pitbridge@0.2.2
CAUTION· not startedPublisher claims: "Local-first, guardrailed MCP bridge for NinjaTrader 8, with hard risk limits your AI agent cannot bypass." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry PyPI (MCP server) · listed in the official MCP RegistryPublisher toolstackvault · publishing for 128 daysInstalls 263Last detonated 26 h ago
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
- no credential variables read in the code
- Where it talks to
- pitbridge.com (its own)
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it under the guard. Not started: dependency install failed; the server itself was not observed. The code names no credential variable and talks to pitbridge.com, its own; the guard pins the network to what the honeypot saw and logs every call.
$vet-skills run --net declared -- uvx pitbridge
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 78/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Prompting user to enter sensitive credentials. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run
Static findings
MEDIUM
Process kill commandsrc/pitbridge/runtime.py:81 · Process kill command — agent can terminate processes
AST05kill = KillSwitch(kill_file or default_kill_file())Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pitbridge/config.py:152 · Process kill command — agent can terminate processes
AST05# (kill / schema / permission / guardrails). This is a second, independentFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pitbridge/modes.py:1 · Process kill command — agent can terminate processes
AST05"""Permission modes + arm-live ritual + kill switch state.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandtests/test_account_deny.py:148 · Process kill command — agent can terminate processes
AST05"""kill OFF, mode=live (would be LIVE_NOT_ARMED), valid guardrails -> stillFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pitbridge/cli.py:270 · Process kill command — agent can terminate processes
AST05"""Render a human overview: mode, kill state, link/halt state, open orders."""Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pitbridge/cli.py:467 · Process kill command — agent can terminate processes
AST05" [WARN] kill switch: ENGAGED (all order flow blocked until `pitbridge unkill`)"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pitbridge/guardrails/kill_switch.py:20 · Process kill command — agent can terminate processes
AST05"kill switch engaged: all order flow blocked (unkill is CLI-only)",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pitbridge/mcp_server.py:17 · Process kill command — agent can terminate processes
AST05tool that releases the kill switch, arms live trading, or mutates config /Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pitbridge/pipeline.py:243 · Process kill command — agent can terminate processes
AST05re-runs against a fresh snapshot (kill + sticky-halt + link-down + everyFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pitbridge/guardrails/link_down.py:4 · Process kill command — agent can terminate processes
AST05after the kill switch (before any risk math):Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pitbridge/rest.py:12 · Process kill command — agent can terminate processes
AST05deliberately absent (CLI-only); kill MAY be triggered here.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pitbridge/guardrails/__init__.py:36 · Process kill command — agent can terminate processes
AST05"KILL_SWITCH": "kill switch engaged (file / CLI / REST); release is CLI-only",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pitbridge/cli.py:280 · Process kill command — agent can terminate processes
AST05f" kill : {'ENGAGED' if kill_engaged else 'released'}"]Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pitbridge/mcp_server.py:60 · Process kill command — agent can terminate processes
AST05"release the kill switch, arm live trading, or change any guardrail/config "Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pitbridge/denylist.py:7 · Process kill command — agent can terminate processes
AST05refuse a denied account BEFORE anything else (kill / schema / permission /Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandtests/test_account_deny.py:159 · Process kill command — agent can terminate processes
AST05assert d.kill_switch.engaged is False # kill is OFFFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pitbridge/pipeline.py:323 · Process kill command — agent can terminate processes
AST05# FIX 2: de-risking bypasses the risk guardrails + kill + halt (correct —Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pitbridge/modes.py:87 · Process kill command — agent can terminate processes
AST05"""File-backed kill switch. Presence of the file = engaged, so a humanFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pitbridge/pipeline.py:380 · Process kill command — agent can terminate processes
AST05kill = self.kill_switch.engaged if self.kill_switch is not None else FalseFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
MCP server using network transport (SSE/HTTP)src/pitbridge/rest.py:237 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04mcp_server.streamable_http_app() # lazily builds the session managerFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
Process kill commandsrc/pitbridge/config.py:234 · Process kill command — agent can terminate processes
AST05# Deny prevails over EVERYTHING (kill switch / permission / guardrails): aFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pitbridge/guardrails/engine.py:9 · Process kill command — agent can terminate processes
AST05`pitbridge.guardrails.registry` (kill switch always first). EveryFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pitbridge/guardrails/kill_switch.py:5 · Process kill command — agent can terminate processes
AST05sees the boolean on the account snapshot; reading the kill file is theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pitbridge/guardrails/__init__.py:5 · Process kill command — agent can terminate processes
AST05(12 guardrails, 11 modules — position_caps carries two): kill switch, linkFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pitbridge/cli.py:308 · Process kill command — agent can terminate processes
AST05Reads static config + the kill file locally, and enriches with live link /Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.CRITICAL
Prompting user to enter sensitive credentialssrc/pitbridge/cli.py:547 · Prompting user to enter sensitive credentials — social engineering
AST03Nothing is written for you: paste the token into your config yourself.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Process kill commandsrc/pitbridge/cli.py:311 · Process kill command — agent can terminate processes
AST05kill = KillSwitch(default_kill_file())Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pitbridge/rest.py:351 · Process kill command — agent can terminate processes
AST05# kill MAY be triggered over REST; un-kill is CLI-only and has no route.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandtests/test_account_deny.py:4 · Process kill command — agent can terminate processes
AST05pipeline, before kill / schema / permission / guardrails. A denied account mayFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandtests/test_hardening_risk_gate.py:36 · Process kill command — agent can terminate processes
AST05h.d.kill_switch.engage("kill on")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandtests/test_mcp_server.py:9 · Process kill command — agent can terminate processes
AST05reason_code), NOT a raised exception that would kill the session.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandtests/test_mcp_no_bypass.py:7 · Process kill command — agent can terminate processes
AST05(c) no MCP tool can un-kill or arm live trading;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandtests/test_mcp_no_bypass.py:9 · Process kill command — agent can terminate processes
AST05engaged kill / halt.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandtests/test_hardening_risk_gate.py:4 · Process kill command — agent can terminate processes
AST05kill + halt, but MUST still respect the mode gate: a read_only account (incl.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandtests/test_cli_m3.py:132 · Process kill command — agent can terminate processes
AST05"reason_code": "KILL_SWITCH", "detail": "kill engaged"}Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedtests/test_guardrails.py:467 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandtests/test_rest.py:187 · Process kill command — agent can terminate processes
AST05# there is no un-kill route (CLI-only)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandtests/test_guardrails.py:7 · Process kill command — agent can terminate processes
AST05boundary, block case; precedence (kill switch beats everything) and registryFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandtests/test_hardening_confirm.py:21 · Process kill command — agent can terminate processes
AST05# kill trips while the operator deliberatesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandtests/test_account_deny.py:164 · Process kill command — agent can terminate processes
AST05# and deny also wins when the kill IS engaged (both directions).Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandtests/test_guardrails.py:83 · Process kill command — agent can terminate processes
AST05# -------- kill switchFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandtests/test_hardening_confirm.py:3 · Process kill command — agent can terminate processes
AST05A kill / sticky day-halt / link-down that engages *during* the ≤60 s confirmFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandtests/test_cli_m3.py:76 · Process kill command — agent can terminate processes
AST05assert "ENGAGED" in text # kill state surfacedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandtests/test_hardening_risk_gate.py:33 · Process kill command — agent can terminate processes
AST05# De-risking must still work under a kill for a paper/live account.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandtests/test_mcp_no_bypass.py:125 · Process kill command — agent can terminate processes
AST05# ------------------------------------ (d) mixed sequence under kill / haltFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandtests/test_mcp_no_bypass.py:85 · Process kill command — agent can terminate processes
AST05# kill is engaged: a new order is blocked and there is no tool to lift itFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandtests/test_cli_m3.py:4 · Process kill command — agent can terminate processes
AST05plugin is installed. `status` must render a useful overview from config + killFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandtests/test_guardrails.py:284 · Process kill command — agent can terminate processes
AST05# every other guardrail would also fire; kill switch must winFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandtests/test_mcp_no_bypass.py:89 · Process kill command — agent can terminate processes
AST05# kill remains engaged after the whole session (agent could not release it)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.Cost to the agent
Instructions loaded
≈61 tok
1 file · 74 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for pitbridge@0.2.2 as of 26 h ago. This is the package itself, not its dependencies.
What would make this Verified
2 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Prompting user to enter sensitive credentials≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Unclaimed publisher≈ +8 on the totalClaim toolstackvault: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
- Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim toolstackvaultPropose a patch to the maintainer