pmcp@3.0.3
CAUTION· not startedPublisher claims: "PMCP - Progressive MCP: Minimal context bloat with on-demand tool discovery" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry PyPI (MCP server)Publisher consiliency · publishing for 320 daysInstalls 1,070Last detonated 1 h ago
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
API_TOKENBOOTSTRAP_CLONE_TOKENBOOTSTRAP_HMAC_SECRETGH_TOKENGITHUB_TOKENPMCP_AUTH_MODEPMCP_AUTH_TOKENPMCP_OAUTH_AUDIENCEPMCP_OAUTH_ISSUERPMCP_OAUTH_JWKS_URLVERCEL_AUTOMATION_BYPASS_SECRETWORKER_API_KEYor--src-authfile/--dest-authfile/--oauth-audience/--auth-token/--auth-token-file/--oauth-issuer/--oauth-jwks-url/--init-author-email/--init-author-name/--init-author-urlConfiguration, not credentials: BOOTSTRAP_ADOPTION_MODE, BOOTSTRAP_HMAC_KEY_ID, BOOTSTRAP_INGEST_ENDPOINT, BOOTSTRAP_INSTALL_MODE, BOOTSTRAP_JOB_ID, BOOTSTRAP_PAYLOAD, BOOTSTRAP_PIPELINE_BRANCH, BOOTSTRAP_PIPELINE_ID, BOOTSTRAP_POLICY_MODE, BOOTSTRAP_REPO, BOOTSTRAP_REQUESTED_MODE, BOOTSTRAP_RUN_ID, BOOTSTRAP_SPEC_SOURCE_KIND, BOOTSTRAP_SPEC_SOURCE_VALUE, BOOTSTRAP_TARGET_BRANCH, BOOTSTRAP_TRIGGERED_BY, GITHUB_ACTIONS, GITHUB_OUTPUT, GITHUB_REF_NAME, GITHUB_REF_TYPE, GITHUB_RUN_ATTEMPT, GITHUB_RUN_ID, GITHUB_SHA, GITHUB_WORKSPACE, GOVERNED_PIPELINE_NODE_MODULES, MUT_END, MUT_FILE, MUT_MARKER- Where it talks to
- no vendor host named in the codeAlso example.invalid, ghcr.io, metadata-check.invalid, private.invalid, crates.io, docker.com — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names example.invalid, ghcr.io, metadata-check.invalid, private.invalid, crates.io, docker.com as well as its own vendor. The guard injects API_TOKEN, BOOTSTRAP_CLONE_TOKEN, BOOTSTRAP_HMAC_SECRET, GH_TOKEN, GITHUB_TOKEN, PMCP_AUTH_MODE, PMCP_AUTH_TOKEN, PMCP_OAUTH_AUDIENCE, PMCP_OAUTH_ISSUER, PMCP_OAUTH_JWKS_URL, VERCEL_AUTOMATION_BYPASS_SECRET, WORKER_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.
$vet-skills run --net declared -- uvx pmcp
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-14 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.2sprocessdependency install exit 1 ·
0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run
Static findings
HIGH
Access to sensitive file pathssrc/pmcp/atomic_write.py:36 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05all.** ``<project>/.env.pmcp`` ships with a checkout, so a clone could link itFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/pmcp/env_store.py:208 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"""The root a checkout file named by its path (``<cwd>/.env.pmcp``) is confined to.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/pmcp/cli.py:693 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05description="Set, sync, and check secrets in user/project PMCP .env files.",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/pmcp/types.py:1504 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05api_key_available: bool = False # True if key found in .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
References a credential file in the home directorysrc/pmcp/manifest/manifest.yaml:1113 · References a credential file in the home directory
AST03env_instructions: "Uses active kubeconfig (~/.kube/config or KUBECONFIG env var)"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/pmcp/env_store.py:131 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05return resolve_project_root(project) / ".env.pmcp"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Auto-update or dynamic fetch configurationsrc/pmcp/types.py:176 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06# every npm/npx server silently loses auto-update and version reporting.Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathssrc/pmcp/errors.py:110 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05ErrorCode.E502_API_KEY_MISSING: "Set the required environment variable in .env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Process kill commandpyproject.toml:162 · Process kill command — agent can terminate processes
AST05# LAST RESORT, above the kill on purpose. faulthandler's C watchdog dumpsFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/pmcp/config/loader.py:50 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05behalf -- ``cli.load_startup_env`` reads ``.env`` and ``.env.pmcp`` before argFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/pmcp/manifest/loader.py:1681 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# reads ``.env.pmcp``; ``_check_api_key_available`` reads ``.env``), and thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/pmcp/cli.py:2425 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05operator's behalf (``load_startup_env`` reads ``.env`` and ``.env.pmcp``),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/pmcp/atomic_write.py:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05(``pmcp.env``, ``.env.pmcp``), the trust store, package approvals, the registryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Auto-update or dynamic fetch configurationsrc/pmcp/manifest/version_checker.py:139 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06# removal is fail-closed, so it costs auto-update for an unusual config andFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathssrc/pmcp/remote_auth.py:85 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05``.env.pmcp`` linked out of the checkout contributes nothing, so a file theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Auto-update or dynamic fetch configurationsrc/pmcp/manifest/version_checker.py:118 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06# the default is the entire point. An omission now costs auto-update for oneFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandpyproject.toml:167 · Process kill command — agent can terminate processes
