Is AnkiMCP Server safe?
- Python shell/command execution
- Python network egress
- Python filesystem read
repo is an AI mcp_server analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators, though 6 risky constructs are reported for review. It can: delegated authentication, filesystem read, filesystem write, mcp tools detected, network egress and shell execution — capabilities are what the code can do, not a verdict on intent. Risk score 0/100 (low).
repo
Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of AnkiMCP Server's authors. Report a false positive.
Behavioral traits
How this component maps to the CSA agentic threat model. Descriptive — it never affects the risk score.
Findings (6)
The component can run operating-system commands or spawn processes.
subprocess.run([opener, str(path)], check=False)
Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.
Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; avoid shell=True.
The component reads files from disk.
data = json.loads(path.read_text(encoding="utf-8"))
source = path.read_text(encoding="utf-8")
merged.update(json.loads(config_path.read_text(encoding="utf-8")))
meta = json.loads(meta_path.read_text(encoding="utf-8"))
raw = self.CREDENTIALS_PATH.read_text(encoding="utf-8")
for line in version_file.read_text().splitlines():
with open(ext_path, "rb") as fh:
cached_version = version_file.read_text().strip() if version_file.exists() else None
cached_version = version_file.read_text().strip() if version_file.exists() else None
_CONTENT = _CONTENT_FILE.read_text(encoding="utf-8")
return resolved.read_bytes(), "file"
fragment = DESCRIPTION.read_text(encoding="utf-8")
template = TEMPLATE.read_text(encoding="utf-8")
Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.
Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.
The component writes or deletes files on disk.
with open(github_output, "a", encoding="utf-8") as handle:
with open(github_output, "a", encoding="utf-8") as handle:
tmp_path.write_text(content, encoding="utf-8")
shutil.copy(pyd_file, simple_path)
shutil.rmtree(old_dir, ignore_errors=True)
shutil.rmtree(old_dir, ignore_errors=True)
shutil.rmtree(sibling, ignore_errors=True)
shutil.rmtree(temp_dir, ignore_errors=True)
shutil.rmtree(temp_dir, ignore_errors=True)
version_file.write_text(expected_version)
shutil.rmtree(cache_dir, ignore_errors=True)
shutil.rmtree(cache_dir, ignore_errors=True)
shutil.rmtree(cache_dir, ignore_errors=True)
Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.
Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.
The component makes outbound network requests.
import urllib.error
import urllib.parse
import urllib.request
f"{REGISTRY_BASE}/servers/{urllib.parse.quote(name, safe='')}"f"/versions/{urllib.parse.quote(version, safe='')}"request = urllib.request.Request(
url, headers={"Accept": "application/json", "User-Agent": USER_AGENT}
)with urllib.request.urlopen(request, timeout=REQUEST_TIMEOUT) as response:
import urllib.request
with urllib.request.urlopen(pypi_url, timeout=30) as response:
urllib.request.urlretrieve(wheel_url, wheel_path, reporthook=download_progress)
import urllib.parse
parsed = urllib.parse.urlparse(url)
import urllib.request
import urllib.error
with urllib.request.urlopen(url, timeout=30) as response:
from urllib.parse import urlparse, urlunparse
import httpx
parsed = urlparse(ws_url)
return urlunparse(parsed._replace(scheme=http_scheme))
async with httpx.AsyncClient(timeout=_HTTP_TIMEOUT) as client:
Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.
Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.
An OAuth 2.0 / OpenID Connect delegated-authentication flow was detected (authorization-code / refresh-token / token-exchange grant, an OIDC authorize/discovery endpoint or id_token, or a delegation library). Tools authenticate with the end user's delegated, scoped credentials rather than a long-lived embedded service credential.
"grant_type": "refresh_token",
Fix: Delegated auth is a lower-blast-radius execution context than an embedded static credential. Confirm the requested scopes are minimal and that tokens are never logged or forwarded off-host.
An MCP tool surface (manifest or tool definitions) was found.
"mcpServers": {mcp = FastMCP(
Why it matters: Just context — review which tools it offers and their permissions.
Fix: Review the declared MCP tools and their permissions.
Check your own component
Run the same evidence-backed scan on any MCP server, agent skill, or package.
Scan your own componentHow we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →