Is CodeNib MCP server safe?

proc = subprocess.Popen(  # noqa: S602 — loose shell policy by design
            command,
            shell=True,
            cwd=cwd,
            stdin=subprocess.DEVNULL,
            stdout=subprocess.PIPE,
            stderr=subprocess. …

store._store = pickle.load(f)

cache._cache = pickle.load(f)

payload = pickle.load(handle)

self._model = self._model.to(device).eval()

_load_lm(
                model_name,
                dtype=dtype or torch.bfloat16,
                model_class=model_class,
                attn_implementation="eager",
            )
            .to(device)
            .eval()

_load_lm(
                model_name,
                dtype=dtype or torch.bfloat16,
                model_class=model_class,
            )
            .to(device)
            .eval()

process = subprocess.Popen(command, cwd=root, stdout=output, stderr=error)

proc = subprocess.Popen(  # noqa: S603 - fixed interpreter and module
                command,
                stdin=subprocess.PIPE,
                stdout=stdout_file,
                stderr=stderr_file,
                start_new_session= …

proc = subprocess.Popen(  # noqa: S603 - fixed executable and argv
            command,
            cwd=cwd,
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
            bufsize=0,
            start_new_session=True, …

proc = subprocess.Popen(  # noqa: S602 — loose shell policy by design
            command,
            shell=True,
            cwd=cwd,
            stdin=subprocess.DEVNULL,
            stdout=subprocess.PIPE,
            stderr=subprocess. …

result = subprocess.run(
            ["git", "-C", str(repo_path), "config", "--get", "remote.origin.url"],
            check=True,
            capture_output=True,
            text=True,
            timeout=10,
        )

result = subprocess.run(command, check=False, capture_output=True)

result = subprocess.run(
            [
                "git",
                "-c",
                f"safe.directory={repo}",
                "-C",
                str(repo),
                "rev-parse",
                "HEAD", …

process = await asyncio.create_subprocess_exec(
                *request.argv,
                cwd=str(request.cwd),
                env=environment,
                stdin=(
                    asyncio.subprocess.PIPE
                    if …

return subprocess.run(
            ("git", "rev-parse", "HEAD"),
            cwd=workspace,
            capture_output=True,
            text=True,
            check=True,
            timeout=15,
            env={
                "GIT_CONFI …

return subprocess.run(
        ("git", "status", "--porcelain=v1", "-z", "--untracked-files=all"),
        cwd=request.workspace,
        capture_output=True,
        check=True,
        timeout=30,
    ).stdout

result = subprocess.run(
            ("git", *args),
            cwd=cwd,
            capture_output=True,
            text=True,
            check=True,
            timeout=60,
            env={
                "GIT_CONFIG_NOSYSTEM": "1", …

return subprocess.run(
            ["git", "rev-parse", "HEAD"],
            cwd=repo_path,
            capture_output=True,
            text=True,
            check=True,
        ).stdout.strip()

return subprocess.run(
        ("git", *args),
        cwd=workspace,
        capture_output=True,
        text=True,
        check=False,
        timeout=30,
        env=_GIT_ENV,
    )

result = subprocess.run(
        ["git", "-C", str(repo_path), "rev-parse", "HEAD"],
        capture_output=True,
        check=False,
        text=True,
    )

result = subprocess.run(
            ["git", "-C", repo_path, *args],
            capture_output=True,
            text=True,
            timeout=15,
        )

result_git = subprocess.run(
                ["git", "rev-parse", "HEAD"],
                cwd=repo_path,
                capture_output=True,
                text=True,
                check=True,
            )

resolved = subprocess.run(
        ["git", "-C", repo_path, "rev-parse", "--verify", revision],
        check=False,
        capture_output=True,
        env=_zoekt_git_env(),
    )

result = subprocess.run(
        [
            "git",
            "-C",
            repo_path,
            "ls-tree",
            "-rz",
            "--full-tree",
            source_commit,
        ],
        check=False,

result = subprocess.run(
        ["git", "-C", repo_path, "ls-files", "--stage", "-z"],
        check=False,
        capture_output=True,
        env=_zoekt_git_env(),
    )

result = subprocess.run(
        ["git", "-C", repo_path, "ls-files", "--others", "-z"],
        check=False,
        capture_output=True,
        env=_zoekt_git_env(),
    )

process = subprocess.Popen(
            ["git", "-C", repo_path, "cat-file", "--batch"],
            stdin=subprocess.PIPE,
            stdout=subprocess.PIPE,
            stderr=subprocess.DEVNULL,
            bufsize=0,
            env=_z …

subprocess.run(
                            cmd,
                            check=True,
                            capture_output=True,
                            text=True,
                            env=_zoekt_git_env(), …

result = subprocess.run(
                ["git", "rev-parse", "HEAD"],
                cwd=repo_path,
                capture_output=True,
                text=True,
                timeout=5,
            )

subprocess.run(
            [
                "git",
                "-c",
                f"safe.directory={Path(source_repo).expanduser().resolve()}",
                "-C",
                str(source_repo),
                "worktree", …

return subprocess.run(
            ["git", "-c", f"safe.directory={resolved}", "-C", str(repo), *args],
            check=True,
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
            text=True,
        ).stdout. …

return self.authenticated_snapshot(
            relative,
            max_bytes=max_bytes,
        ).read_bytes()

with open("/proc/self/mountinfo", encoding="utf-8") as mountinfo:

return binding.read_bytes(max_bytes=max_bytes)

return binding.read_bytes(max_bytes=max_bytes)

return path.read_text(encoding="utf-8", errors="replace").splitlines()[line]

source_line = source.read_text(
                encoding="utf-8", errors="strict"
            ).splitlines()[int(line)]

with open(cfg) as f:

(self.repo_root / path)
                    .read_text(encoding="utf-8", errors="replace")

raw = source.read_bytes(record.path, max_bytes=10 * 1024 * 1024)

with open(config_file) as f:

skill_doc = skill_md_file.read_text(encoding="utf-8")

with open(file_path, "rb") as fh:

text = file_path.read_text(encoding="utf-8", errors="replace")

with open(file_path, "rb") as fh:

or candidate_metadata.read_bytes() != expected_metadata_bytes

or candidate.read_bytes(
                    CONTEXT_ARTIFACT_MANIFEST,
                    max_bytes=expected_metadata_size,
                )

else reader.read_bytes(path, max_bytes=max_bytes)

payload = reader.read_bytes(
            path,
            max_bytes=MAX_PORTABLE_DOCUMENTS_JSON_BYTES,
        )

reader.read_bytes(relative, max_bytes=max_bytes),

payload = reader.read_bytes(relative, max_bytes=_MAX_CONFIG_JSON_BYTES)

payload = reader.read_bytes(relative, max_bytes=_MAX_CONFIG_JSON_BYTES)

lines = resolved.read_text(encoding="utf-8", errors="replace").splitlines()

digest = hashlib.sha256(resolved.read_bytes()).hexdigest()

json.loads(manifest.read_text(encoding="utf-8"))

return __import__("hashlib").sha256(target.read_bytes()).hexdigest()

os.unlink(relative.name, dir_fd=parent)

target.write_bytes(text.encode("utf-8"))

target.write_bytes(_json_bytes(value))

shutil.copytree(source, destination)

shutil.copy2(source, target)

os.unlink(name, dir_fd=directory_descriptor)

path.write_bytes(_json_bytes(normalized))

config_path.write_bytes(_json_bytes(config))

output.write_bytes(_json_bytes(payload))

config_path.write_bytes(_json_bytes(config))

metadata_path.write_bytes(_json_bytes(metadata))

temporary.write_text(
        json.dumps(value, indent=2, sort_keys=True) + "\n", encoding="utf-8"
    )

temporary.write_text(value, encoding="utf-8")

_write_text(prefix.with_suffix(".txt"), attempt.response)

_write_text(root / "final-report.md", render_markdown(result))

temporary.write_text(
            json.dumps(serialized, indent=2, sort_keys=True) + "\n", encoding="utf-8"
        )

with open(output_path, "w", encoding="utf-8") as f:

with open(output_path, "w", encoding="utf-8") as f:

temporary.write_text(json.dumps(report, indent=2) + "\n", encoding="utf-8")

os.unlink(occurrence_path)

with open(meta_path, "w") as f:

path.write_text(json.dumps(body, indent=2) + "\n", encoding="utf-8")

os.remove(dataset_path)

with open(self.cache_path, "w", encoding="utf-8") as fh:

with open(cache_path, "w", encoding="utf-8") as f:

import{i as s,s as l,a as m}from"./index-CGflccWM.js";const c=m();async function f(n,e){let t="";try{const r=(await n.text()).trim();if(r)try{const i=JSON.parse(r);t=typeof i.detail=="string"?i.detail:r}catch{t=r}}catch{}const o=t.replace(/ …

import requests

with requests.post(
            "https://openrouter.ai/api/v1/chat/completions",
            headers={"Authorization": f"Bearer {key}", "X-OpenRouter-Title": "CodeNib"},
            json={
                "model": config.planner_model, …

import urllib.request

parsed = urllib.parse.urlsplit(value.rstrip("/"))

return urllib.parse.urlunsplit(parsed)

request = urllib.request.Request(url, headers=_request_headers(token))

opener = urllib.request.build_opener(_NoRedirect())

parsed_download = urllib.parse.urlsplit(download_url)

parsed_api = urllib.parse.urlsplit(api_url)

encoded_name = urllib.parse.urlencode(
        {"name": artifact_name, "per_page": 100},
    )

f"{api_url}/repos/{urllib.parse.quote(owner, safe='')}/"

f"{urllib.parse.quote(name, safe='')}/actions/artifacts?{encoded_name}"

request = urllib.request.Request(url, headers=_request_headers(token))

opener = urllib.request.build_opener(_NoRedirect())

parsed = urllib.parse.urlsplit(location)

redirected = urllib.request.Request(
        location,
        headers={"User-Agent": _USER_AGENT},
    )

with urllib.request.urlopen(redirected, timeout=60) as response:

import requests

self._session = requests.Session()

import requests

response = requests.post(
                    "https://openrouter.ai/api/alpha/decisions",
                    headers={
                        "Authorization": f"Bearer {key.strip()}",
                        "X-OpenRouter-Title": "CodeNi …

import requests

with requests.request(
            method,
            f"https://openrouter.ai/api/v1/{path}",
            headers=headers,
            json=payload,
            timeout=(5, 20),
            allow_redirects=False,
            stream=True, …

import urllib.request

with urllib.request.urlopen(url, timeout=1.0) as response:

@mcp.tool(

@mcp.tool(

@mcp.tool(

@mcp.tool(

@mcp.tool(

@mcp.tool(

@mcp.tool(

@mcp.tool(

@mcp.tool(

@mcp.tool(

@mcp.tool(

@mcp.tool(