mcp-zuul@0.11.0
VERIFIED· not startedPublisher claims: "MCP server for Zuul CI — build failure analysis, log search, pipeline status, and job configuration" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry PyPI (MCP server)Publisher imatza-rh · publishing for 238 daysInstalls 408Last detonated 4d ago
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
ZUUL_AUTH_TOKENConfiguration, not credentials: LOGJUICER_URL, MCP_HOST, MCP_PORT, MCP_TRANSPORT, ZUUL_DEFAULT_TENANT, ZUUL_DISABLED_TOOLS, ZUUL_ENABLED_TOOLS, ZUUL_READ_ONLY, ZUUL_TIMEOUT, ZUUL_URL, ZUUL_USE_KERBEROS, ZUUL_VERIFY_SSL- Where it talks to
- no vendor host named in the code
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it with a scoped credential, under the guard. It asks for ZUUL_AUTH_TOKEN and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.
$vet-skills run --net declared -- uvx mcp-zuul
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-10 and scored it 80/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run
Static findings
MEDIUM
File type combined with upload actionsrc/mcp_zuul/tools/_builds.py:128 · File type combined with upload action — agent may exfiltrate local data files
AST07base = "Both job-output.json and job-output.txt unavailable."Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Instructs the agent to modify its persistent memory or instruction filesCLAUDE.md:108 · Instructs the agent to modify its persistent memory or instruction files
AST01After release, update tool counts and version in CLAUDE.md if tools were added.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
MCP server using network transport (SSE/HTTP)CLAUDE.md:68 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04- **AppContext**: Injected via MCPServer lifespan, accessed in tools via `app(ctx)` helper. Holds both clients, config, and the auth lock.Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
Destructive file system command detectedDockerfile:7 · Destructive file system command detected
AST05rm -rf /var/lib/apt/lists/*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandsrc/mcp_zuul/config.py:56 · Privileged sudo command — agent may execute with elevated privileges
AST05" Fedora/RHEL: sudo dnf install krb5-devel python3-devel gcc\n"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandsrc/mcp_zuul/config.py:57 · Privileged sudo command — agent may execute with elevated privileges
AST05" Debian/Ubuntu: sudo apt install libkrb5-dev python3-dev gcc"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Destructive file system command detectedDockerfile:20 · Destructive file system command detected
AST05rm -rf /var/lib/apt/lists/* && \Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known package.serena/project.yml:162 · npx invocation of non-well-known package — may execute untrusted code
AST06# example: activation_command: "npx nx run-many -t build"Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
MCP server using network transport (SSE/HTTP)CLAUDE.md:40 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04server.py → MCPServer instance ("zuul-ci"), lifespan (creates httpx clients), _BearerAuthFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
Access to sensitive file pathstests/test_hardening.py:554 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05await stream_log(a, "file:///etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actionsrc/mcp_zuul/tools/_logs.py:407 · File type combined with upload action — agent may exfiltrate local data files
AST07msg += ". fetch-output.log is available — use browse_build_logs(path='fetch-output.log') to check post-run failures"Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Access to sensitive file pathstests/test_tools_logs.py:438 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05await browse_build_logs(mock_ctx, "build-uuid-1", path="../../etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
URL with embedded credentialstests/test_helpers.py:964 · URL with embedded credentials — may be phishing or credential leaking
AST07assert _sanitize_url("https://user:[email protected]/zuul") == (Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstests/test_helpers.py:99 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05safepath("../etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstests/test_files_in_failure.py:220 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"""../../../etc/passwd must not match."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstests/test_tools_logs.py:136 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05await get_build_log(mock_ctx, "build-uuid-1", log_name="../../etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.LOW
Instructs the agent to modify its persistent memory or instruction filesCONTRIBUTING.md:49 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST019. Update the tool count in `README.md`, `CLAUDE.md`, and `tools/__init__.py` docstringFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
File type combined with upload actiontests/test_tools_logs.py:1072 · File type combined with upload action — agent may exfiltrate local data files
AST07'<a href="job-output.txt.gz">job-output.txt.gz</a>'Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Process kill commandtests/test_auth.py:167 · Process kill command — agent can terminate processes
AST05"""JWT crash on the 200 early-return path doesn't kill auth."""Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File type combined with upload actiontests/test_tools_builds.py:1813 · File type combined with upload action — agent may exfiltrate local data files
AST07"""When fetch-output.log exists, diagnose_build includes it in output."""Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Access to sensitive file pathstests/test_hardening.py:893 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05await tail_build_log(mock_ctx, "b1", log_name="%2e%2e/%2e%2e/etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actionsrc/mcp_zuul/tools/_common.py:159 · File type combined with upload action — agent may exfiltrate local data files
AST07for suffix in ("job-output.json.gz", "job-output.json"):Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Access to sensitive file pathstests/test_hardening.py:849 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05await get_build_log(mock_ctx, "b1", log_name="%2e%2e/%2e%2e/etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstests/test_response_sizes.py:293 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05result = json.loads(await tool(mock_ctx, direct_log_url="file:///etc/passwd"))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstests/test_helpers.py:103 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05safepath("org/../etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstests/test_hardening.py:871 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05await browse_build_logs(mock_ctx, "b1", path="%2e%2e/%2e%2e/etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actionsrc/mcp_zuul/tools/_logs.py:402 · File type combined with upload action — agent may exfiltrate local data files
AST07# Check if fetch-output.log exists (post-run log capture output)Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Access to sensitive file pathstests/test_files_in_failure.py:221 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05tasks = [{"msg": "reading ../../../etc/passwd.txt"}]Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstests/test_get_build_log.py:139 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05log_name = "../../etc/passwd"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstests/test_hardening.py:882 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05result = json.loads(await get_build_log(mock_ctx, "b1", log_name="../../etc/passwd"))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actiontests/test_tools_builds.py:1831 · File type combined with upload action — agent may exfiltrate local data files
AST07"""When fetch-output.log returns 404, field is absent from output."""Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiontests/test_get_build_log.py:144 · File type combined with upload action — agent may exfiltrate local data files
AST07assert "job-output.txt" == "job-output.txt" # trivial but documents the contractFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiontests/conftest.py:84 · File type combined with upload action — agent may exfiltrate local data files
AST07"artifacts": [{"name": "job-output.json", "url": f"{log_url}job-output.json"}],Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
URL with embedded credentialstests/test_helpers.py:974 · URL with embedded credentials — may be phishing or credential leaking
AST07assert _sanitize_url("https://user:[email protected]:8443/zuul") == (Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.LOW
Instructs the agent to modify its persistent memory or instruction filesrelease.sh:137 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01echo "Remember to update CLAUDE.md if tool count changed."Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.Cost to the agent
Instructions loaded
≈2,032 tok
2 files · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for mcp-zuul@0.11.0 as of 4d ago. This is the package itself, not its dependencies.