Skills/PyPI/redbees-modem-mcp

redbees-modem-mcp@0.4.0

CAUTION· not started

Publisher claims: "MCP server for the Redbees modem (Zephyr RTOS): generation and verification of Lua scripts, device access over SMP (mcumgr), and flashing via esptool." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher dmkuzmin · publishing for 132 daysInstalls 197Last detonated 1 h ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
HF_TOKENRB_AUTH_CLIENTSRB_AUTH_TOKENRB_DOC_TOKEN_BUDGETTOKENIZERS_PARALLELISMConfiguration, not credentials: HF_HUB_DISABLE_SYMLINKS_WARNING, KMP_DUPLICATE_LIB_OK, MKL_THREADING_LAYER, OMP_NUM_THREADS, RB_ADDR2LINE, RB_AUDIT_LOG, RB_EXAMPLES_DIR, RB_FIRMWARE_DIR, RB_FLEET_FILE, RB_FLEET_KEYS, RB_HF_REPO_ID, RB_HOST, RB_JOB_FOREGROUND_WAIT, RB_LOG_DIR, RB_MODEL_DIR, RB_MODEL_NAME, RB_OMP_THREADS, RB_PORT, RB_SERIAL_WRITE_TIMEOUT, RB_SESSION_IDLE_TIMEOUT, RB_SMP_DTLS_PSK_HEX, RB_SMP_DTLS_PSK_ID, RB_SMP_TIMEOUT, RB_TLS_CERT, RB_TLS_KEY, RB_TOOLSET, RB_TRANSPORT, RB_VECTOR_DB_DIR
Where it talks to
no vendor host named in the codeAlso pytorch.org — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names pytorch.org as well as its own vendor. The guard injects HF_TOKEN, RB_AUTH_CLIENTS, RB_AUTH_TOKEN, RB_DOC_TOKEN_BUDGET, TOKENIZERS_PARALLELISM only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx redbees-modem-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-15 and scored it 78/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.2sprocessdependency install exit 1 ·
0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

MEDIUM
Destructive file system command detectedtests/test_device_api.py:53 · Destructive file system command detectedr = d.validate_shell_command("rm -rf /")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_env_priority.py:47 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescheck(f"RB_TRANSPORT={value!r}: .env {'read' if reads else 'skipped'}",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsredbees_modem_mcp/http_auth.py:375 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filestry: # read .env the same way the server does, for RB_AUTH_CLIENTSFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive command against a filesystem root or devicetests/test_device_api.py:53 · Destructive command against a filesystem root or devicer = d.validate_shell_command("rm -rf /")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_fleet.py:269 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"import dotenv; dotenv.load_dotenv = lambda *a, **k: False\n" # ignore the dev .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detectedtests/test_lua_test.py:344 · Destructive file system command detected"the board answers" in report and log.index("RESET", log.index("fs rm /scripts/t.lua")) < len(log) - 1Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/test_fleet.py:279 · Python subprocess execution detectedproc = subprocess.run([sys.executable, "-c", probe], cwd=PROJECT_ROOT, env=env,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Destructive file system command detectedtests/test_lua_test.py:341 · Destructive file system command detected"app_power sleep off" in log and log.index("app_power sleep off") < log.index("fs rm /scripts/t.lua"), str(log))Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedredbees_modem_mcp/esptool_flasher.py:171 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedredbees_modem_mcp/firmware_analysis.py:148 · Python subprocess execution detectedproc = subprocess.run([tool, "-f", "-p", "-C", "-e", elf_path,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Destructive file system command detectedtests/test_lua_test.py:193 · Destructive file system command detectedorder.index("fs rm /scripts/old.lua") < order.index("UPLOAD /scripts/t.lua"), str(order))Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsredbees_modem_mcp/config.py:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesзапускает MCP-хост (блок env в mcp_config.json), и настройки задаёт он. Иначе .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsredbees_modem_mcp/http_auth.py:384 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileshelp="client file (default: RB_AUTH_CLIENTS from the environment / .env)")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/run_all.py:39 · Python subprocess execution detectedproc = subprocess.run([sys.executable, os.path.join(TESTS_DIR, f)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_env_priority.py:68 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprint("SUCCESS: all .env priority tests passed.")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiontests/test_lua_test.py:86 · File type combined with upload action — agent may exfiltrate local data filesself.m.log.append(f"UPLOAD {dst}")Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Access to sensitive file pathstests/test_env_priority.py:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""When the server reads .env: not when an MCP host starts it over stdio, otherwise aFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsredbees_modem_mcp/config.py:25 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesпеременную сбрасывают: для них действует .env. Возвращает, загружен ли .env.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detectedtests/test_firmware_compat.py:288 · Destructive file system command detected"fs rm /config/settings.txt", "fs write /config/settings.txt 00"):Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_env_priority.py:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesrepository .env with RB_TRANSPORT=streamable-http makes it serve HTTP and the host time out.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_env_priority.py:57 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# The launchers must let .env decide, whatever the OS environment holds.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsredbees_modem_mcp/server.py:52 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# applies .env, which takes precedence over inherited variables (see config.load_env).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedredbees_modem_mcp/download_model.py:42 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsredbees_modem_mcp/config.py:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesЧитает .env с приоритетом над окружением, чтобы устаревшие системные переменные неFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsredbees_modem_mcp/fleet.py:625 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filestry: # read .env the same way the server does, for RB_FLEET_FILE / RB_FLEET_KEYSFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedredbees_modem_mcp/lua_syntax_checker.py:182 · Python subprocess execution detectedprocess = subprocess.run([luac_path, '-p', temp_path], capture_output=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Destructive file system command detectedtests/test_manage.py:91 · Destructive file system command detected"shell_rm_confirm": await call("fleet_shell", name="pump-3", command="fs rm /scripts/a.lua", confirm=True),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive file system command detectedtests/test_manage.py:90 · Destructive file system command detected"shell_rm_preview": await call("fleet_shell", name="pump-3", command="fs rm /scripts/a.lua"),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/test_manage.py:253 · Python subprocess execution detectedproc = subprocess.run([sys.executable, "-c", PROBE], cwd=PROJECT_ROOT, env=env,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Destructive file system command detectedtests/test_shell_safety.py:69 · Destructive file system command detected"rm -rf /", "app_modem zzz", "app_future_module do_something",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Destructive file system command detectedtests/test_shell_safety.py:129 · Destructive file system command detectedfor command in ("app_boot factory", "app_modem reset", "fs rm /a"):Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Destructive file system command detectedtests/test_shell_safety.py:155 · Destructive file system command detectedcheck("confirm runs it", client.requests == ["fs rm /scripts/a.lua"], str(client.requests))Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Destructive file system command detectedtests/test_shell_safety.py:154 · Destructive file system command detectedwith_client(client, lambda: s.guarded_shell("fs rm /scripts/a.lua", conn, confirm=True))Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Destructive command against a filesystem root or devicetests/test_shell_safety.py:69 · Destructive command against a filesystem root or device"rm -rf /", "app_modem zzz", "app_future_module do_something",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Destructive file system command detectedtests/test_shell_safety.py:64 · Destructive file system command detected"settings read smp/psk", "settings read ble/passkey", "fs rm /scripts/main.lua", "fs mkdir /x",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈76 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for redbees-modem-mcp@0.4.0 as of 1 h ago. This is the package itself, not its dependencies.

What would make this Verified

2 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim dmkuzmin: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Destructive file system command detected≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Access to sensitive file paths≈ +2 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Destructive command against a filesystem root or device≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim dmkuzminPropose a patch to the maintainer