Is mcp safe?
- Python shell/command execution
- Possible command injection (shell + dynamic command)
- Python filesystem read
mcp is an AI python_package analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators, though 7 risky constructs are reported for review. It can: delegated authentication, filesystem read, filesystem write, mcp tools detected, network egress and shell execution — capabilities are what the code can do, not a verdict on intent. Risk score 20/100 (low).
mcp 2.2.0
Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of mcp's authors. Report a false positive.
Behavioral traits
How this component maps to the CSA agentic threat model. Descriptive — it never affects the risk score.
Findings (7)
The code builds an OS command out of values that can change at runtime, then runs it through a shell.
subprocess.run([cmd, "--version"], check=True, capture_output=True, shell=True)
Why it matters: If any of those values come from untrusted input, an attacker can run their own commands on the machine.
Fix: Pass arguments as a list without shell=True (e.g. subprocess.run(['git', 'checkout', branch])); never build a shell string from external input. If a shell is unavoidable, quote with shlex.quote.
The component can run operating-system commands or spawn processes.
result = subprocess.run(
[
"uv", "run", "--frozen", "--group", "codegen", "datamodel-codegen",
"--input", str(schema_path),
"--input-file-type", "jsonschema",
"--output", str(output_pa …subprocess.run(
["uv", "run", "--frozen", "ruff", "format", "--no-cache", str(staging)],
cwd=REPO_ROOT, capture_output=True, check=True,
) # fmt: skipsubprocess.run([cmd, "--version"], check=True, capture_output=True, shell=True)
process = subprocess.run(
[npx_cmd, "@modelcontextprotocol/inspector"] + uv_cmd,
check=True,
shell=shell,
env=dict(os.environ.items()), # Copy the environment for subprocess launch
)popen_obj = subprocess.Popen(
[command, *args],
stdin=subprocess.PIPE,
stdout=subprocess.PIPE,
stderr=errlog,
env=env,
cwd=cwd,
bufsize=0, # Unbuffered output
creationflags=ge …Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.
Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; avoid shell=True.
The component reads files from disk.
png = LOGO_FILE.read_bytes() # a database read, an HTTP response, Pillow output...
return STYLE_GUIDE_FILE.read_text(encoding="utf-8")
return file.read_text(encoding="utf-8")
entries: list[dict[str, str]] = json.loads((SCHEMA_DIR / "PINNED.json").read_text(encoding="utf-8"))
actual = hashlib.sha256(path.read_bytes()).hexdigest()
schema = json.loads((SCHEMA_DIR / f"{version}.json").read_text(encoding="utf-8"))source = raw.read_text(encoding="utf-8")
return staging.read_text(encoding="utf-8")
committed = target.read_text(encoding="utf-8") if target.is_file() else ""
code = Path(file_path).read_text(encoding="utf-8").rstrip()
content = readme_path.read_text(encoding="utf-8")
config = json.loads(config_file.read_bytes())
with open(self.path, "rb") as f:
with open(self.path, "rb") as f:
Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.
Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.
The component writes or deletes files on disk.
patched.write_text(json.dumps(schema), encoding="utf-8")
staging.write_text(source, encoding="utf-8")
target.write_text(candidate, encoding="utf-8")
readme_path.write_text(updated_content, encoding="utf-8")
config_file.write_text("{}", encoding="utf-8")config_file.write_text(json.dumps(config, indent=2), encoding="utf-8")
Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.
Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.
The component makes outbound network requests.
for key, req in requests.items():
Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.
Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.
An OAuth 2.0 / OpenID Connect delegated-authentication flow was detected (authorization-code / refresh-token / token-exchange grant, an OIDC authorize/discovery endpoint or id_token, or a delegation library). Tools authenticate with the end user's delegated, scoped credentials rather than a long-lived embedded service credential. (25 occurrence(s) shown as evidence).
"grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
"subject_token_type": "urn:ietf:params:oauth:token-type:id_token",
if self.context.oauth_metadata and self.context.oauth_metadata.authorization_endpoint:
auth_endpoint = str(self.context.oauth_metadata.authorization_endpoint)
"grant_type": "authorization_code",
"grant_type": "refresh_token",
oidc_path = f"/.well-known/openid-configuration{parsed.path.rstrip('/')}"oidc_path = f"{parsed.path.rstrip('/')}/.well-known/openid-configuration"urls.append(urljoin(base_url, "/.well-known/openid-configuration"))
authorization_endpoint=authorization_url,
authorization_endpoint: AnyHttpUrl
url="https://example.com/oauth/authorize",
Fix: Delegated auth is a lower-blast-radius execution context than an embedded static credential. Confirm the requested scopes are minimal and that tokens are never logged or forwarded off-host.
An MCP tool surface (manifest or tool definitions) was found.
@mcp.tool()
@mcp.tool()
@mcp.tool()
@mcp.tool()
@mcp.tool()
@mcp.tool()
@mcp.tool()
@mcp.tool()
@mcp.tool(title="Search the catalog")
@mcp.tool()
@mcp.tool()
@mcp.tool()
@mcp.tool()
@mcp.tool()
@mcp.tool()
@mcp.tool()
@mcp.tool()
@mcp.tool()
@mcp.tool()
@mcp.tool()
@mcp.tool()
@mcp.tool()
@mcp.tool()
@mcp.tool()
@mcp.tool()
Why it matters: Just context — review which tools it offers and their permissions.
Fix: Review the declared MCP tools and their permissions.
Check your own component
Run the same evidence-backed scan on any MCP server, agent skill, or package.
Scan your own componentHow we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →