Is mcp-stdio@0.46.0 safe to install?

mcp-stdio@0.46.0

VERIFIED· not started

Publisher claims: "Stdio-to-HTTP gateway — connects MCP clients to remote HTTP MCP servers" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher shigechika · publishing for 230 daysInstalls 1,529Last detonated 3 h ago

$claude mcp add mcp-stdio -- uvx mcp-stdio

Watch Report an issue

Coverage

Not started: dependency install failed; the server itself was not observed.

Tested: the dependency install step · every file read, file written and host contacted by what ran
Not tested: server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: MCP_BEARER_TOKENMCP_OAUTH_CLIENT_IDMCP_OAUTH_REFRESH_LEEWAY or --oauth-refresh-leeway / --oauth-resource / --bearer-token / --oauth-use-id-token / --oauth-timeout / --oauth / --oauth-device / --oauth-scope / --oauth-eager / --no-oauth-reauthConfiguration, not credentials: BROWSER, DISPLAY, WAYLAND_DISPLAY
Where it talks to: no vendor host named in the codeAlso example.org, claude.ai — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names example.org, claude.ai as well as its own vendor. The guard injects MCP_BEARER_TOKEN, MCP_OAUTH_CLIENT_ID, MCP_OAUTH_REFRESH_LEEWAY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx mcp-stdio

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-14 and scored it 81/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.1sprocessdependency install exit 1 ·

0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed

0.1sprocessscript backend runs setup only

0.2sprocessno install scripts to re-run

Static findings

MEDIUM

Process kill commandsrc/mcp_stdio/server.py:3459 · Process kill command — agent can terminate processes"""Terminate the backend child, escalating to kill if needed."""Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

URL with embedded credentialstests/test_oauth.py:113 · URL with embedded credentials — may be phishing or credential leaking("https://user:[email protected]/mcp", "https://api.example.com/mcp"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

File permission modification commandsrc/mcp_stdio/token_store.py:238 · File permission modification command — agent changes file ownership/permissionsNOT chmod the fd or emit the corrupt-store warning — it is a pure probe.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

HIGH

URL with embedded credentialssrc/mcp_stdio/oauth.py:147 · URL with embedded credentials — may be phishing or credential leakingauthorization codes to be POSTed to ``https://user:pass@host/token``.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

File permission modification commandsrc/mcp_stdio/token_store.py:210 · File permission modification command — agent changes file ownership/permissions# the chmod can genuinely fail (a dir owned by anotherFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

HIGH

URL with embedded credentialssrc/mcp_stdio/oauth.py:742 · URL with embedded credentials — may be phishing or credential leaking# operator passed `https://user:pass@host/mcp` against a correct PRMFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

File permission modification commandsrc/mcp_stdio/token_store.py:182 · File permission modification command — agent changes file ownership/permissionsno path-based chmod on a just-created ancestor to be redirected by a symlinkFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

HIGH

URL with embedded credentialssrc/mcp_stdio/oauth.py:146 · URL with embedded credentials — may be phishing or credential leaking``https://user:pass@host/mcp`` server URL would cause credentials andFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

Python subprocess execution detectedsrc/mcp_stdio/server.py:2377 · Python subprocess execution detectedself._proc = subprocess.Popen( # noqa: S603 — operator-supplied argvFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

HIGH

URL with embedded credentialssrc/mcp_stdio/oauth.py:625 · URL with embedded credentials — may be phishing or credential leaking# ``https://user:pass@host/mcp`` would leak credentials into the OIDC GET andFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

URL with embedded credentialstests/test_oauth.py:118 · URL with embedded credentials — may be phishing or credential leaking("https://u:p@host:8443/mcp?a=1", "https://host:8443/mcp?a=1"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

File permission modification commandsrc/mcp_stdio/token_store.py:368 · File permission modification command — agent changes file ownership/permissions# defensive re-chmod of the XDG dir. An older version (or permissiveFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

MEDIUM

Process kill commandsrc/mcp_stdio/token_store.py:626 · Process kill command — agent can terminate processesNote: a HARD kill (SIGKILL / power loss / OOM) between the tempFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

URL with embedded credentialstests/test_cli.py:881 · URL with embedded credentials — may be phishing or credential leaking"https://user:[email protected]/client.json", # userinfoFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

File permission modification commandsrc/mcp_stdio/token_store.py:385 · File permission modification command — agent changes file ownership/permissions# (a path-based chmod would FOLLOW a symlink and 0o600 an attacker /Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

MEDIUM

Process kill commandsrc/mcp_stdio/server.py:7132 · Process kill command — agent can terminate processes# thread, which would kill the stream abruptly — aFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Privileged sudo command.github/workflows/release.yml:138 · Privileged sudo command — agent may execute with elevated privilegessudo mv mcp-publisher /usr/local/bin/Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Process kill commandsrc/mcp_stdio/server.py:1141 · Process kill command — agent can terminate processes# keep a LIVE child's terminate/kill wait off theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

URL with embedded credentialstests/test_oauth.py:917 · URL with embedded credentials — may be phishing or credential leaking"https://user:[email protected]/mcp", "oauth-authorization-server"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