AST05# the kill it only fires when pytest-timeout's handler never got to run --Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.CRITICAL
Reads credential paths from the home directorysrc/pmcp/manifest/npm_resolver.py:99 · Reads credential paths from the home directory
AST03# `npx --name foo probe`). `HOME` relocates `~/.npmrc`, so `HOME=/x` withFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
URL with embedded credentialsscripts/pipeline-bootstrap/run.mjs:297 · URL with embedded credentials — may be phishing or credential leaking
AST07const cloneUrl = `https://x-access-token:${cloneToken}@github.com/${repository_full_name}.git`;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actionscripts/_mutate_workflow.sh:991 · File type combined with upload action — agent may exfiltrate local data files
AST07' ' - run: curl -sd @"$RUNNER_TEMP/published-wheel/report.json" "$UPLOAD_URL"Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Process kill commandpyproject.toml:178 · Process kill command — agent can terminate processes
AST05# 60 s -> async stacks | 700 s -> thread stacks + kill itemFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/pmcp/feedback_egress.py:67 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05_PROJECT_STORE_PATH = ".env.pmcp"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/pmcp/feedback_egress.py:179 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05checkout's plain ``.env``; ``pmcp_introduced_keys`` covers a plant whose storeFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Auto-update or dynamic fetch configurationsrc/pmcp/manifest/version_checker.py:430 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06# auto-update but never mints a wrong identity.Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationsrc/pmcp/client/manager.py:3462 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06remote_config = config.configFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathssrc/pmcp/tools/handlers.py:4890 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# `.env.pmcp` that is a symlink leaving the project (pmcp.atomic_write),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/pmcp/manifest/version_checker.py:1645 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05``docker run --env-file .env <image>`` resolved to ``.env`` and any twoFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/pmcp/env_store.py:159 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05#: ``project`` (``<project>/.env.pmcp``, or a checkout file named by ``path=``)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/pmcp/cli.py:3219 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05before, and the gateway still reads ``.env`` for its own configuration.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Auto-update or dynamic fetch configurationsrc/pmcp/manifest/_npm_resolve.js:18 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06// A refusal costs auto-update coverage for that server; a wrong answer is aFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathssrc/pmcp/env_store.py:243 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05return root / ".env.pmcp", (root, "project")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/pmcp/tools/handlers.py:4810 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# .env, then read back when the subprocess is provisioned. Only theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actionscripts/_mutate_workflow.sh:985 · File type combined with upload action — agent may exfiltrate local data files
AST07' ' - run: curl -sfT "$RUNNER_TEMP/published-wheel/report.json" "$UPLOAD_URL"Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Auto-update or dynamic fetch configurationsrc/pmcp/client/manager.py:3446 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06remote_config = config.configFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathssrc/pmcp/manifest/manifest.yaml:1113 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05env_instructions: "Uses active kubeconfig (~/.kube/config or KUBECONFIG env var)"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/pmcp/cli.py:3214 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"""Load the startup env files, recording what the plain ``.env`` introduced.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/pmcp/env_store.py:273 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05name = "pmcp.env" if scope != "project" else ".env.pmcp"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/pmcp/argument_errors.py:1337 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"""A name read from a file pmcp does not own (``.env``, ``.env.pmcp``,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
References a credential file in the home directorysrc/pmcp/manifest/npm_resolver.py:99 · References a credential file in the home directory
AST03# `npx --name foo probe`). `HOME` relocates `~/.npmrc`, so `HOME=/x` withFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/_npm_resolve.js:154 · npx invocation of non-well-known package — may execute untrusted code
AST06// Walk up from a realpath'd npm/npx entry point to the npm package root, i.e.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionscripts/_mutate_workflow.sh:997 · File type combined with upload action — agent may exfiltrate local data files
AST07' ' - run: wget --post-file="$RUNNER_TEMP/published-wheel/report.json" "$UPLOAD_URL"Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Process kill commandsrc/pmcp/manifest/installer.py:311 · Process kill command — agent can terminate processes
AST05"""Monitor subprocess output as heartbeat, kill on timeout.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pmcp/manifest/installer.py:669 · Process kill command — agent can terminate processes
AST05# The backstop is disarmed only now, after the kill it guardsFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedscripts/check_published_wheel.py:129 · Python subprocess execution detected
