Skills/PyPI/postgres-mcp-pro

postgres-mcp-pro@0.4.2

CAUTION· not started

Publisher claims: "PostgreSQL Tuning and Analysis Tool" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher johann-schleier-smith-jssmith · publishing for 579 daysInstalls 278Last detonated 19 min ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
ANTHROPIC_API_KEYDATABASE_URLEMAIL_PASSWORDGIGACHAT_ACCESS_TOKENGOOGLE_API_KEYLLM_MAX_TOKENSLLM_MAXTOKENS_MAXLLM_MAXTOKENS_MINOPENAI_API_KEYPG_PASSWORDConfiguration, not credentials: ACCESS_MODE, ACTIVE_LLM_CONNECTION, ANTHROPIC_API_VERSION, ANTHROPIC_BASE_URL, APP_HOST, APP_PORT, APP_TITLE, AUTO_CONNECT_DIALOG, CERT_DEFAULT_TTL_DAYS, CERT_GRACE_DAYS, CERT_PASSPHRASE, CERT_STORE_DIR, CHAT_MAX_TOOL_ITERATIONS, CHAT_TOOL_RESULT_TRUNCATE, CONNECTIONS_ENCRYPTION_KEY, CONNECTIONS_STORE, DB_DOCKER_HOST, DB_POOL_COMMAND_TIMEOUT, DB_POOL_FAMILY, DB_POOL_MAX_SIZE, DB_POOL_MIN_SIZE, DB_POOL_TIMEOUT, DEFAULT_CONNECTION_KEY, EMAIL_ADDRESS, EXPLAIN_ANALYZE, EXPLAIN_FORMAT, GIGACHAT_BASE_URL, GIGACHAT_MODEL_NAME, GOOGLE_BASE_URL, HOST_LOG_FILE
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard. It asks for ANTHROPIC_API_KEY, DATABASE_URL, EMAIL_PASSWORD, GIGACHAT_ACCESS_TOKEN, GOOGLE_API_KEY, LLM_MAX_TOKENS, LLM_MAXTOKENS_MAX, LLM_MAXTOKENS_MIN, OPENAI_API_KEY, PG_PASSWORD and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --net declared -- uvx postgres-mcp-pro

