preflight

https://github.com/47-ronn/tunshell_mcp_agents

tunshell_mcp_agents

Hostile

Score 14 / 100 · 80 files read · 0 critical, 2 high, 21 medium, 4 low findings

Report 1161bda6923e3e3f · first scanned 2026-10-28 · scanned 4× · keyed to the exact package contents, so this link always shows this version

Listed in the Agent Census directory data

Subscores

credentials64
exfiltration70
execution0
injection100
obfuscation98
files92

100 is clean. Deductions come only from the cited findings below.

Findings

highReferences the SSH directory (~/.ssh)
crates/mcp-server/src/executor/git.rs · line 363 · rule H1
mand(Some("ssh -i ~/.ssh/deploy_key")), None); } #[test] fn combine_appends_stderr_to_stdout() { let (out, ok
highThis package both touches credential material and sends data over the network (in different files) — review the flow before installing
crates/mcp-server/src/executor/git.rs · line 1 · rule H1
mediumCode contacts static.modelcontextprotocol.io, which the documentation never mentions
(package) · line 1 · rule M3
static.modelcontextprotocol.io
mediumCan run shell commands from code
crates/mcp-server/src/autonomous.rs · line 106 · rule M1
e(); tokio::spawn(async move { store.run_task(&id_bg, &prompt, runner_override, cwd_override).await; }
mediumCan run shell commands from code
crates/mcp-server/src/connection.rs · line 353 · rule M1
ter_handle = tokio::spawn(async move { while let Some(msg) = ws_rx.recv().await { if let Err(e) = write.send(m
mediumCan run shell commands from code
crates/mcp-server/src/daemon.rs · line 202 · rule M1
D_PROCESS) .spawn() .with_context(|| format!("failed to launch detached: {:?}", exe))?; println!( "La
mediumCan run shell commands from code
crates/mcp-server/src/executor/git.rs · line 90 · rule M1
)); let _ = cmd.spawn()?.wait().await; Ok(()) } /// Check if a drive letter path is a network drive (GetDriveTypeW return
mediumCan run shell commands from code
crates/mcp-server/src/executor/shell.rs · line 69 · rule M1
let mut child = cmd.spawn()?; let pid = child.id(); let deadline = Duration::from_millis(timeout_ms); let start = Inst
mediumCan run shell commands from code
crates/mcp-server/src/files.rs · line 255 · rule M1
o::null()) .spawn() .with_context(|| format!("spawn {program}"))?; let mut out = Vec::new(); if let Some(
mediumCan run shell commands from code
crates/mcp-server/src/relay_api.rs · line 167 · rule M1
tokio::spawn(async move { let mut backoff = crate::relay_controller::RECONNECT_MIN;
mediumCan run shell commands from code
crates/mcp-server/src/relay_controller.rs · line 199 · rule M1
tokio::spawn(async move { let mut ping = tokio::time::interval(std::time::Duration::from_secs(30));
mediumCan run shell commands from code
crates/mcp-server/src/relay_udp.rs · line 68 · rule M1
e(); tokio::spawn(async move { while let Some(data) = recv_rx.recv().await { if inbound_tx.sen
mediumEnumerates the full process environment (all variables, not one named key)
crates/mcp-server/src/safety.rs · line 45 · rule M2
ree", "id", "env", "printenv", "which", "type", "stat", "file", "tree", "realpath", "dirname", "basename", "readlink",
mediumCan run shell commands from code
crates/mcp-server/src/sessions.rs · line 1778 · rule M1
let mut child = cmd.spawn().ok()?; let pid = child.id(); let deadline = Instant::now() + timeout; loop {
mediumCan run shell commands from code
crates/mcp-server/src/state.rs · line 213 · rule M1
e(); tokio::spawn(async move { scheduler.run().await }); } } /// Insert `peer`, or replace the existing entry with th
mediumCan run shell commands from code
crates/mcp-server/src/tunnel.rs · line 58 · rule M1
ommand .spawn() .context("spawn cloudflared (is it executable?)")?; match wait_for_url(&mut child
mediumCan run shell commands from code
crates/mcp-server/src/udp_transport.rs · line 79 · rule M1
e(); tokio::spawn(async move { while let Some(data) = recv_rx.recv().await { if inbound_tx.sen
mediumCan run shell commands from code
crates/mcp-server/tests/chain_e2e.rs · line 17 · rule M1
.port(); tokio::spawn(async move { axum::serve( listener, router(state).into_make_service_with
mediumCan run shell commands from code
crates/mcp-server/tests/join_retry.rs · line 25 · rule M1
port"); tokio::spawn(async move { axum::serve( listener, router(state).into_make_service_with
mediumCan run shell commands from code
crates/mcp-server/tests/transfer_e2e.rs · line 19 · rule M1
.port(); tokio::spawn(async move { axum::serve( listener, router(state).into_make_service_with
mediumRuns a command automatically at install time (postinstall)
npm/package.json · line 1 · rule M4
postinstall: node install.js
mediumCan run shell commands from code
npm/run.js · line 15 · rule M1
spawn } = require("child_process"); const { version } = require("./package.json"); const REGISTRY_URL = "https://registry.npmjs.
mediumWrites files under the user home directory
npm/run.js · line 109 · rule M5
ate. Never throws. `writeFile`/`mkdir` // are injectable for tests. function cacheUpdateAvailable( latest, current = version,
low5 binary file(s) were not parsed (static text analysis only)
(package) · line 1 · rule L3
5 binary files
lowReads named environment variables (normal for API keys; listed in the permission summary)
npm/install.js · line 127 · rule L1
lease exists. if (process.env.REMOTE_AGENTS_SKIP_DOWNLOAD) { console.log("remote-agents: REMOTE_AGENTS_SKIP_DOWNLOAD set, sk
lowReads named environment variables (normal for API keys; listed in the permission summary)
npm/run.js · line 91 · rule L1
in32") { return process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"); } if (process.platform === "darwin")
lowReads named environment variables (normal for API keys; listed in the permission summary)
npm/run.test.js · line 109 · rule L1
K", async () => { process.env.REMOTE_AGENTS_NO_UPDATE_CHECK = "1"; let called = false; const fetchLatest = async () => {

Permission surface

Network endpoints
127.0.0.1.evil.comabc-def.trycloudflare.comapi.ipify.orgcloudflare-dns.comdns.googleevil-localhost.comevil.comexample.comgithub.comhappy-tree-cat.trycloudflare.comimg.shields.iolocalhost.evil.commodelcontextprotocol.ionssm.ccregistry.npmjs.orgstatic.modelcontextprotocol.iowww.apple.comx.trycloudflare.com
Environment read
APPDATAREMOTE_AGENTS_NO_UPDATE_CHECKREMOTE_AGENTS_SKIP_DOWNLOADXDG_DATA_HOME
Shell execution
yes — code or scripts can run shell commands
Install hooks
postinstall: node install.js
Credential material
Reads named environment variables (normal for API keys; listed in the permission summary)
References the SSH directory (~/.ssh)
Enumerates the full process environment (all variables, not one named key)

Provenance

Source
GitHub
Repository
47-ronn/tunshell_mcp_agents
Owner
47-ronn
Stars
2
Forks
1
Repo created
2026-06-15
Last push
2026-10-22
License
MIT

Watch this package

Interest list only. We store the address and this report link, nothing else. No mail is sent in v1.

Share this report: https://preflight.orbitaldeskllc.com/r/1161bda6923e3e3f