AST05subprocess.check_output(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandsrc/pmcp/child_output.py:304 · Process kill command — agent can terminate processes
AST05"""The kill for a child pmcp started with :func:`detached`: it andFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/_npm_resolve.js:270 · npx invocation of non-well-known package — may execute untrusted code
AST06// gateway.update_server probe `npx -y exec@latest --help` for every npx serverFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Python subprocess execution detectedscripts/pytest_temp.py:413 · Python subprocess execution detected
AST05child = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
MCP server using network transport (SSE/HTTP)src/pmcp/cli.py:1242 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04config=RemoteMcpServerConfig(type="streamable-http", url=probe_url),Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/installer.py:96 · npx invocation of non-well-known package — may execute untrusted code
AST06by what an argument looks like. In ``npx -y [email protected] --token abcdef0123456789``Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/_npm_resolve.js:204 · npx invocation of non-well-known package — may execute untrusted code
AST06// Two different npm installations on PATH would mean `npx <pkg>` andFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Python subprocess execution detectedscripts/check_published_wheel.py:113 · Python subprocess execution detected
AST05subprocess.run(command, cwd=work, env=env, check=True, timeout=300)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandsrc/pmcp/env_store.py:1445 · Process kill command — agent can terminate processes
AST05destination. A write that fails partway -- ``ENOSPC``, a quota, a killFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pmcp/client/manager.py:725 · Process kill command — agent can terminate processes
AST05# The one kill rule (round 7, claude N-B): the group is signalledFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File type combined with upload actionsrc/pmcp/argument_errors.py:1338 · File type combined with upload action — agent may exfiltrate local data files
AST07``.mcp.json``, an overlay, a manifest), fit for any output: itself whenFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Process kill commandsrc/pmcp/child_output.py:509 · Process kill command — agent can terminate processes
AST05is tracked by nothing and its kill falls back to the child alone."""Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedscripts/release_artifacts.py:40 · Python subprocess execution detected
AST05subprocess.run(["git", "diff", "--quiet", "HEAD", "--"], cwd=source, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandsrc/pmcp/client/manager.py:669 · Process kill command — agent can terminate processes
AST05kill site shares (Consiliency/pmcp#388 round 7): the leader only whileFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedscripts/ci_environment.py:32 · Python subprocess execution detected
AST05output = subprocess.check_output(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/_npm_resolve.js:4 · npx invocation of non-well-known package — may execute untrusted code
AST06// Name an npm/npx server's package using **npm's own parser**, or refuse.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionscripts/_mutate_workflow.sh:1049 · File type combined with upload action — agent may exfiltrate local data files
AST07' ' - run: curl -sf [email protected] "$UPLOAD_URL"Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedscripts/image_publish.py:538 · Python subprocess execution detected
AST05subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandsrc/pmcp/client/manager.py:743 · Process kill command — agent can terminate processes
AST05os.killpg(pgid, signal.SIGKILL if kill else signal.SIGTERM)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedscripts/image_registry_readback.py:454 · Python subprocess execution detected
AST05output = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/release_artifacts.py:42 · Python subprocess execution detected
AST05subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/verify_release_bundle.py:68 · Python subprocess execution detected
AST05refs = subprocess.check_output(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandsrc/pmcp/client/manager.py:668 · Process kill command — agent can terminate processes
AST05:func:`pmcp.child_output.kill_process_tree_now`, the one kill rule everyFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pmcp/child_output.py:105 · Process kill command — agent can terminate processes
AST05# --- the one kill rule (Consiliency/pmcp#388 rounds 6-7) ----------------------Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
MCP server using network transport (SSE/HTTP)src/pmcp/cli.py:2933 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04config=RemoteMcpServerConfig(type="streamable-http", url=gateway_url),Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
Python subprocess execution detectedsrc/pmcp/child_output.py:1073 · Python subprocess execution detected
AST05process = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/release_artifacts.py:84 · Python subprocess execution detected
AST05sha = subprocess.check_output(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandsrc/pmcp/env_store.py:1470 · File permission modification command — agent changes file ownership/permissions
AST05# user-scope secrets) to 0700. Never chmod a pre-existing directory such asFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/_npm_resolve.js:115 · npx invocation of non-well-known package — may execute untrusted code