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-14 and scored it 74/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/mcp_server.py:73 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filespython mcp_server.py --transport sse # принудительно SSE (host/port из .env MCP_SERVER_HOST/PORT)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/key_manager.py:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Переопределяется: CERT_STORE_DIR в .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/pg_client.py:37 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# умолчанию через DB_POOL_FAMILY, AF_UNSPEC=0 если .env явноFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/app.py:93 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# и max_tokens (читаются из .env LLM_TEMPERATURE/LLM_MAX_TOKENS наFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/mcp_server.py:42 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# - Транспорт (stdio/sse) по-прежнему выбирается через .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/mcp_server.py:51 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# и абсолютный путь к .env (этап 2, v1.1.0).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/llm_client.py:39 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# - Base URL провайдеров / LLM_HTTP_TIMEOUT / ANTHROPIC_API_VERSION вынесены в .env.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/app.py:85 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# - Лимит итераций tool-calling цикла вынесен в .env CHAT_MAX_TOOL_ITERATIONSFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/llm_connection_store.py:150 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesТакже очищает ACTIVE_LLM_CONNECTION в .env (чтобы не конфликтовать)."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/certificate.py:69 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Константы — настраиваются через .env (см. key_manager.py)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/llm_connection_store.py:131 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files1. Переменная ACTIVE_LLM_CONNECTION (.env) — сопоставление по name.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/app.py:155 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Compute ENV_PATH before load_dotenv so it finds .env regardless of CWDFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/llm_client.py:289 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""FALLBACK-конструктор из плоских переменных .env (старый путь).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/app.py:157 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesENV_PATH = os.path.join(_PROJECT_ROOT, ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/crypto.py:153 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Попытка 2: legacy .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/mcp_server.py:72 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filespython mcp_server.py # транспорт из .env (MCP_TRANSPORT, по умолчанию stdio)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdevenv-all.yaml:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# уже управляется через .env (dotenv.enable = true в devenv.nix),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/key_manager.py:269 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files2. Иначе: миграция из .env (CONNECTIONS_ENCRYPTION_KEY) → cert.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/pg_client.py:57 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# теперь читаются из .env (DB_POOL_MIN_SIZE, DB_POOL_MAX_SIZE,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/pg_client.py:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# в _maybe_replace_localhost() (для URL из .env / connections.json / UI),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/llm_client.py:123 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# подхватить .env независимо от порядка импортов.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/llm_client.py:36 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# - Обратная совместимость: get_llm_client() (старый .env-путь) сохранёнFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/certificate.py:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Вместо голого Fernet-ключа в .env (CONNECTIONS_ENCRYPTION_KEY) мыFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/mcp_server.py:49 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# get_object_details) сохранена по поведению 1:1, включая .env-конфигFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/crypto.py:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# "fernet:" — старый формат, один глобальный ключ из .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)PROJECT_STATUS.md:128 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)версionныеFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/crypto.py:138 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Fallback на legacy .env-ключFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsconfig/prompts.yaml:5 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Приоритет: если в .env задан LLM_SYSTEM_PROMPT (непустая строка) —Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/app.py:77 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# пустом реестре fallback на старый get_llm_client() из плоских .env-переменных.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/crypto.py:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# - Если активного нет и нет .env-ключа → plaintext (с warning).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/key_manager.py:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 2. Есть старый .env (CONNECTIONS_ENCRYPTION_KEY):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/key_manager.py:287 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesЕсли в .env есть CONNECTIONS_ENCRYPTION_KEY, оборачивает его в сертификат.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/key_manager.py:276 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Попытка миграции из .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathspyproject.toml:80 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Конфигурация: YAML-каталоги + .env + шифрование секретовFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/pg_client.py:201 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesf"вместо localhost, либо убедитесь, что DB_POOL_FAMILY=4 в .env "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/crypto.py:27 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 2. С префиксом "fernet:" но без kid → попробовать .env-ключ.