Skills/PyPI/nucleus-mcp

nucleus-mcp@1.17.3

CAUTION· not started

Publisher claims: "Persistent memory for AI coding agents — one MCP server gives Claude Code, Cursor & Codex a shared .brain (decisions, plans, context) that survives every session" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher eidetic-works · publishing for 322 daysInstalls 678Last detonated 27 h ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
NUCLEUS_DATABASE_URLNUCLEUS_SYNC_TOKEN or --include-secretsConfiguration, not credentials: CC_SESSION_ROLE, CLAUDE_CODE_SESSION_ID, CLAUDE_SESSION_ID, EIDETIC_WATCHERS_CONFIG, FASTMCP_LOG_LEVEL, FASTMCP_SHOW_CLI_BANNER, NUCLEAR_BRAIN_PATH, NUCLEUS_AGENT_ROLES, NUCLEUS_AUTONOMOUS_WAKE_DISABLED, NUCLEUS_BENCH_RUN_ID, NUCLEUS_BRAIN_PATH, NUCLEUS_BRAIN_ROOT, NUCLEUS_DEBUG, NUCLEUS_DEFAULT_RUNNER, NUCLEUS_FLYWHEEL_REPO, NUCLEUS_HOSTED_PROVIDER, NUCLEUS_LOG_JSON, NUCLEUS_PRIVILEGE_WARNING, NUCLEUS_RELAY_BEARER, NUCLEUS_RELAY_RECIPIENT, NUCLEUS_RELAY_URL, NUCLEUS_ROT_CONTROLS_DIR, NUCLEUS_SESSION_ID, NUCLEUS_SESSION_ROLE, NUCLEUS_SYNC_URL, NUCLEUS_TEST, NUCLEUS_TOOL_TIER, NUCLEUS_TRIGGERS_PATH, NUCLEUS_WEDGE_INDEX_CHATTER, NUCLEUS_WEDGE_LEGACY_RECALL, NUCLEUS_WEDGE_RANKER, NUCLEUS_WORKSPACE_ROOT, PYTEST_CURRENT_TEST
Where it talks to
nucleusos.dev (its own)Also claude.ai — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names claude.ai as well as its own vendor. The guard injects NUCLEUS_DATABASE_URL, NUCLEUS_SYNC_TOKEN only into requests to nucleusos.dev (and its subdomains) and refuses the rest.

$vet-skills run --secrets NUCLEUS_DATABASE_URL=nucleusos.dev,NUCLEUS_SYNC_TOKEN=nucleusos.dev -- uvx nucleus-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 72/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Collapsed <details> block carrying instructions; Access to sensitive file paths; Privileged sudo command. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

HIGH
Collapsed <details> block carrying instructionsREADME.md:273 · Collapsed <details> block carrying instructions<summary>Manual config (fallback)</summary> If a client isn't auto-detected, run `nucleus setup --dry-run` to print every location nucleus looks in and the exacFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/runs/workspace.py:232 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/runtime/prove.py:110 · Python subprocess execution detectedout = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandsrc/mcp_server_nucleus/mirror/daemon.py:301 · Process kill command — agent can terminate processesexcept Exception as exc: # noqa: BLE001 — sink errors must not kill usFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/mcp_server_nucleus/mirror/hook.py:80 · MCP server using network transport (SSE/HTTP) — data sent over networkfrom mcp_server_nucleus.runtime.relay_transport import is_http_mode, read_inboxFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
npx invocation of non-well-known packagesrc/mcp_server_nucleus/runtime/prove.py:619 · npx invocation of non-well-known package — may execute untrusted code"coverage (e.g. `npx vitest run --coverage`)",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/flywheel/rot.py:147 · Python subprocess execution detectedr = subprocess.run(["git", "-C", str(self.root), "ls-files"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/flywheel/rot.py:179 · Python subprocess execution detectedreturn subprocess.run(["git", "-C", str(self.root), "cat-file", "-e", f"{sha}^{{commit}}"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathssrc/mcp_server_nucleus/flywheel/rot.py:543 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesPRIVATE_PREFIXES = (".brain/", "~/.claude", "~/Library", "~/.ssh", "~/.cloudflared", "~/.nucleus", ".claude/", "~/career")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/selfhealer.py:168 · Python subprocess execution detectedstatus = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/runs/workspace.py:204 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/runs/service.py:51 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/runs/cli.py:748 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/runs/workspace.py:86 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/runs/service.py:447 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)pyproject.toml:147 · MCP server using network transport (SSE/HTTP) — data sent over networknucleus-mcp-cloud = "mcp_server_nucleus.http_transport.app:serve"Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/runs/cli.py:713 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Privileged sudo commandsrc/mcp_server_nucleus/__init__.py:111 · Privileged sudo command — agent may execute with elevated privilegeslogger_init.warning(" For active defense, install via `sudo scripts/install_nucleus_daemon.sh`")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/runs/targets.py:191 · Python subprocess execution detectedproc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/mcp_server_nucleus/runtime/prove.py:603 · npx invocation of non-well-known package — may execute untrusted codef"`npx vitest run --coverage --coverage.reporter=json` or "Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/flywheel/rot.py:160 · Python subprocess execution detectedr = subprocess.run(["git", "-C", str(self.root), "ls-files"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/runs/targets.py:427 · Python subprocess execution detectedproc = subprocess.run(cmd, capture_output=True, text=True, timeout=300, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/nucleus_wedge/bench_cmd.py:58 · Python subprocess execution detectedproc = subprocess.run(command)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathssrc/mcp_server_nucleus/flywheel/rot.py:568 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_ALWAYS_PRIVATE = ("~/career", "~/.claude", "~/.ssh", "~/Library", "~/.cloudflared", "~/.nucleus")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/runs/workspace.py:239 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandsrc/mcp_server_nucleus/selfhealer.py:329 · File permission modification command — agent changes file ownership/permissionsresult["suggestions"] = ["Run: chmod -R 755 <brain_path>"]Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/runs/cli.py:572 · Python subprocess execution detectedproc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/selfhealer.py:151 · Python subprocess execution detecteddiff = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/selfhealer.py:208 · Python subprocess execution detectedfiles = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/runs/service.py:61 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/selfhealer.py:160 · Python subprocess execution detectedlog = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/mcp_server_nucleus/runtime/prove.py:609 · npx invocation of non-well-known package — may execute untrusted code"function coverage: run `npx vitest run --coverage "Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/selfhealer.py:201 · Python subprocess execution detectedmeta = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/flywheel/core.py:506 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/runs/cli.py:766 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathssrc/mcp_server_nucleus/flywheel/rot.py:376 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files`~/.claude`, `~/Library`, `~/.ssh`, `~/career`, dotfiles, credentials or `.env` files, or any OTHER memory file.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/runs/workspace.py:210 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)pyproject.toml:146 · MCP server using network transport (SSE/HTTP) — data sent over networknucleus-mcp-http = "mcp_server_nucleus.http_transport.server:main"Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedsrc/mcp_server_nucleus/runs/verifiers.py:89 · Python subprocess execution detectedproc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionsrc/nucleus_wedge/memories.py:79 · File type combined with upload action — agent may exfiltrate local data files"""Open ``memories.db`` with the primary-store concurrency posture.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Instructs the agent to modify its persistent memory or instruction filessrc/nucleus_wedge/init_cmd.py:9 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file6. Write ``AGENTS.md`` stub if absent (or with ``--force``).Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedsrc/nucleus_wedge/store.py:306 · Python subprocess execution detectedout = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈77 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for nucleus-mcp@1.17.3 as of 27 h ago. This is the package itself, not its dependencies.

What would make this Verified

8 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim eidetic-works: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim eidetic-worksPropose a patch to the maintainer