URL with embedded credentialstests/test_oauth.py:219 · URL with embedded credentials — may be phishing or credential leaking_authorization_base_url("https://user:[email protected]:8443/mcp")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

URL with embedded credentialstests/test_token_store.py:1034 · URL with embedded credentials — may be phishing or credential leaking_normalize_key("https://userC:[email protected]/mcp")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

Process kill commandtests_integration/test_stdio_client.py:80 · Process kill command — agent can terminate processesthen terminate, then kill — all bounded", but the wait AFTER `kill()`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

File permission modification commandtests/test_token_store.py:1587 · File permission modification command — agent changes file ownership/permissionsreal_chmod = os.chmodFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

MEDIUM

Process kill commandtests_integration/_stdio_client.py:281 · Process kill command — agent can terminate processes"""Rule 6's relay half: EOF, then terminate, then kill — all bounded.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

File permission modification commandtests/test_token_store.py:1559 · File permission modification command — agent changes file ownership/permissionsreal_chmod = os.chmodFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

MEDIUM

URL with embedded credentialstests/test_redact_url.py:45 · URL with embedded credentials — may be phishing or credential leakingassert redact_url("https://u:pw@[2001:db8::1]/x") == "https://[2001:db8::1]/x"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

Process kill commandtests_integration/conftest.py:560 · Process kill command — agent can terminate processesterminate step gets the generous bound and the kill is the lastFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Access to sensitive file pathstests/test_oauth.py:4638 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"file:///etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Process kill commandtests_integration/test_stdio_client.py:89 · Process kill command — agent can terminate processesDrives `_StubProc` through the full EOF -> terminate -> kill escalationFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Python subprocess execution detectedtests_integration/conftest.py:237 · Python subprocess execution detectedreturn subprocess.Popen( # noqa: S603 — fixed argv, no shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL with embedded credentialstests/test_redact_url.py:8 · URL with embedded credentials — may be phishing or credential leakingredact_url("https://user:[email protected]/mcp") == "https://example.com/mcp"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

URL with embedded credentialstests/test_oauth.py:213 · URL with embedded credentials — may be phishing or credential leaking_authorization_base_url("https://user:[email protected]/v1/mcp")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

Process kill commandtests_integration/conftest.py:559 · Process kill command — agent can terminate processesits `finally`; a kill would orphan them, which is why theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

File permission modification commandtests/test_token_store.py:1569 · File permission modification command — agent changes file ownership/permissionsf"legacy dir was not tightened to 0o700; chmod calls: {chmodded!r}"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

MEDIUM

URL with embedded credentialstests/test_token_store.py:1027 · URL with embedded credentials — may be phishing or credential leakingk1 = _normalize_key("https://userA:[email protected]/mcp")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

File permission modification commandtests/test_token_store.py:1543 · File permission modification command — agent changes file ownership/permissionsdefensive re-chmod of the XDG dir."""Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

MEDIUM

Python subprocess execution detectedtests_integration/conftest.py:597 · Python subprocess execution detectedproc = subprocess.Popen( # noqa: S603 — fixed argv, no shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Process kill commandtests_integration/test_stdio_client.py:52 · Process kill command — agent can terminate processesfull EOF -> terminate -> kill escalation, so all three `wait()` callsFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

URL with embedded credentialstests/test_scrub_secrets.py:8 · URL with embedded credentials — may be phishing or credential leakingout = scrub_secrets("ConnectError to https://user:[email protected]/mcp")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

URL with embedded credentialstests/test_scrub_secrets.py:15 · URL with embedded credentials — may be phishing or credential leakingout = scrub_secrets("401 for url https://tok:pw@host:8443/x?a=b")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

URL with embedded credentialstests/test_server.py:2499 · URL with embedded credentials — may be phishing or credential leakingassert server._redirect_key("http://u:[email protected]:5/cb") is NoneFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

URL with embedded credentialstests/test_scrub_secrets.py:21 · URL with embedded credentials — may be phishing or credential leakingout = scrub_secrets("fail: https://u:p@[::1]:9000/relay")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

URL with embedded credentialstests/test_token_store.py:1028 · URL with embedded credentials — may be phishing or credential leakingk2 = _normalize_key("https://userB:[email protected]/mcp")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

URL with embedded credentialstests/test_server.py:2522 · URL with embedded credentials — may be phishing or credential leaking"https://u:[email protected]/cb", # userinfoFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

File permission modification commandtests/test_token_store.py:899 · File permission modification command — agent changes file ownership/permissionsaltered, so a symlink-swap cannot chmod an attacker-chosen file."""Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

MEDIUM

URL with embedded credentialstests/test_redact_url.py:32 · URL with embedded credentials — may be phishing or credential leakingout = redact_url("https://user:[email protected]:9000/x?token=SECRETTOK")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

Cost to the agent

Instructions loaded

≈8,328 tok

3 files · 71 in bundle

Tool list per prompt

≈0 tok

0 tools · 0 per tool

Handshake

no reply

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp-stdio@0.46.0 as of 2 h ago. This is the package itself, not its dependencies.