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandsrc/postgres_mcp/sql/extension_utils.py:292 · Privileged sudo command — agent may execute with elevated privilegesf"2. Для RHEL/CentOS: sudo yum install postgresql{major_version_str}-hypopg\n"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandsrc/postgres_mcp/sql/extension_utils.py:291 · Privileged sudo command — agent may execute with elevated privilegesf"1. Для Debian/Ubuntu: sudo apt-get install postgresql-{major_version_str}-hypopg\n"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/host-latest-24-06-2025-12-30_.py:529 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn f"Ошибка: отсутствуют параметры SMTP в .env: {', '.join(missing_params)}"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/host-latest.py:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslogger.error("Отсутствуют необходимые параметры PostgreSQL в .env (PG_USER, PG_PASSWORD, PG_HOST, PG_PORT, PG_DATABASE)")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionsrc/postgres_mcp/explain/explain_plan.py:49 · File type combined with upload action — agent may exfiltrate local data filesfrom ..sql import check_postgres_version_requirementFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Privileged sudo commandsrc/postgres_mcp/sql/extension_utils.py:281 · Privileged sudo command — agent may execute with elevated privilegesf"1. Для Debian/Ubuntu: `sudo apt-get install postgresql-{major_version_str}-hypopg`\n"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/autonomous/pg_client.py:259 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# уровне модуля, чтобы гарантированно подхватить .env,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathsdocker-compose.yml:36 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- path: .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Prompt injectionREADME-en.md:594 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileUnrestricted mode aligns with the approach of [Cursor's auto-run mode](https://docs.cursor.com/chat/tools#auto-run), where the AI agent operates with limited human oversight or approvals.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
File type combined with upload actiontests/conftest.py:7 · File type combined with upload action — agent may exfiltrate local data filesfrom postgres_mcp.sql import reset_postgres_version_cacheFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Prompt injectionREADME-en.md:205 · Prompt injection — known jailbreak technique reference · informational: not an instruction file- **Unrestricted Mode**: Allows full read/write access to modify data and schema. It is suitable for development environments.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
MCP server using network transport (SSE/HTTP)src/postgres_mcp/autonomous/mcp_server.py:73 · MCP server using network transport (SSE/HTTP) — data sent over networkpython mcp_server.py --transport sse # принудительно SSE (host/port из .env MCP_SERVER_HOST/PORT)Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathssrc/postgres_mcp/host-latest-24-06-2025-12-30_.py:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Получение параметров логирования и PostgreSQL из .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)CLAUDE.md:24 · MCP server using network transport (SSE/HTTP) — data sent over networkpython -m src.postgres_mcp.autonomous.mcp_server --transport sse # MCP server (SSE)Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathssrc/postgres_mcp/host-latest-24-06-2025-12-30_.py:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslogger.error("Отсутствуют необходимые параметры PostgreSQL в .env (PG_USER, PG_PASSWORD, PG_HOST, PG_PORT, PG_DATABASE)")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/postgres_mcp/host-latest-24-06-2025-12-30_.py:636 · MCP server using network transport (SSE/HTTP) — data sent over networkclient.add_mcp_server(MCPServerConfig(name="postgres-mcp-tools-server", url="http://localhost:5000"))Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathssrc/postgres_mcp/host-latest-24-06-2025-12-30_.py:432 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn f"Ошибка: отсутствуют параметры SMTP в .env: {', '.join(missing_params)}"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Unicode escape sequence detectedsrc/postgres_mcp/autonomous/app.py:818 · Unicode escape sequence detected — may contain obfuscated payloads… { "role": "assistant", "content": f"\u274c \u041e\u0448\u0438\u0431\u043a\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Destructive file system command detectedDockerfile:7 · Destructive file system command detected&& rm -rf /var/lib/apt/lists/*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/host-latest.py:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Загрузим ключи из .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/postgres_mcp/host-latest.py:636 · MCP server using network transport (SSE/HTTP) — data sent over networkclient.add_mcp_server(MCPServerConfig(name="postgres-mcp-tools-server", url="http://localhost:5001"))Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Access to sensitive file pathsdocker-compose.yml:67 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- path: .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandDockerfile:16 · File permission modification command — agent changes file ownership/permissionsRUN chown -R app:app /appFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/host-latest.py:529 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn f"Ошибка: отсутствуют параметры SMTP в .env: {', '.join(missing_params)}"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detectedDockerfile:29 · Destructive file system command detected&& rm -rf /var/lib/apt/lists/*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/host-latest.py:432 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn f"Ошибка: отсутствуют параметры SMTP в .env: {', '.join(missing_params)}"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/postgres_mcp/host-latest.py:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Получение параметров логирования и PostgreSQL из .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandDockerfile:34 · File permission modification command — agent changes file ownership/permissionsRUN chmod +x /app/docker-entrypoint.shFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actionsrc/postgres_mcp/top_queries/top_queries_calc.py:35 · File type combined with upload action — agent may exfiltrate local data filesfrom ..sql.extension_utils import get_postgres_versionFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Privileged sudo commandsrc/postgres_mcp/sql/extension_utils.py:282 · Privileged sudo command — agent may execute with elevated privilegesf"2. Для RHEL/CentOS: `sudo yum install postgresql{major_version_str}-hypopg`\n"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/postgres_mcp/autonomous/mcp_server.py:61 · MCP server using network transport (SSE/HTTP) — data sent over network# позиции sys.argv[2]) — раньше "python mcp_server.py --transport sse"Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathssrc/postgres_mcp/host-latest-24-06-2025-12-30_.py:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Загрузим ключи из .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈1,237 tok
2 files · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Not checked against OSV yet; the weekly check has not reached this version.

What would make this Verified

6 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim johann-schleier-smith-jssmith: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  5. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
  6. Unicode escape sequence detected≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim johann-schleier-smith-jssmithPropose a patch to the maintainer