Skills/PyPI/mcp-win-stdio

mcp-win-stdio@0.5.0

CAUTION· not started

Publisher claims: "Universal Windows-optimized Model Context Protocol (MCP) suite & dynamic on-demand tool gateway for AI IDEs and CLI agents (Gemini, Claude, ChatGPT, Cursor, Windsurf, Kiro, OpenCode)." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher mohan-kumar-indala · publishing for 54 daysInstalls 3,447Last detonated 21 h ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
TWINE_PASSWORDConfiguration, not credentials: DISPLAY, MWS_HUB_CONFIG, USERNAME
Where it talks to
no vendor host named in the codeAlso cloudflare.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names cloudflare.com as well as its own vendor. The guard injects TWINE_PASSWORD only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx mcp-win-stdio

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 72/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Tunneling service URL. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathssrc/mcp_win_stdio/core/discovery.py:90 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…p_win_stdio.ssh.server", "description": "34 tools: multi-host pooling, ~/.ssh/config auto-discovery, interactive PTY shells, background jobs, systemd/docker …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_win_stdio/cli.py:749 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = Path(getattr(args, "env_file", ".env"))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Tunneling service URLsrc/mcp_win_stdio/core/tunnel.py:318 · Tunneling service URL — may route traffic to attacker infrastructurem = re.search(r"https://[a-zA-Z0-9-]+\.trycloudflare\.com", line)Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedscripts/build_all.py:56 · Python subprocess execution detectedres = subprocess.run([sys.executable, "-m", "build", str(pkg)], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathssrc/mcp_win_stdio/core/clients.py:265 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslines.append(f"[mcp_servers.{server_key}.env]")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedsrc/mcp_win_stdio/core/installer.py:204 · Destructive file system command detectedcmd = f'timeout /t 2 /nobreak >nul & if exist "{target_file}" del /f /q "{target_file}"'Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/mcp_win_stdio/core/wizard.py:431 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprint(" [3] System SSH Agent / ~/.ssh/config default")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_win_stdio/cli.py:1244 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"${workspaceFolder}/.env" if is_vscode else str(cwd / ".env"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_win_stdio/cli.py:1200 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"Project MCP commands use the active Python runtime and load an optional root `.env` file. Keep secrets in `.env`, never in committed MCP configuration.",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/core/installer.py:349 · Python subprocess execution detectedres = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_cli.py:285 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfirst = (tmp_path / ".env.example").read_text(encoding="utf-8")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/core/external_updater.py:118 · Python subprocess execution detectedres = subprocess.run([target_python, "-c", script], capture_output=True, text=True, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/core/external_updater.py:202 · Python subprocess execution detectedres = subprocess.run(cmd, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/core/external_updater.py:209 · Python subprocess execution detectedsubprocess.run([mws_bin, "--version"], check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/mcp_win_stdio/core/hub/bridge.py:3 · MCP server using network transport (SSE/HTTP) — data sent over networkConnects FastMCP/MCPServer Streamable HTTP transport with BearerAuthMiddleware,Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/cli.py:509 · Python subprocess execution detectedemail_check = subprocess.run(["git", "config", "user.email"], capture_output=True, text=True).stdout.strip()Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/core/tunnel.py:233 · Python subprocess execution detectedres = subprocess.run(["brew", "install", "cloudflared"], timeout=180.0)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/core/installer.py:316 · Python subprocess execution detectedres = subprocess.run(cmd, capture_output=True, text=True, timeout=10)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/publish_safe.py:199 · Python subprocess execution detectedres = subprocess.run([sys.executable, str(build_script)], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/server/process_pool.py:85 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/core/external_updater.py:230 · Python subprocess execution detectedres = subprocess.run(cmd, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_cli.py:280 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert (tmp_path / ".env.example").exists()Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/cli.py:508 · Python subprocess execution detectedname_check = subprocess.run(["git", "config", "user.name"], capture_output=True, text=True).stdout.strip()Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/publish_safe.py:158 · Python subprocess execution detectedproc = subprocess.run(cmd, env=env, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/cli.py:520 · Python subprocess execution detectedsubprocess.run(["git", "config", "--global", "user.email", u_email])Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_cli.py:278 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"${workspaceFolder}/.env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/publish_safe.py:127 · Python subprocess execution detectedcheck_uv = subprocess.run(["uv", "run", "twine", "--version"], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/core/installer.py:236 · Python subprocess execution detectedres = subprocess.run(cmd, capture_output=True, text=True, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_cli.py:281 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert "DATABASE_URL" in (tmp_path / ".env.example").read_text(encoding="utf-8")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/server/process_pool.py:54 · Python subprocess execution detectedself.proc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/core/tunnel.py:297 · Python subprocess execution detectedself._cf_proc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_cli.py:282 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert ".env" in (tmp_path / ".gitignore").read_text(encoding="utf-8")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/cli.py:519 · Python subprocess execution detectedsubprocess.run(["git", "config", "--global", "user.name", u_name])Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/core/hub/supervisor.py:190 · Python subprocess execution detectedproc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/publish_safe.py:121 · Python subprocess execution detectedcheck = subprocess.run([sys.executable, "-m", "twine", "--version"], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/core/tunnel.py:215 · Python subprocess execution detectedres = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandsrc/mcp_win_stdio/server/process_pool.py:202 · Process kill command — agent can terminate processes# On error or timeout: kill process tree OUTSIDE the lock!Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/core/installer.py:56 · Python subprocess execution detectedcheck = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandsrc/mcp_win_stdio/core/hub/supervisor.py:736 · Process kill command — agent can terminate processeslogger.debug("Error during force kill of %s: %s", clean_name, e)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/cli.py:506 · Python subprocess execution detectedsubprocess.run(["winget", "install", "--id", "Git.Git", "-e"])Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/core/external_updater.py:211 · Python subprocess execution detectedsubprocess.run([target_python, "-m", "mcp_win_stdio", "--version"], check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/core/installer.py:207 · Python subprocess execution detectedsubprocess.Popen(["cmd.exe", "/c", cmd], creationflags=flags, close_fds=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_win_stdio/core/tunnel.py:196 · Python subprocess execution detectedres = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Tunneling service URLtests/test_tunnel.py:62 · Tunneling service URL — may route traffic to attacker infrastructureassert url == "https://mock-live-zen.trycloudflare.com"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Tunneling service URLtests/test_tunnel.py:64 · Tunneling service URL — may route traffic to attacker infrastructureassert client_cfg["mcpServers"]["mws"]["url"] == "https://mock-live-zen.trycloudflare.com/mcp"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Tunneling service URLtests/test_tunnel_auth.py:117 · Tunneling service URL — may route traffic to attacker infrastructureassert cfg["mcpServers"]["mws"]["url"] == "https://example.trycloudflare.com/mcp"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_tunnel_auth.py:138 · MCP server using network transport (SSE/HTTP) — data sent over networkassert cfg["mcpServers"]["mws"]["url"] == "https://unauthenticated.trycloudflare.com/mcp"Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
LOW
Instructs the agent to modify its persistent memory or instruction filessrc/mcp_win_stdio/cli.py:1574 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileWrite or update root .mcp.json and AGENTS.md in target directory with smart client environment variables.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_tunnel.py:38 · MCP server using network transport (SSE/HTTP) — data sent over networkassert cfg["mcpServers"]["mws"]["url"] == "https://mock-tunnel-abc.trycloudflare.com/mcp"Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_tunnel_auth.py:117 · MCP server using network transport (SSE/HTTP) — data sent over networkassert cfg["mcpServers"]["mws"]["url"] == "https://example.trycloudflare.com/mcp"Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Tunneling service URLtests/test_tunnel_auth.py:116 · Tunneling service URL — may route traffic to attacker infrastructurecfg = prov.get_client_config("https://example.trycloudflare.com")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Tunneling service URLtests/test_tunnel.py:38 · Tunneling service URL — may route traffic to attacker infrastructureassert cfg["mcpServers"]["mws"]["url"] == "https://mock-tunnel-abc.trycloudflare.com/mcp"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
Instructs the agent to modify its persistent memory or instruction filessrc/mcp_win_stdio/cli.py:1842 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileupdated_files.append(str(cwd / "AGENTS.md"))Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedtests/test_git.py:121 · Python subprocess execution detectedsubprocess.run(["git", "init", "-b", "main"], cwd=str(repo_dir), check=True, capture_output=True, stdin=subprocess.DEVNULL)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Tunneling service URLtests/test_tunnel.py:34 · Tunneling service URL — may route traffic to attacker infrastructuremgr._public_url = "https://mock-tunnel-abc.trycloudflare.com"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Tunneling service URLtests/test_tunnel.py:54 · Tunneling service URL — may route traffic to attacker infrastructure"INF Your quick Tunnel has been created! Visit it at (https://mock-live-zen.trycloudflare.com)\n",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Tunneling service URLtests/test_tunnel_auth.py:137 · Tunneling service URL — may route traffic to attacker infrastructurecfg = prov.get_client_config("https://unauthenticated.trycloudflare.com")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_hub_cli.py:231 · Python subprocess execution detectedres_status = subprocess.run(cmd_status, capture_output=True, text=True, timeout=5, stdin=subprocess.DEVNULL)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_git.py:123 · Python subprocess execution detectedsubprocess.run(["git", "config", "user.email", "[email protected]"], cwd=str(repo_dir), check=True, capture_output=True, stdin=subprocess.DEVNULL)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_hub_cli.py:32 · Python subprocess execution detectedres = subprocess.run(cmd, capture_output=True, text=True, stdin=subprocess.DEVNULL)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_tunnel.py:64 · MCP server using network transport (SSE/HTTP) — data sent over networkassert client_cfg["mcpServers"]["mws"]["url"] == "https://mock-live-zen.trycloudflare.com/mcp"Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedtests/test_hub_cli.py:239 · Python subprocess execution detectedres_stop = subprocess.run(cmd_stop, capture_output=True, text=True, timeout=10, stdin=subprocess.DEVNULL)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_hub_cli.py:224 · Python subprocess execution detectedres_start = subprocess.run(cmd_start, capture_output=True, text=True, timeout=15, stdin=subprocess.DEVNULL)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Tunneling service URLtests/test_tunnel_auth.py:138 · Tunneling service URL — may route traffic to attacker infrastructureassert cfg["mcpServers"]["mws"]["url"] == "https://unauthenticated.trycloudflare.com/mcp"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_git.py:122 · Python subprocess execution detectedsubprocess.run(["git", "config", "user.name", "Test Runner"], cwd=str(repo_dir), check=True, capture_output=True, stdin=subprocess.DEVNULL)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈821 tok
3 files · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp-win-stdio@0.5.0 as of 20 h ago. This is the package itself, not its dependencies.

What would make this Verified

8 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim mohan-kumar-indala: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Tunneling service URL≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  4. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim mohan-kumar-indalaPropose a patch to the maintainer