Skills/PyPI/mcp-server-synology

mcp-server-synology@1.8.0

VERIFIED· not started

Publisher claims: "MCP server for Synology NAS" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher atom2ueki · publishing for 279 daysInstalls 581Last detonated 5d ago
$claude mcp add mcp-server-synology -- uvx mcp-server-synology
WatchReport an issue

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
SYNOLOGY_PASSWORDXIAOZHI_TOKENConfiguration, not credentials: AUTO_LOGIN, MCP_HTTP, MCP_HTTP_ALLOWED_HOSTS, MCP_HTTP_ALLOWED_ORIGINS, MCP_HTTP_HOST, MCP_HTTP_PATH, MCP_HTTP_PORT, MCP_SERVER_NAME, MCP_SERVER_VERSION, SESSION_TIMEOUT, SYNOLOGY_MCP_ALLOW_UNVERIFIED_WINDOWS_ACL, SYNOLOGY_OTP_CODE, SYNOLOGY_URL, SYNOLOGY_USERNAME, VERIFY_SSL, XIAOZHI_MCP_ENDPOINT
Where it talks to
no vendor host named in the codeAlso nas.example — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names nas.example as well as its own vendor. The guard injects SYNOLOGY_PASSWORD, XIAOZHI_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx mcp-server-synology

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-09 and scored it 82/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

LOW
URL to a private-network addresssrc/mcp_server.py:737 · URL to a private-network address — a LAN or development target- base_url: a full URL like http://10.0.0.51:5000Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Access to sensitive file pathstests/test_config.py:171 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# treats the project as having no .env.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/config.py:64 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Legacy .env support (deprecated - use settings.json instead)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/config.py:108 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# One-shot 2FA code for legacy .env single-NAS users on first login.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_server.py:641 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Legacy single-NAS from .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
URL to a private-network addresstests/test_config.py:161 · URL to a private-network address — a LAN or development targetassert specific["base_url"] == "https://192.168.1.100:5001"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathssrc/config.py:68 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesload_dotenv(".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_server.py:457 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Optional 2FA material from settings.json (or legacy .env forFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
URL to a private-network addresstests/test_config.py:370 · URL to a private-network address — a LAN or development targetassert cfg.nas_configs["nas"]["base_url"] == "https://192.168.1.5:5001"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstests/test_config.py:1048 · URL to a private-network address — a LAN or development target{"nas1": {"base_url": "https://192.168.1.100:5001", "verify_ssl": True}},Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstests/test_auth.py:232 · URL to a private-network address — a LAN or development target"https://192.168.1.100:5001",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathssrc/mcp_server.py:1046 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Fall back to .env if no secrets.jsonFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
URL to a private-network addresstests/test_auth.py:233 · URL to a private-network address — a LAN or development target"https://192.168.1.100:5001/",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Access to sensitive file pathstests/test_config.py:170 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# is in the developer's local .env. Patch os.path.exists so the loaderFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandsrc/config.py:151 · File permission modification command — agent changes file ownership/permissionslogger.warning(f"Recommended: chmod 600 {path}")Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
LOW
URL to a private-network addresstests/test_file_station.py:252 · URL to a private-network address — a LAN or development targetbase_url = "https://192.168.1.100:5001"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathssrc/mcp_server.py:904 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# token back for exactly that call, and a legacy .env setup has noFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
URL to a private-network addresssrc/mcp_server.py:406 · URL to a private-network address — a LAN or development target"base_url": {"type": "string", "description": "Synology NAS base URL (e.g., https://192.168.1.100:5001)"},Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
README links to an external installerREADME.md → https://example.com/file.ziphttps://example.com/file.zipFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstests/test_config.py:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Test that .env values are used as fallback."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/config.py:67 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileselif os.path.exists(".env"):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_server.py:497 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Legacy .env single-NAS mode has no settings.json entry to writeFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
URL to a private-network addresstests/test_config.py:1051 · URL to a private-network address — a LAN or development targetassert cfg.verify_ssl_for("https://192.168.1.100:5001") is TrueFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstests/test_config.py:107 · URL to a private-network address — a LAN or development targetassert cfg.nas_configs["test_nas"]["base_url"] == "http://192.168.1.100:5000"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Access to sensitive file pathstests/test_login_output_redaction.py:70 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslegacy .env setup has no other way to obtain it.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/config.py:74 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Load non-sensitive settings from environment / .env."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_config.py:169 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# load_dotenv(".env") at construction time, which re-injects whateverFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈47 tok
1 file · 50 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp-server-synology@1.8.0 as of 5d ago. This is the package itself, not its dependencies.