SkillTotal

Is Keboola MCP server safe?

x is an AI python_package analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators, though 3 risky constructs are reported for review. It can: filesystem read, filesystem write and network egress — capabilities are what the code can do, not a verdict on intent. Risk score 0/100 (low).

x 1.72.4

python_package · pypi:keboola-mcp-server
LOW
0
/ 100 malicious-risk
Snapshot · scanned Jun 23, 2026 · x@1.72.4 · engine 0.18.0 / ruleset 19
No malicious indicators - review capabilities before installing
Notable — review in context (capabilities are not malware):
  • Python network egress
  • Python filesystem write/delete
  • Python filesystem read

No malicious indicators found by static analysis.

Capabilities — what this component can do (not a risk score):
filesystem readfilesystem writenetwork egress

Findings (3)

MEDIUMPython filesystem readST-FS-PY-READ

The component reads files from disk.

return resources.files(__package__).joinpath(name).read_text(encoding='utf-8')
_QUERY_SERVICE_QUERY_DATA_FUNCTION_CODE = _DATA_APP_RESOURCES.joinpath('qsapi_query_data_code.py').read_text(
    encoding='utf-8'
)
_STORAGE_QUERY_DATA_FUNCTION_CODE = _DATA_APP_RESOURCES.joinpath('sapi_query_data_code.py').read_text(encoding='utf-8')

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

MEDIUMPython filesystem write/deleteST-FS-PY-WRITE

The component writes or deletes files on disk.

with open(self._output_path, mode='w', encoding='utf-8') as f:

Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.

Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.

MEDIUMPython network egressST-NET-PY

The component makes outbound network requests.

self.timeout = timeout or httpx.Timeout(connect=5.0, read=60.0, write=10.0, pool=5.0)
raise httpx.HTTPStatusError('\n'.join(message_parts), request=response.request, response=response) from e
async with httpx.AsyncClient(timeout=self.timeout, transport=self._create_transport()) as client:
async with httpx.AsyncClient(timeout=self.timeout, transport=self._create_transport()) as client:
async with httpx.AsyncClient(timeout=timeout or self.timeout, transport=self._create_transport()) as client:
async with httpx.AsyncClient(timeout=self.timeout, transport=self._create_transport()) as client:
async with httpx.AsyncClient(timeout=self.timeout, transport=self._create_transport()) as client:
async with httpx.AsyncClient(timeout=self.timeout, transport=self._create_transport()) as client:
from urllib.parse import urlparse, urlunparse
raise httpx.HTTPStatusError(message, request=exc.request, response=exc.response) from exc
sapi_url_parsed = urlparse(storage_api_url)
self._storage_api_url = urlunparse(('https', f'connection.{self._hostname_suffix}', '', '', '', ''))
metastore_api_url = urlunparse(('https', f'metastore.{self._hostname_suffix}', '', '', '', ''))
queue_api_url = urlunparse(('https', f'queue.{self._hostname_suffix}', '', '', '', ''))
ai_service_api_url = urlunparse(('https', f'ai.{self._hostname_suffix}', '', '', '', ''))
data_science_api_url = urlunparse(('https', f'data-science.{self._hostname_suffix}', '', '', '', ''))
encryption_api_url = urlunparse(('https', f'encryption.{self._hostname_suffix}', '', '', '', ''))
scheduler_api_url = urlunparse(('https', f'scheduler.{self._hostname_suffix}', '', '', '', ''))
sync_actions_api_url = urlunparse(('https', f'sync-actions.{self._hostname_suffix}', '', '', '', ''))
from urllib.parse import urlparse, urlunparse
url_value = urlparse(value)
value = urlunparse((scheme, url_value.netloc, '', '', '', ''))
value = urlunparse(('https', url_value.path.split('/', maxsplit=1)[0], '', '', '', ''))

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.

Check your own component

Run the same evidence-backed scan on any MCP server, agent skill, or package.

Scan your own component

Or get notified if this component's risk changes:

How we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →