Skills/PyPI/modal-mcp

modal-mcp@0.1.0

CAUTION· not started

Publisher claims: "Local, read-only Modal MCP server" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher php-workx · publishing for 193 daysInstalls 19Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
MODAL_MCP_SIGNING_KEYSMODAL_TOKEN_IDMODAL_TOKEN_ID_FILEMODAL_TOKEN_SECRETMODAL_TOKEN_SECRET_FILEConfiguration, not credentials: MODAL_CONFIG_PATH
Where it talks to
no vendor host named in the codeAlso githubusercontent.com, astral.sh — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names githubusercontent.com, astral.sh as well as its own vendor. The guard injects MODAL_MCP_SIGNING_KEYS, MODAL_TOKEN_ID, MODAL_TOKEN_ID_FILE, MODAL_TOKEN_SECRET, MODAL_TOKEN_SECRET_FILE only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx modal-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-11 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Direct script execution from GitHub raw URL; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessexited 1:
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.2sprocesssecond launch, clock +45 days, CI unset
0.2sprocessexited 1:

Static findings

HIGH
Direct script execution from GitHub raw URLinstall.sh:3 · Direct script execution from GitHub raw URL — unverified code source# Usage: curl -fsSL https://raw.githubusercontent.com/php-workx/modal-mcp/refs/heads/main/install.sh | shFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsinstall.sh:51 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho " modal-mcp setup --yes # Create .env and signing key"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/agent_targets/codex.py:79 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_ENV_FILE_PLACEHOLDER: Final[str] = "/path/to/project/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/agent_targets/claude.py:292 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_ENV_FILE_PLACEHOLDER: Final[str] = "/absolute/path/to/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/agent_targets/claude.py:103 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesmodal-mcp run --env-file /absolute/path/to/.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/agent_targets/codex.py:111 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files#: ``{env_file}`` must be replaced with the *absolute* path to the ``.env``Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/__main__.py:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileshelp="Path to a .env file to load before starting the server.",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/agent_targets/claude.py:268 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file: *Absolute* path to the ``.env`` file.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/__main__.py:64 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"Absolute path to the .env file to write (with --yes) or embed in "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/agent_config.py:118 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file: Absolute path to the ``.env`` file. Required only forFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/config.py:88 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Load a .env file from the process CWD if present. pydantic-settingsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/config.py:92 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file=".env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/agent_targets/codex.py:49 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesargs = ["run", "--env-file", "/absolute/path/to/.env"]Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/agent_targets/contract.py:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesis set to the project directory; the server process finds ``.env`` via cwd.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsinstall.sh:52 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho " modal-mcp doctor --env-file .env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/agent_targets/codex.py:35 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfind the ``.env`` file regardless of the working directory at launch.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/__main__.py:83 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"Replace existing .env and signing key with fresh values. "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/agent_targets/codex.py:232 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file: Absolute path to the ``.env`` file. If ``None``, theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/agent_targets/claude.py:255 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files#: *absolute* path to the ``.env`` file before the snippet is shown or stored.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/__main__.py:36 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"Non-interactive: generate .env and a signing key without prompts. "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/config.py:89 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# silently ignores a missing file, so no .env is not an error. RealFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/agent_config.py:275 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file: *Absolute* path to the ``.env`` file. Embedded in theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/doctor.py:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(environment variables, a ``.env`` file, file-backed token paths, andFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/__main__.py:66 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"Defaults to '.env' in the current directory."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/doctor.py:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files``Settings`` can be validated. Its job is to explain missing ``.env`` files,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Pipe-to-shell patterninstall.sh:3 · Pipe-to-shell pattern — downloads and immediately executes remote code# Usage: curl -fsSL https://raw.githubusercontent.com/php-workx/modal-mcp/refs/heads/main/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file pathssrc/modal_mcp/agent_targets/claude.py:305 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesmodal-mcp run --env-file /absolute/path/to/.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsinstall.sh:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho " modal-mcp run --env-file .env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/doctor.py:326 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesValues discovered in the selected ``.env`` file or file-backed token filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/setup.py:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfile-backed secrets (never in env vars or ``.env`` files).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_doctor.py:92 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/doctor.py:137 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Parse a ``.env`` file into a ``{key: value}`` dict.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Privileged sudo command.github/workflows/ci.yml:58 · Privileged sudo command — agent may execute with elevated privilegessudo apt-get install -y just shellcheckFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/setup.py:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- No Modal credential material is ever written to a ``.env`` fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_setup.py:146 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesf"setup-generated .env must not contain {forbidden_key!r}"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/setup.py:62 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesDEFAULT_ENV_FILE: Path = Path(".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_doctor.py:75 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/setup_files.py:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesThese helpers are used by the local-setup flow to write `.env` files,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Privileged sudo command.github/workflows/ci.yml:33 · Privileged sudo command — agent may execute with elevated privilegesrun: sudo apt-get update && sudo apt-get install -y justFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_setup.py:129 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# .env content: no forbidden tokens, correct entriesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/setup_files.py:248 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- ``.env``Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_setup.py:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn tmp_path / ".env", tmp_path / ".secrets"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/doctor.py:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files``.env`` file.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_config.py:366 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/modal_mcp/adapters/_cli_fallback.py:130 · Python subprocess execution detectedcompleted = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_doctor.py:80 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Remote installer piped to shellinstall.sh:3 · Remote installer piped to shell# Usage: curl -fsSL https://raw.githubusercontent.com/php-workx/modal-mcp/refs/heads/main/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Privileged sudo command.github/workflows/ci.yml:57 · Privileged sudo command — agent may execute with elevated privilegessudo apt-get updateFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_setup.py:192 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filespytest.fail("MODAL_MCP_SIGNING_KEY_FILE not found in .env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_setup.py:180 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filespytest.fail("MODAL_MCP_SIGNING_KEY_FILE not found in .env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/setup_files.py:249 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- ``.env.*``Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/setup_files.py:27 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_DEFAULT_GITIGNORE_ENTRIES: tuple[str, ...] = (".env", ".env.*", ".secrets/")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/setup.py:6 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- A local ``.env`` file that references the key and supplies minimalFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_doctor.py:97 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_config.py:391 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_config.py:339 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_config.py:336 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Settings reads values from a .env file when passed via _env_file."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_doctor.py:87 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detectedDockerfile:14 · Destructive file system command detected&& rm -rf /var/lib/apt/lists/*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/modal_mcp/setup.py:61 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files#: Default .env filename (resolved relative to CWD at call time).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_config.py:166 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Explicitly override any .env file values so the test is hermetic.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandsrc/modal_mcp/setup_files.py:55 · File permission modification command — agent changes file ownership/permissions# Explicit chmod so that a restrictive umask cannot widen the mode later,Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05

Cost to the agent

Instructions loaded
≈43 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for modal-mcp@0.1.0 as of 3d ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Unclaimed publisher≈ +8 on the totalClaim php-workx: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Direct script execution from GitHub raw URL≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Privileged sudo command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim php-workxPropose a patch to the maintainer