Skills/PyPI/mcp-server-for-oscal

mcp-server-for-oscal@0.7.1

CAUTION· not started

Publisher claims: "AI agent tools for Open Security Controls Assessment Language (OSCAL)." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher dfkunstler · publishing for 333 daysInstalls 841Last detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
OSCAL_AGENT_MAX_TOKENS or --max-tokensConfiguration, not credentials: AWS_PROFILE, AWS_REGION, BEDROCK_MODEL_ID, OSCAL_AGENT_CONVERSATION_MANAGER, OSCAL_AGENT_MAX_RETRY_ATTEMPTS, OSCAL_AGENT_RETRY_INITIAL_DELAY, OSCAL_AGENT_RETRY_MAX_DELAY, OSCAL_AGENT_SESSION_DIR, OSCAL_AGENT_SESSION_S3_BUCKET, OSCAL_AGENT_SESSION_S3_PREFIX, OSCAL_AGENT_SESSION_STORAGE, OSCAL_ALLOW_REMOTE_URIS, OSCAL_COMPONENT_DEFINITIONS_DIR, OSCAL_DOCUMENTS_DIR, OSCAL_KB_ID, OSCAL_MAX_URI_DEPTH, OSCAL_MCP_HOST, OSCAL_MCP_SERVER_NAME, OSCAL_MCP_STATELESS_HTTP, OSCAL_MCP_TRANSPORT, OSCAL_REQUEST_TIMEOUT, OSCAL_STORE_CACHE_SIZE, OSCAL_STORE_DB_PATH, ZIP_FILE_TEMP_PATH
Where it talks to
no vendor host named in the codeAlso nist.gov — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names nist.gov as well as its own vendor. The guard injects OSCAL_AGENT_MAX_TOKENS only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx mcp-server-for-oscal

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-09 and scored it 77/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; URL with embedded credentials. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

