Skills/PyPI/things3-mcp-server

things3-mcp-server@2.0.7

CAUTION

Publisher claims: "MCP server for Things 3 with read/write support for tasks, projects, areas and tags." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher rossshannon · joined 0 days agoInstalls 93Last detonated 59 min ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.1sprocessdependency install exit 1

0.1sprocessexec /usr/bin/timeout

0.1sprocessexec .venv/bin/Things3-MCP-server

0.1sprocessexited 127: timeout: failed to run command '.venv/bin/Things3-MCP-server': No such file or directory

0.1sclaimedno tools/list reply (exit 127)

0.1sprocessscript backend runs setup only

Static findings

MEDIUM

Remote installer piped to shellREADME.md:54 · Remote installer piped to shell

AST07

MEDIUM

MCP server using network transport (SSE/HTTP).github/workflows/README.md:9 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

HIGH

Python subprocess execution detectedsrc/things3_mcp/applescript_bridge.py:32 · Python subprocess execution detected

AST05

CRITICAL

Pipe-to-shell patternPKG-INFO:91 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

CRITICAL

Pipe-to-shell patternREADME.md:54 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

MEDIUM

Remote installer piped to shellPKG-INFO:91 · Remote installer piped to shell

AST07