mcp-switchboard-server-harness@0.4.0.dev6
VERIFIED· not startedPublisher claims: "A stdio MCP server exposing filesystem, git and shell tools for coding agents" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry PyPI (MCP server)Publisher akos-papp · publishing for 52 daysInstalls 96Last detonated 5d ago
$claude mcp add mcp-switchboard-server-harness -- uvx mcp-switchboard-server-harness
WatchReport an issueCoverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
- no credential variables read in the code
- Where it talks to
- no vendor host named in the code
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it under the guard. Not started: dependency install failed; the server itself was not observed. The code names no credential variable; the guard pins the network to what the honeypot saw and logs every call.
$vet-skills run --net declared -- uvx mcp-switchboard-server-harness
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-10 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run
Static findings
MEDIUM
Process kill commandsrc/mcp_switchboard_server_harness/server.py:317 · Process kill command — agent can terminate processes
AST05elapsed_s: Optional[float] = Field(default=None, description="Seconds from start to the kill (or exit).")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File type combined with upload actionsrc/mcp_switchboard_server_harness/server.py:1941 · File type combined with upload action — agent may exfiltrate local data files
AST07…t (pytest config or tests/), `go test -json ./...` (go.mod), `npm test` (package.json test script) or `cargo test`. Pass command to run something else (pytest and go test output is still parsed). changed_only=true runs ONLY the tests git s…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedtests/test_extras.py:284 · Python subprocess execution detected
AST05subprocess.run(["git", "init", "-q"], cwd=tmp_path, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_sandbox.py:101 · Python subprocess execution detected
AST05proc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandtests/test_tools.py:371 · Process kill command — agent can terminate processes
AST05# The kill and the wait must happen while the loop runs: reaping theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedtests/test_tools.py:249 · Python subprocess execution detected
AST05subprocess.run(["git", *cmd], cwd=path, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_extras.py:327 · Python subprocess execution detected
AST05subprocess.run(["git", "init", "--bare", str(origin)], check=True, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandsrc/mcp_switchboard_server_harness/server.py:315 · Process kill command — agent can terminate processes
AST05description="True when the command was killed at the applied timeout; stdout/stderr are then everything it produced up to the kill and exit_code is the sentinel 124.",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedtests/test_extras.py:285 · Python subprocess execution detected
AST05subprocess.run(["git", "add", "."], cwd=tmp_path, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandsrc/mcp_switchboard_server_harness/server.py:1016 · Process kill command — agent can terminate processes
AST05# hub deadline can kill a wait, and a 24 h watch costs one subprocess per poll.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedtests/test_mcp_protocol.py:25 · Python subprocess execution detected
AST05proc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandtests/test_watch.py:2 · Process kill command — agent can terminate processes
AST05so no hub per-call deadline can kill a wait.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedtests/test_extras.py:329 · Python subprocess execution detected
AST05subprocess.run(["git", "clone", str(origin), str(work)], check=True, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandsrc/mcp_switchboard_server_harness/server.py:955 · Process kill command — agent can terminate processes
AST05f"too many background processes and watches ({MAX_PROCESSES}); kill one first"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedtests/test_extras.py:160 · Python subprocess execution detected
AST05return subprocess.run(["python", "-c", "import pytest"], capture_output=True).returncode == 0Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandsrc/mcp_switchboard_server_harness/server.py:1094 · Process kill command — agent can terminate processes
AST05…tch and return its id at once — nothing blocks, so no hub per-call deadline can kill a long wait. The shell predicate `until` (via bash -c) is re-run every `poll` se…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.Cost to the agent
Instructions loaded
≈67 tok
1 file · 14 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for mcp-switchboard-server-harness@0.4.0.dev6 as of 5d ago. This is the package itself, not its dependencies.