universal-host-manager-mcp

Risky

Score 57 / 100 · 21 files read · 0 critical, 0 high, 7 medium, 4 low findings

Report 240d864a2311447c · first scanned 2026-10-28 · scanned 3× · keyed to the exact package contents, so this link always shows this version

Listed in the Agent Census directory data

Subscores

credentials94

exfiltration92

execution68

injection84

obfuscation98

files100

100 is clean. Deductions come only from the cited findings below.

mediumCode contacts static.modelcontextprotocol.io, which the documentation never mentions

(package) · line 1 · rule M3

static.modelcontextprotocol.io

mediumInstructions involve running commands with sudo

README.md · line 249 · rule M6

ok`; on Ubuntu use `sudo snap install ngrok`. Other Linux distributions can use ngrok's official [download instructions](https://n

mediumInstructions involve running commands with sudo

SECURITY.md · line 21 · rule M6

dless unrestricted `sudo`. - Review logs and rotate credentials if an MCP client or account is compromised. - For stronger isolati

mediumCan run shell commands from code

src/universal_host_manager_mcp/server.py · line 143 · rule M1

ocess_tree(process: subprocess.Popen) -> None: """Kill ``process`` and every child it spawned (a background job, a piped c

mediumCan run shell commands from code

src/universal_host_manager_mcp/setup_wizard.py · line 172 · rule M1

ue result = subprocess.run( command, capture_output=True, text=True, timeo

mediumCan run shell commands from code

tests/test_command_timeout.py · line 3 · rule M1

urdugunu dogrular. subprocess.run(..., shell=True) yalnizca dogrudan shell surecini oldurur; bir pipeline'da ('sleep | cat', POSI

mediumCan run shell commands from code

tests/test_setup_wizard_guidance.py · line 292 · rule M1

None) result = subprocess.run( [sys.executable, "-c", "from universal_host_manager_mcp import server; print(server.PO

low3 binary file(s) were not parsed (static text analysis only)

(package) · line 1 · rule L3

3 binary files

lowReads named environment variables (normal for API keys; listed in the permission summary)

src/universal_host_manager_mcp/server.py · line 35 · rule L1

sattr guard. if not os.getenv("FASTMCP_CHECK_FOR_UPDATES") and hasattr(fastmcp.settings, "check_for_updates"): fastmcp.setting

lowReads named environment variables (normal for API keys; listed in the permission summary)

tests/conftest.py · line 18 · rule L1

m-test-workspace-") os.environ.setdefault("ALLOW_INSECURE_NO_AUTH", "true") os.environ.setdefault("MCP_WORKSPACE_DIR", _workspace)

lowReads named environment variables (normal for API keys; listed in the permission summary)

tests/test_setup_wizard_guidance.py · line 280 · rule L1

\n" ) env = os.environ.copy() for key in ( "HOST", "PORT", "MCP_WORKSPACE_DIR", "ALLOW

Network endpoints: another.exampleantigravity.googleapp.mcptoai.comauth0.comchatgpt.comclaude.aiclaude.comdashboard.ngrok.comdemo.ngrok-free.appdemo.ngrok-free.devdevelopers.cloudflare.comgithub.comglama.aigofastmcp.commcp.example.commodelcontextprotocol.iongrok.comprovider.examplepypi.orgstatic.modelcontextprotocol.iothird.examplewww.apple.comyour-name.ngrok-free.dev
Environment read: ALLOW_INSECURE_NO_AUTHAUTH0_AUDIENCEAUTH0_CLIENT_IDAUTH0_CLIENT_SECRETAUTH0_DOMAINDEFAULT_CMD_TIMEOUTFASTMCP_CHECK_FOR_UPDATESHOSTLOG_COMMANDSLOG_LEVELMAX_CMD_TIMEOUTMAX_OUTPUT_CHARSMAX_READ_BYTESMAX_WRITE_BYTESMCP_BASE_URLMCP_WORKSPACE_DIRPORTUHM_ALLOWED_CLIENT_REDIRECT_URIS
Shell execution: yes — code or scripts can run shell commands
Install hooks: none
Credential material: Reads named environment variables (normal for API keys; listed in the permission summary)

Interest list only. We store the address and this report link, nothing else. No mail is sent in v1.