https://github.com/AG-Bureau/mcp-search

mcp-search

Hostile

Score 17 / 100 · 44 files read · 1 critical, 0 high, 9 medium, 12 low findings

Report 2d239e7bb57dcc4a · first scanned 2026-10-28 · scanned 4× · keyed to the exact package contents, so this link always shows this version

Listed in the Agent Census directory data

Subscores

credentials54

exfiltration92

execution15

injection100

obfuscation98

files100

100 is clean. Deductions come only from the cited findings below.

Findings

criticalDownloads a remote file and pipes it straight into a shell interpreter

HOWTO-CALL.md · line 491 · rule C1

ty, not the process curl -s http://<host>:8081/healthz | python3 -m json.tool # a real search end to end (pays with one outbound

mediumCode contacts static.modelcontextprotocol.io, which the documentation never mentions

(package) · line 1 · rule M3

static.modelcontextprotocol.io

mediumCan run shell commands from code

adapter/reader.py · line 1107 · rule M1

ry: child = subprocess.Popen(cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE, start_ne

mediumEnumerates the full process environment (all variables, not one named key)

browser/supervise.py · line 202 · rule M2

. """ out = dict(os.environ if env is None else env) out.pop(SECRET_ENV, None) return out def _relay(stream, pat

mediumCan run shell commands from code

browser/supervise.py · line 371 · rule M1

y: server = subprocess.Popen([*command, str(fd_in)], env=_child_env(env), stdout=subproc

mediumEnumerates the full process environment (all variables, not one named key)

tests/test_adapter.py · line 3623 · rule M2

ss as _sp env = dict(os.environ, AG_DOOR_AUTH="enforce", PORT="0") for argv in ([], ["--stdio"]): ran = _sp.run([s

mediumCan run shell commands from code

tests/test_adapter.py · line 2853 · rule M1

]) + "\n" run = subprocess.run([sys.executable, os.path.join(os.path.dirname(server.__file__),

mediumEnumerates the full process environment (all variables, not one named key)

tests/test_model.py · line 569 · rule M2

= {k: v for k, v in os.environ.items() if k != "LLM_RATE_LIMIT_CODES"} env.update(PYTHONPATH=os.pat

mediumCan run shell commands from code

tests/test_model.py · line 575 · rule M1

done = subprocess.run( [sys.executable, "-c", "import model; " "print(','.join(sorte

mediumCan run shell commands from code

tests/test_reader.py · line 2165 · rule M1

s_popen = supervise.subprocess.Popen started = [] try: supervise.subprocess.Popen = lambda *a, **k: st

low1 binary file(s) were not parsed (static text analysis only)

(package) · line 1 · rule L3

1 binary files

lowReads named environment variables (normal for API keys; listed in the permission summary)

adapter/deep.py · line 61 · rule L1

e. READ_CHARS = int(os.environ.get("DEEP_READ_CHARS") or "60000") def _window_at_markers(text: str, markers: list[str], size: in

lowReads named environment variables (normal for API keys; listed in the permission summary)

adapter/model.py · line 52 · rule L1

nguage. API_BASE = (os.environ.get("LLM_API_BASE") or "").strip().rstrip("/") API_KEY = (os.environ.get("LLM_API_KEY") or "").stri

lowReads named environment variables (normal for API keys; listed in the permission summary)

adapter/pool.py · line 58 · rule L1

ch. POOL_SIZE = int(os.environ.get("POOL_SIZE") or "8") # Below this many probes an engine takes NO part in the computation — it

lowReads named environment variables (normal for API keys; listed in the permission summary)

adapter/reader.py · line 86 · rule L1

. PDF_CEILING = int(os.environ.get("PDF_MAX_BYTES") or str(30 * 1024 * 1024)) THIN_CHARS = 1200 # "suspiciously littl

lowReads named environment variables (normal for API keys; listed in the permission summary)

adapter/render.py · line 33 · rule L1

DPI_DEFAULT = int(os.environ.get("RENDER_DPI") or "300") DPI_FLOOR = int(os.environ.get("RENDER_DPI_MIN") or "72") # Downscale l

lowReads named environment variables (normal for API keys; listed in the permission summary)

adapter/server.py · line 114 · rule L1

OR_AUTH = door_mode(os.environ.get("AG_DOOR_AUTH")) DOOR_TOKENS_FILE = (os.environ.get("AG_DOOR_TOKENS") or "").strip() # `/health

lowReads named environment variables (normal for API keys; listed in the permission summary)

browser/supervise.py · line 88 · rule L1

EAP_EVERY_S = float(os.environ.get("BROWSER_REAP_EVERY_S") or "30") MAX_AGE_S = float(os.environ.get("BROWSER_MAX_AGE_S") or "120"

lowReads named environment variables (normal for API keys; listed in the permission summary)

prober/probe.py · line 38 · rule L1

rce SEARXNG_URL = (os.environ.get("SEARXNG_URL") or "http://searxng:8080").rstrip("/") API_BASE = os.environ.get("PROBE_DB") or "

lowReads named environment variables (normal for API keys; listed in the permission summary)

tests/test_adapter.py · line 140 · rule L1

e = serve(Fake) os.environ["SEARXNG_URL"] = f"http://127.0.0.1:{fake.server_address[1]}" import server # imported AFTER t

lowReads named environment variables (normal for API keys; listed in the permission summary)

tests/test_model.py · line 569 · rule L1

= {k: v for k, v in os.environ.items() if k != "LLM_RATE_LIMIT_CODES"} env.update(PYTHONPATH=os.pat

lowReads named environment variables (normal for API keys; listed in the permission summary)

tests/test_reader.py · line 253 · rule L1

e's result set. os.environ.pop("READ_ALLOW_INTERNAL", None) import reader print("\n== prohibitions (the test gate is

Permission surface

Network endpoints: a.examplea.ruarxiv.orgbing.comblocked.examplecdn.example.netdocs.searxng.orgdoes-not-exist.invalidexample.comexample.orgfiles.stroyinf.rufsf.orggithub.comglama.aigo.example.comgo.resulthunter.comimg.shields.ioimgur.comno.model.invalidnormal.ruodd.exampleone-index.exampleopencorp.exampleoutward.exampleprovider.invalidregistry.modelcontextprotocol.ioru.wikipedia.orgrules.exampleshared.examplesp.netstatic.modelcontextprotocol.iosupport.microsoft.comwhatever.invalidwww.example.orgwww.gnu.orgwww.google.comwww.rbc.ruwww.rfc-editor.orgwww.tadviser.ru
Environment read: ADAPTER_URLAG_DOOR_AUTHAG_DOOR_TLS_CERTAG_DOOR_TLS_KEYAG_DOOR_TLS_PORTAG_DOOR_TOKENSBROWSER_CONNECT_MSBROWSER_COOLDOWN_SBROWSER_KILL_GRACE_SBROWSER_MAX_AGE_SBROWSER_MAX_SESSIONSBROWSER_PROBE_SBROWSER_REAP_EVERY_SBROWSER_SETTLE_MSBROWSER_SLOT_WAIT_SBROWSER_TIMEOUT_MSBROWSER_WS_SECRETBROWSER_WS_URLDEEP_DATE_WINDOWDEEP_RATE_LIMIT_MAX_WAIT_SDEEP_READ_CHARSDEEP_READ_EXPECTDEEP_READ_URLDEEP_SIMILARITYENGINE_COOLDOWN_EMPTY_SENGINE_COOLDOWN_SENGINE_MAX_WAIT_SENGINE_MIN_INTERVAL_SFAKE_PW_MODEFAKE_PW_PIDSIMAGE_PROBE_EVERYLLM_API_BASELLM_API_KEYLLM_DISABLE_THINKINGLLM_MAX_CONCURRENTLLM_MODEL_TEXTLLM_MODEL_VISIONLLM_PRICE_INPUT_PER_1KLLM_PRICE_OUTPUT_PER_1KLLM_PROVIDERLLM_RATE_LIMIT_CODESLLM_RATE_LIMIT_WAIT_SMCP_TRANSPORTMODEL_MAX_TOKENSMODEL_TIMEOUT_SOCR_MAX_PAGESOCR_TIMEOUT_SPATHS_CACHE_SPDF_MAX_BYTESPDF_MAX_PAGESPOOL_DEADZONEPOOL_FAMILY_CAPPOOL_FAMILY_OVERLAPPOOL_MIN_PROBESPOOL_RECALC_EVERYPOOL_SIZEPOOL_WINDOW_HPORTPROBE_DBPROBE_DOOR_TOKENPROBE_INTERVAL_SPROBE_RAREPROBE_RARE_INTERVAL_SPROBE_READ_TIMEOUT_SPROBE_TIMEOUT_SPYTHONPATHREAD_ALLOW_INTERNALREAD_CONTACTREAD_LANGUAGESREAD_PARALLELREAD_PROBE_EVERYREGISTRY_RETRY_SRENDER_DPIRENDER_DPI_MINRENDER_FORMATRENDER_JPEG_QUALITYRENDER_MAX_B64SEARCH_READ_CHARSSEARCH_READ_TOPSEARXNG_TIMEOUT_SSEARXNG_URLSHOT_TEXT_CHARSSPEND_LEDGERTRUST_LAST_N
Shell execution: yes — code or scripts can run shell commands
Install hooks: none
Credential material: Reads named environment variables (normal for API keys; listed in the permission summary)
Enumerates the full process environment (all variables, not one named key)

Provenance

Source: GitHub
Repository: AG-Bureau/mcp-search
Owner: AG-Bureau
Stars: 0
Forks: 0
Repo created: 2026-09-07
Last push: 2026-09-26
License: AGPL-3.0

Watch this package

Interest list only. We store the address and this report link, nothing else. No mail is sent in v1.

Share this report: https://preflight.orbitaldeskllc.com/r/2d239e7bb57dcc4a