MEDIUM
Python subprocess execution detectedbin/build_mcpb.py:72 · Python subprocess execution detectedsubprocess.run(cmd, cwd=cwd, check=True) # nosec B603Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagebin/build_mcpb.py:83 · npx invocation of non-well-known package — may execute untrusted codeif not npx or not uv:Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedbin/update_hashes.py:87 · Python subprocess execution detectedcommit = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionsrc/mcp_server_for_oscal/oscal_schemas/oscal_catalog_schema.json:1 · File type combined with upload action — agent may exfiltrate local data files…raft-07/schema#","$id":"http://csrc.nist.gov/ns/oscal/1.2.3/oscal-catalog-schema.json","$comment":"OSCAL Control Catalog Model: JSON Schema","type":"object","definitions":{"json-schema-directive":{"title":"Schema Directive","description":"…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/mcp_server_for_oscal/oscal_schemas/oscal_mapping_schema.json:1 · File type combined with upload action — agent may exfiltrate local data files…raft-07/schema#","$id":"http://csrc.nist.gov/ns/oscal/1.2.3/oscal-mapping-schema.json","$comment":"OSCAL Control Mapping Model: JSON Schema","type":"object","definitions":{"json-schema-directive":{"title":"Schema Directive","description":"…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/mcp_server_for_oscal/oscal_schemas/oscal_assessment-plan_schema.json:1 · File type combined with upload action — agent may exfiltrate local data files…org/draft-07/schema#","$id":"http://csrc.nist.gov/ns/oscal/1.2.3/oscal-ap-schema.json","$comment":"OSCAL Assessment Plan Model: JSON Schema","type":"object","definitions":{"json-schema-directive":{"title":"Schema Directive","description":"…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)pyproject.toml:235 · MCP server using network transport (SSE/HTTP) — data sent over network"python -m mcp_server_for_oscal.main --transport streamable-http",Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actionsrc/mcp_server_for_oscal/oscal_schemas/oscal_component_schema.json:1 · File type combined with upload action — agent may exfiltrate local data files…a#","$id":"http://csrc.nist.gov/ns/oscal/1.2.3/oscal-component-definition-schema.json","$comment":"OSCAL Component Definition Model: JSON Schema","type":"object","definitions":{"json-schema-directive":{"title":"Schema Directive","descripti…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedsrc/mcp_server_for_oscal/tools/validate_oscal_content.py:250 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionsrc/mcp_server_for_oscal/oscal_schemas/oscal_assessment-results_schema.json:1 · File type combined with upload action — agent may exfiltrate local data files…org/draft-07/schema#","$id":"http://csrc.nist.gov/ns/oscal/1.2.3/oscal-ar-schema.json","$comment":"OSCAL Assessment Results Model: JSON Schema","type":"object","definitions":{"json-schema-directive":{"title":"Schema Directive","description…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsAGENTS.md:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files| `src/mcp_server_for_oscal/config.py` | `Config` singleton `config`, read from env and `.env` at import | |Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedbin/eval_tool_selection_kiro.py:52 · Python subprocess execution detectedproc = subprocess.run( # nosec B603 B607 - fixed argv, no shellFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
HIGH
Access to sensitive file pathssrc/mcp_server_for_oscal/main.py:68 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesReads os.environ (which includes .env values loaded by Config) rather thanFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagepyproject.toml:263 · npx invocation of non-well-known package — may execute untrusted code# Run `hatch build` first. Requires uv and npx (Node.js).Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/build_mcpb.py:81 · npx invocation of non-well-known package — may execute untrusted codenpx = shutil.which("npx")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionbin/update_oscal_metaschema.py:298 · File type combined with upload action — agent may exfiltrate local data filesprint("Run `hatch run rehash` to regenerate the bundle hashes.json files.") # noqa: T201 - CLI outputFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/mcp_server_for_oscal/oscal_schemas/oscal_profile_schema.json:1 · File type combined with upload action — agent may exfiltrate local data files…raft-07/schema#","$id":"http://csrc.nist.gov/ns/oscal/1.2.3/oscal-profile-schema.json","$comment":"OSCAL Profile Model: JSON Schema","type":"object","definitions":{"json-schema-directive":{"title":"Schema Directive","description":"A JSON S…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/mcp_server_for_oscal/oscal_schemas/oscal_poam_schema.json:1 · File type combined with upload action — agent may exfiltrate local data files…g/draft-07/schema#","$id":"http://csrc.nist.gov/ns/oscal/1.2.3/oscal-poam-schema.json","$comment":"OSCAL Plan of Action and Milestones (POA&M) Model: JSON Schema","type":"object","definitions":{"json-schema-directive":{"title":"Schema Dire…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
URL with embedded credentialssrc/mcp_server_for_oscal/oscal_metaschema/oscal_assessment-common_metaschema.xml:1454 · URL with embedded credentials — may be phishing or credential leaking<allowed-values id="oscal-facet-fedramp-values" target="(.)[@system=('http://fedramp.gov','http://fedramp.gov/ns/oscal')]/@name">Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
File type combined with upload actionsrc/mcp_server_for_oscal/oscal_schemas/oscal_complete_schema.json:1 · File type combined with upload action — agent may exfiltrate local data files…07/schema#","$id":"http://csrc.nist.gov/ns/oscal/1.0/1.2.3/oscal-complete-schema.json","$comment":"OSCAL Unified Model of Models: JSON Schema","type":"object","definitions":{"json-schema-directive":{"title":"Schema Directive","description"…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/mcp_server_for_oscal/oscal_schemas/oscal_ssp_schema.json:1 · File type combined with upload action — agent may exfiltrate local data files…rg/draft-07/schema#","$id":"http://csrc.nist.gov/ns/oscal/1.2.3/oscal-ssp-schema.json","$comment":"OSCAL System Security Plan (SSP) Model: JSON Schema","type":"object","definitions":{"json-schema-directive":{"title":"Schema Directive","des…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈4,284 tok
2 files · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp-server-for-oscal@0.7.1 as of 5d ago. This is the package itself, not its dependencies.

What would make this Verified

3 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim dfkunstler: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  5. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim dfkunstlerPropose a patch to the maintainer