\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandsetup_host.sh:11 · Privileged sudo command — agent may execute with elevated privilegessudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsecurity_audits/2026-09-25_a80b830/findings.json:880 · Python subprocess execution detected…, str(path))):\n with contextlib.suppress(OSError):\n subprocess.run(cmd, stdin=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=False)\n if o…Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsecurity_audits/2026-09-25_a80b830/findings.json:934 · Python subprocess execution detected…lled from run_python_code, line 251)", "description": "Caller code runs via subprocess.Popen(srt ...) as the configured user: the invoking user in CLI mode, nonroot in Docke…Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandsecurity_audits/2026-09-25_a80b830/coverage-ledger.json:311 · File permission modification command — agent changes file ownership/permissions…s with followlinks=False and symlinked subdirs are skipped. The is_symlink-then-chmod window has no concurrent sandbox writer in Docker mode: bwrap's pid namespace an…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandsecurity_audits/2026-09-25_a80b830/coverage-ledger.json:579 · Process kill command — agent can terminate processes…d by u14): ensure no sandbox descendant outlives the run on macOS as well (e.g. kill the process group on normal exit too, not only on timeout), so the cleanup windo…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsecurity_audits/2026-09-25_a80b830/coverage-ledger.json:593 · Process kill command — agent can terminate processes"boundary": "src/mcp_run_isolated_python/code_executor.py#_run_sandboxed process-group kill on timeout and normal exit without bwrap pid namespace",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsecurity_audits/2026-09-25_a80b830/coverage-ledger.json:919 · Python subprocess execution detected…99 but gid=0 with supplementary group 0 (root), observed via id in Docker mode. subprocess.Popen(user=...) in code_executor.py:139-150 sets no group=/extra_groups=, so the root …Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandsecurity_audits/2026-09-25_a80b830/coverage-ledger.json:457 · File permission modification command — agent changes file ownership/permissions…solated_python/code_executor.py#_remove_run_dir path-based is_symlink-then-Path.chmod walk and rmtree, raced by a sandbox descendant that outlives the run (no pid nam…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathssecurity_audits/2026-09-25_a80b830/coverage-ledger.json:80 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…n permission, and dummy 'server-only'/'SECRET' fixtures in test_security.py. No .env, *.pem, *.key or credentials files are tracked. .gitignore covers .env, .venv, …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandsecurity_audits/2026-09-25_a80b830/coverage-ledger.json:588 · Process kill command — agent can terminate processes"boundary": "src/mcp_run_isolated_python/code_executor.py#_run_sandboxed process-group kill on timeout and normal exit without bwrap pid namespace",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Script disguised as a text filesecurity_audits/2026-09-25_a80b830/agents/h-macos/artifacts/evidence1.txt contains a shell or batch script# h-macos evidence1: executor-side lifecycle of sandbox descendants (macOS command shape, STUB srt) # Launcher: python3 Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
MCP server using network transport (SSE/HTTP)security_audits/2026-09-25_a80b830/coverage-ledger.json:1202 · MCP server using network transport (SSE/HTTP) — data sent over network…per server start." ] }, { "coverage_id": "src%2Fmcp_run_isolated_python%2Fmcp_server.py%23Tool%20run_python_code%20%28sandboxed%20code%20as%20principal%3B%20Docker%20weaker-nested%20srt%2Bbwrap%20and%20macOS%20Seatbelt%20CLI%20modes%29::sr…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Credential pass-through configurationsecurity_audits/2026-09-25_a80b830/coverage-ledger.json:1173 · Credential pass-through configuration — agent relays sensitive credentials…owedDomains [] in Docker weaker-nested mode, sandboxed code holding the per-run proxy credential (exposed in HTTP_PROXY/ALL_PROXY) must not reach the MCP server port in the con…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
File type combined with upload actionsecurity_audits/2026-09-25_a80b830/coverage-ledger.json:2064 · File type combined with upload action — agent may exfiltrate local data files…tput-file-bound: Independently reproduced (agents/ver-outagg/artifacts/evidence1.txt). code_timeout_seconds=8: 9,598 zero-byte files created; _collect_output_files then ran 9.82 s AFTER the code timeout (tool call wall 21.4 s vs 8 s advert…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)security_audits/2026-09-25_a80b830/coverage-ledger.json:450 · MCP server using network transport (SSE/HTTP) — data sent over network… ], "hardening": [ "The FastMCP stdio transport is unreachable: run_mcp (mcp_server.py:49-56) always passes host/port/path/stateless, and run_stdio_async rejects them with a TypeError. I…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File permission modification commandsecurity_audits/2026-09-25_a80b830/coverage-ledger.json:319 · File permission modification command — agent changes file ownership/permissions…de from trojaning the root server or later runs. Leave these root-owned (drop --chown on the /code copy) and keep only the working directory owned by nonroot.", "N…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Privileged sudo command.github/actions/setup_python_environment/action.yaml:30 · Privileged sudo command — agent may execute with elevated privilegessudo apt-get install ripgrep socat bubblewrapFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsecurity_audits/2026-09-25_a80b830/findings.json:417 · Process kill command — agent can terminate processes…ckends without PID isolation (non-Linux), either refuse to run or supervise and kill the full descendant tree (for example, track the session and the processes of th…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsecurity_audits/2026-09-25_a80b830/findings.json:313 · Process kill command — agent can terminate processes… and whether os.symlink succeeded inside the sandbox. Use only dummy paths, and kill leftover children afterwards.", "deployment": "Owner-observed on a representa…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandsecurity_audits/2026-09-25_a80b830/findings.json:236 · File permission modification command — agent changes file ownership/permissions…, line 66) and then calls path-based `Path.chmod(stat.S_IRWXU)` (line 68). Path.chmod follows symlinks. The run directory is the sandbox's writable cwd (Popen cwd=cod…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandsrc/mcp_run_isolated_python/code_executor.py:161 · Process kill command — agent can terminate processes# own process group, so a timeout can kill the whole sandbox & not just srtFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/unit/code_executor/test_security.py:65 · Python subprocess execution detectedprocesses = subprocess.run(("ps", "-eo", "args"), capture_output=True, text=True, check=True).stdout # ruff: ignore[start-process-with-partial-path]Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)security_audits/2026-09-25_a80b830/findings.json:674 · MCP server using network transport (SSE/HTTP) — data sent over network…default. The repo has no semaphore, per-caller cap, or busy rejection anywhere (mcp_server.py:26-56). A local test used the real run_mcp HTTP server, the real FastMCP dispatch and the real run_python_code. Only the sandbo…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actionsecurity_audits/2026-09-25_a80b830/findings.json:417 · File type combined with upload action — agent may exfiltrate local data files…r=None, working_directory=<empty dir>, path_to_srt_settings=default_srt_settings.json, path_to_python_interpreter=<venv python>)). Case 1 (normal exit): code 'import os\\nif os.fork()==0:\\n os.setsid(); os.execv(\"/bin/sleep\",[\"sleep\",…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedtests/unit/code_executor/test_security.py:58 · Python subprocess execution detectedsubprocess.Popen(["sleep", "{marker}"])Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_run_isolated_python/code_executor.py:82 · Python subprocess execution detectedsubprocess.run(cmd, stdin=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=False) # ruff: ignore[subprocess-without-shell-equals-true]Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_run_isolated_python/code_executor.py:133 · Python subprocess execution detectedp = subprocess.run( # ruff: ignore[subprocess-without-shell-equals-true]Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandsrc/mcp_run_isolated_python/code_executor.py:66 · File permission modification command — agent changes file ownership/permissions# sandbox code owning its dirs (same-uid mode) can chmod them to block removal: unlock them first.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actionsecurity_audits/2026-09-25_a80b830/findings.json:321 · File type combined with upload action — agent may exfiltrate local data files…roduced with a stub srt that has no Seatbelt (agents/h-macos/artifacts/evidence1.txt): normal exit left a survivor, 10.3 s delay, output '', threads 1->3, fds 4->6; a timeout with a setsid child left a survivor; the …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)security_audits/2026-09-25_a80b830/findings.json:902 · MCP server using network transport (SSE/HTTP) — data sent over network"fingerprint": "mcp_server.py:run_mcp/http-transport-no-auth-no-host-origin-guard",Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File permission modification commandsrc/mcp_run_isolated_python/code_executor.py:79 · File permission modification command — agent changes file ownership/permissions# the sandbox controls the tree depth (> PATH_MAX, > fd limit): chmod -R / rm -rf handle bothFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actionsecurity_audits/2026-09-25_a80b830/findings.json:236 · File type combined with upload action — agent may exfiltrate local data files…e cwd (Popen cwd=code_path at line 141; allowWrite ['.'] in default_srt_settings.json line 10). So a sandbox process that is still alive during cleanup can swap a real subdirectory entry for a symlink between the check and the chmod, and t…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedsrc/mcp_run_isolated_python/code_executor.py:152 · Python subprocess execution detectedproc = subprocess.Popen( # ruff: ignore[subprocess-without-shell-equals-true]Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandsecurity_audits/2026-09-25_a80b830/findings.json:235 · File permission modification command — agent changes file ownership/permissions"title": "TOCTOU in _remove_run_dir: a surviving sandbox descendant can make the unsandboxed server chmod any same-uid file or directory outside the run dir to 0700 (macOS CLI/library mode)",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)security_audits/2026-09-25_a80b830/findings.json:905 · MCP server using network transport (SSE/HTTP) — data sent over network… without credentials, and so can any web page via rebinding.", "root_cause": "mcp_server.py:49-56 calls mcp.run_async(transport, stateless, host, port, path, show_banner) without host_origin_protection, allowed_hosts or allowed_origins, an…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actionsecurity_audits/2026-09-25_a80b830/findings.json:94 · File type combined with upload action — agent may exfiltrate local data files…served_result": "Independently reproduced (agents/ver-outagg/artifacts/evidence1.txt). code_timeout_seconds=8: 9,598 zero-byte files created; _collect_output_files then ran 9.82 s AFTER the code timeout (tool call wall 21.4 s vs 8 s advert…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈66 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp_run_isolated_python@1.1.0 as of 4d ago. This is the package itself, not its dependencies.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim kigstn: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Script disguised as a text file≈ +4 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim kigstnPropose a patch to the maintainer