AST06// "has a name" check: `npx -y myalias@npm:left-pad` RUNS `left-pad`, but npaFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Python subprocess execution detectedscripts/release_artifacts.py:33 · Python subprocess execution detected
AST05subprocess.run(args, cwd=cwd, env=env, check=True, timeout=300)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/pmcp/child_output.py:1022 · Python subprocess execution detected
AST05process = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/check_security_claims.py:1027 · Python subprocess execution detected
AST05proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/installer.py:313 · npx invocation of non-well-known package — may execute untrusted code
AST06Reads from both stdout and stderr - npx writes progress to stderr,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Python subprocess execution detectedscripts/check_workflows.py:771 · Python subprocess execution detected
AST05return subprocess.run(["git", *args], capture_output=True, text=True, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandscripts/pytest_temp.py:256 · File permission modification command — agent changes file ownership/permissions
AST05raise PermissionError(f"refusing to chmod a symlink: {target}") from excFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
MCP server using network transport (SSE/HTTP)src/pmcp/cli.py:1038 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04config=RemoteMcpServerConfig(type="streamable-http", url=gateway_url),Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
Process kill commandsrc/pmcp/child_output.py:506 · Process kill command — agent can terminate processes
AST05Windows' group kill -- and closing pmcp's handle kills what is left.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedscripts/release_artifacts.py:87 · Python subprocess execution detected
AST05tree = subprocess.check_output(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandsrc/pmcp/manifest/installer.py:655 · Process kill command — agent can terminate processes
AST05# wait is the caller's to have; the kill is not (round 11,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pmcp/manifest/installer.py:40 · Process kill command — agent can terminate processes
AST05# Heartbeat timeout - kill if no output for this longFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedscripts/check_security_claims.py:753 · Python subprocess execution detected
AST05proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/pmcp/child_output.py:1015 · Python subprocess execution detected
AST05"""``subprocess.run(command, capture_output=True, text=True)`` for aFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/image_publish.py:344 · Python subprocess execution detected
AST05return subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandsrc/pmcp/client/manager.py:655 · Process kill command — agent can terminate processes
AST05every kill site, Consiliency/pmcp#388 round 7)."""Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/pmcp/child_output.py:109 · Process kill command — agent can terminate processes
AST05# (:func:`track`). Every kill site goes through :func:`kill_process_tree_now`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedscripts/image_cutover_inventory.py:65 · Python subprocess execution detected
AST05output = subprocess.check_output(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/loader.py:1401 · npx invocation of non-well-known package — may execute untrusted code
AST06"""*args* with the npx package slot pinned to *version*, and the name.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/loader.py:1432 · npx invocation of non-well-known package — may execute untrusted code
AST06"""Is *command* npx spelled BARE -- the launcher the PATH resolves?Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/npm_resolver.py:99 · npx invocation of non-well-known package — may execute untrusted code
AST06# `npx --name foo probe`). `HOME` relocates `~/.npmrc`, so `HOME=/x` withFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandsrc/pmcp/tools/handlers.py:3590 · Process kill command — agent can terminate processes
AST05# the kill (Consiliency/pmcp#324; round 8, codex F003). After theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/version_checker.py:1132 · npx invocation of non-well-known package — may execute untrusted code
AST06``npx --userconfig /tmp/rc probe`` and ``npx --registry http://x probe``Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/tools/handlers.py:3537 · npx invocation of non-well-known package — may execute untrusted code
AST06# never signals the process, so a probe like `npx <pkg> --help` against aFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/loader.py:294 · npx invocation of non-well-known package — may execute untrusted code
AST06# materialised by `load_manifest` into the npx package slot of `args` andFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/npm_resolver.py:48 · npx invocation of non-well-known package — may execute untrusted code
AST06``npx -y <pkg>`` shape and resolve.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/installer.py:730 · npx invocation of non-well-known package — may execute untrusted code
AST06servers whose install command IS the server (e.g. ``npx @brightdata/mcp``):Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/loader.py:161 · npx invocation of non-well-known package — may execute untrusted code
AST06# or version runs. `cache` is NOT here: npx runs a cached package on itsFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/version_checker.py:1120 · npx invocation of non-well-known package — may execute untrusted code
AST06"""Return the raw npm/npx package token from *args*, or ``None``.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandsrc/pmcp/tools/handlers.py:6119 · Process kill command — agent can terminate processes
AST05# after registration) kill the process synchronously; this killFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
