Is ninja-mcp@1.7.1 safe to install?

ninja-mcp@1.7.1

CAUTION

Publisher claims: "Multi-module MCP server: Coder, Researcher, Secretary" Observed in sandbox: calls astral.sh only, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher ninja-mcp-contributors · joined 2 days agoInstalls 2,127Last detonated 2d ago

What would fix this Watch Dispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-01 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Pipe-to-shell pattern; Destructive command against a filesystem root or device; Access to sensitive file paths. Summary: calls astral.sh only, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios

t+CategoryObserved action

0.2snetworkCONNECT https://astral.sh · undeclared

0.2sprocessexec /usr/bin/dirname

0.2sprocessexec /usr/bin/cut

0.2sprocessexec /usr/bin/curl

0.2sprocessexited 22: curl: (22) The requested URL returned error: 403

0.2sprocessscript backend runs setup only

Static findings

CRITICAL

Pipe-to-shell patternscripts/install.sh:69 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST06

CRITICAL

Destructive command against a filesystem root or devicesrc/ninja_agent/runner.py:82 · Destructive command against a filesystem root or deviceFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

HIGH

Access to sensitive file pathsscripts/release.sh:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Privileged sudo commandscripts/packaging/build-deb.sh:185 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

HIGH

Privileged sudo commandscripts/packaging/build-deb.sh:175 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

HIGH

Destructive file system command detectedsrc/ninja_agent/runner.py:82 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

HIGH

Access to sensitive file pathsscripts/release.sh:241 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/smoke_test.sh:99 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/run_server_stdio.sh:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Destructive file system command detectedsrc/ninja_agent/runner.py:83 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

HIGH

Privileged sudo commandscripts/packaging/build-deb.sh:176 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

CRITICAL

Destructive command against a filesystem root or devicesrc/ninja_agent/runner.py:83 · Destructive command against a filesystem root or deviceFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

HIGH

Outbound HTTP to raw IP addressscripts/stdio_proxy.py:25 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

HIGH

Access to sensitive file pathsscripts/release.sh:244 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/release.sh:242 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Destructive file system command detectedscripts/packaging/build-deb.sh:98 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

HIGH

Auto-update or dynamic fetch configurationsrc/ninja_common/config_cli.py:596 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.

AST06

HIGH

Outbound HTTP to raw IP addresssrc/ninja_common/daemon.py:655 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Remote installer piped to shellscripts/install.sh:69 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST07

MEDIUM

Python subprocess execution detectedscripts/e2e_live.py:42 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

HIGH

Access to sensitive file pathssrc/ninja_config/modern_tui.py:1140 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Python subprocess execution detectedscripts/e2e_live.py:37 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

HIGH

Outbound HTTP to raw IP addresssrc/ninja_common/daemon.py:665 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

HIGH

Outbound HTTP to raw IP addresssrc/ninja_common/daemon.py:993 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

File permission modification commandscripts/fix_config.sh:130 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

MEDIUM

Python subprocess execution detectedscripts/e2e_live.py:36 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscripts/e2e_live.py:41 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscripts/e2e_live.py:40 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

HIGH

Outbound HTTP to raw IP addresssrc/ninja_common/daemon.py:30 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

File permission modification commandscripts/install.sh:112 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

MEDIUM

Process kill commandsrc/ninja_coder/driver.py:2247 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/daemon.py:179 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL using raw IP addressscripts/stdio_proxy.py:25 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Python subprocess execution detectedsrc/ninja_agent/runner.py:821 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/driver.py:2958 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/driver.py:1396 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Process kill commandscripts/restart_mcp.sh:97 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/driver.py:2955 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

File permission modification commandscripts/packaging/build-deb.sh:87 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/driver.py:2957 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

File permission modification commandscripts/packaging/build-deb.sh:103 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

MEDIUM

Process kill commandsrc/ninja_coder/driver.py:1579 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Process kill commandscripts/restart_mcp.sh:40 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/worktree.py:281 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/safety.py:55 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_common/config_cli.py:659 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_common/config_cli.py:332 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/worktree.py:660 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/safety.py:150 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_common/config_cli.py:652 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/worktree.py:755 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/safety.py:127 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/safety.py:201 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/safety.py:63 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/worktree.py:636 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/worktree.py:644 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_common/hooks_base.py:82 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL using raw IP addresssrc/ninja_common/daemon.py:993 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Python subprocess execution detectedsrc/ninja_common/daemon.py:405 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_common/daemon.py:419 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL using raw IP addresssrc/ninja_common/daemon.py:655 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Process kill commandsrc/ninja_common/daemon.py:624 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Process kill commandsrc/ninja_common/daemon.py:445 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

URL using raw IP addresssrc/ninja_common/daemon.py:665 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

URL using raw IP addresssrc/ninja_common/daemon.py:30 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Process kill commandsrc/ninja_common/daemon.py:145 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Process kill commandsrc/ninja_common/daemon.py:458 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_common/hooks_base.py:133 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_common/hooks_base.py:156 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_config/modern_tui.py:1357 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_config/credentials.py:227 · Python subprocess execution detectedFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_config/ui/base.py:101 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_config/ui/settings.py:255 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_config/ui/settings.py:248 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_config/modern_tui.py:1449 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%

Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Unclaimed publisher≈ +8 on the totalClaim ninja-mcp-contributors: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.

Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim ninja-mcp-contributors