MCP server using network transport (SSE/HTTP)src/pmcp/transport/http.py:13 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04{ "mcpServers": { "pmcp": { "type": "http", "url": "http://127.0.0.1:3344/mcp" } } }Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/types.py:176 · npx invocation of non-well-known package — may execute untrusted code
AST06# every npm/npx server silently loses auto-update and version reporting.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandsrc/pmcp/server.py:1146 · Process kill command — agent can terminate processes
AST05# CPython kill a leader alone (Consiliency/pmcp#388 round 14,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/provision_gate.py:25 · npx invocation of non-well-known package — may execute untrusted code
AST06of ``[email protected]`` attached to an argv of ``npx -y pkg`` approves nothing: npxFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/npm_resolver.py:1 · npx invocation of non-well-known package — may execute untrusted code
AST06"""Name an npm/npx server's package via npm's own parser, or refuse.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/npm_resolver.py:151 · npx invocation of non-well-known package — may execute untrusted code
AST06npx -y probe`` fetches ``http://127.0.0.1:9/evil-pkg``.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/validation.py:231 · npx invocation of non-well-known package — may execute untrusted code
AST06# changes WHAT an approved `npx -y name@version` fetches -- the registry it asksFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/provision_gate.py:6 · npx invocation of non-well-known package — may execute untrusted code
AST06`npx -y totally-arbitrary-evil-package`. This gate decides on the package'sFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/tools/handlers.py:5519 · npx invocation of non-well-known package — may execute untrusted code
AST06# connected and running, so a version-only update like `npx pkg@latest`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/loader.py:1282 · npx invocation of non-well-known package — may execute untrusted code
AST06both re-resolve at every ``npx -y`` spawn, which is the drift a pin existsFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/provision_gate.py:190 · npx invocation of non-well-known package — may execute untrusted code
AST06"""Is *executable* npx under any platform spelling (``NPX.CMD``, ``npx.bat``)?Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Python subprocess execution detectedsrc/pmcp/manifest/npm_resolver.py:349 · Python subprocess execution detected
AST05proc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/validation.py:13 · npx invocation of non-well-known package — may execute untrusted code
AST06# ``. _ -``. pypi identifiers are a subset of this. A leading ``-`` (which npxFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/provision_gate.py:5 · npx invocation of non-well-known package — may execute untrusted code
AST06*package* with `npx -y`, so allowlisting `internal-approved-tool` executedFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/manifest.yaml:44 · npx invocation of non-well-known package — may execute untrusted code
AST06- "npx --yes envinfo --version"Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/version_checker.py:65 · npx invocation of non-well-known package — may execute untrusted code
AST06# `npx -y {name}@latest --help` -- and `npx -y` INSTALLS WITHOUT PROMPTINGFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/validation.py:90 · npx invocation of non-well-known package — may execute untrusted code
AST06# escaped `tar\.gz` (npm-package-arg 13.x). pmcp runs whatever npx is on PATH.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File permission modification commandsrc/pmcp/package_approvals.py:314 · File permission modification command — agent changes file ownership/permissions
AST05ignores `mode` for intermediates, and create-then-chmod leaves a window inFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/tools/handlers.py:3269 · npx invocation of non-well-known package — may execute untrusted code
AST06# resolves here before its probe spawns `npx <pkg>`, so without thisFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/tools/handlers.py:3531 · npx invocation of non-well-known package — may execute untrusted code
AST06package code, e.g. ``npx <pkg> --help``, so it must not inherit otherFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/tools/handlers.py:4819 · npx invocation of non-well-known package — may execute untrusted code
AST06# NPM_CONFIG__AUTH, which the pinned `npx -y` spawn would then readFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/npm_resolver.py:97 · npx invocation of non-well-known package — may execute untrusted code
AST06# option -- verified: `env npm_config_package=evil-pkg npx -y probe` fetchesFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/pmcp/manifest/version_checker.py:422 · npx invocation of non-well-known package — may execute untrusted code
AST06# shorthand is not. Collapsing them made `npx --silent true <arg>` reportFix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Instructions loaded
≈51 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for pmcp@3.0.3 as of 52 min ago. This is the package itself, not its dependencies.
What would make this Verified
10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Reads credential paths from the home directory≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Unclaimed publisher≈ +8 on the totalClaim consiliency: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- References a credential file in the home directory≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
- URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim consiliencyPropose a patch to the maintainer