https://github.com/AhmedLaminou/windows-mcp-server

windows-mcp-server

Caution

Score 66 / 100 · 60 files read · 0 critical, 0 high, 23 medium, 3 low findings

Report 9f8836ba1616c40b · first scanned 2026-10-28 · scanned 3× · keyed to the exact package contents, so this link always shows this version

Listed in the Agent Census directory data

Subscores

credentials88

exfiltration92

execution0

injection100

obfuscation98

files100

100 is clean. Deductions come only from the cited findings below.

Findings

mediumCode contacts static.modelcontextprotocol.io, which the documentation never mentions

(package) · line 1 · rule M3

static.modelcontextprotocol.io

mediumCan run shell commands from code

windows_mcp_server/tools/advanced_process.py · line 26 · rule M1

y: result = subprocess.run( ["powershell", "-NoProfile", "-Command", ps_cmd], capture_output=True,

mediumEnumerates the full process environment (all variables, not one named key)

windows_mcp_server/tools/developer_environment.py · line 19 · rule M2

items = sorted(os.environ.items()) return "\n".join(f"{key}={value}" for key, value in items) hive = winreg.HKEY

mediumCan run shell commands from code

windows_mcp_server/tools/developer_environment.py · line 68 · rule M1

[str]: result = subprocess.run(["where", command], capture_output=True, text=True) if result.returncode != 0: path

mediumCan run shell commands from code

windows_mcp_server/tools/disk_health.py · line 9 · rule M1

> str: result = subprocess.run( ["powershell", "-NoProfile", "-NonInteractive", "-Command", script], capture_o

mediumCan run shell commands from code

windows_mcp_server/tools/driver_maintenance.py · line 7 · rule M1

> str: result = subprocess.run( ["powershell", "-NoProfile", "-NonInteractive", "-Command", script], capture_o

mediumCan run shell commands from code

windows_mcp_server/tools/event_diagnostics.py · line 7 · rule M1

> str: result = subprocess.run( ["powershell", "-NoProfile", "-NonInteractive", "-Command", script], capture_o

mediumCan run shell commands from code

windows_mcp_server/tools/execute_powershell.py · line 17 · rule M1

result = subprocess.run(["powershell", "-NoProfile", "-Command", command], capture_output=True, text=True)

mediumCan run shell commands from code

windows_mcp_server/tools/hardware_drivers.py · line 13 · rule M1

n" result = subprocess.run(["powershell", "-NoProfile", "-Command", ps_cmd], capture_output=True, text=True) if no

mediumCan run shell commands from code

windows_mcp_server/tools/manage_network.py · line 46 · rule M1

ing." res = subprocess.run(["ping", "-n", "4", target], capture_output=True, text=True) return res.stdout

mediumCan run shell commands from code

windows_mcp_server/tools/network_diagnostics.py · line 74 · rule M1

completed = subprocess.run( ["ping", "-n", str(count), target], capture_output=True,

mediumCan run shell commands from code

windows_mcp_server/tools/optimization.py · line 11 · rule M1

y: result = subprocess.run( ["powershell", "-NoProfile", "-Command", "Clear-RecycleBin -Force -ErrorAction Sto

mediumCan run shell commands from code

windows_mcp_server/tools/peripherals.py · line 7 · rule M1

> str: result = subprocess.run( ["powershell", "-NoProfile", "-NonInteractive", "-Command", script], capture_o

mediumCan run shell commands from code

windows_mcp_server/tools/power_hardware.py · line 7 · rule M1

> str: result = subprocess.run( ["powershell", "-NoProfile", "-NonInteractive", "-Command", script], capture_o

mediumCan run shell commands from code

windows_mcp_server/tools/restore_update_controls.py · line 7 · rule M1

> str: result = subprocess.run( ["powershell", "-NoProfile", "-NonInteractive", "-Command", script], capture_o

mediumCan run shell commands from code

windows_mcp_server/tools/safe_file_operations.py · line 98 · rule M1

) result = subprocess.run(["powershell", "-NoProfile", "-Command", script], capture_output=True, text=True) if result

mediumCan run shell commands from code

windows_mcp_server/tools/security_updates.py · line 7 · rule M1

> str: result = subprocess.run( ["powershell", "-NoProfile", "-NonInteractive", "-Command", script], capture_o

mediumCan run shell commands from code

windows_mcp_server/tools/services.py · line 41 · rule M1

y: result = subprocess.run(["sc", action, service_name], capture_output=True, text=True, check=True) return f"Succ

mediumCan run shell commands from code

windows_mcp_server/tools/shell_helpers.py · line 19 · rule M1

(path): subprocess.Popen(["explorer", f"/select,{os.path.abspath(path)}"]) else: subprocess.Popen(

mediumCan run shell commands from code

windows_mcp_server/tools/software_maintenance.py · line 111 · rule M1

"''") result = subprocess.run( ["powershell", "-NoProfile", "-Command", f"Start-Process -FilePath 'cmd.exe' -Argument

mediumCan run shell commands from code

windows_mcp_server/tools/startup_tasks.py · line 15 · rule M1

> str: result = subprocess.run( ["powershell", "-NoProfile", "-NonInteractive", "-Command", script], capture_o

mediumCan run shell commands from code

windows_mcp_server/tools/task_manager.py · line 23 · rule M1

n" result = subprocess.run(["powershell", "-NoProfile", "-Command", ps_cmd], capture_output=True, text=True) if no

mediumCan run shell commands from code

windows_mcp_server/tools/virtualization.py · line 7 · rule M1

> str: result = subprocess.run( ["powershell", "-NoProfile", "-NonInteractive", "-Command", script], capture_o

low4 binary file(s) were not parsed (static text analysis only)

(package) · line 1 · rule L3

4 binary files

lowReads named environment variables (normal for API keys; listed in the permission summary)

windows_mcp_server/tools/optimization.py · line 29 · rule L1

mp_dirs = [ os.environ.get("TEMP"), os.environ.get("TMP"), "C:\\Windows\\Temp" ] freed_bytes

lowReads named environment variables (normal for API keys; listed in the permission summary)

windows_mcp_server/tools/startup_tasks.py · line 47 · rule L1

os.path.join(os.environ.get("APPDATA", ""), r"Microsoft\Windows\Start Menu\Programs\Startup"), os.path.join(os.envi

Permission surface

Network endpoints: cla.opensource.microsoft.comfeross.orggithub.comhatch.pypa.ioimg.youtube.comopencollective.compypi.orgregistry.modelcontextprotocol.ioregistry.npmjs.orgstatic.modelcontextprotocol.iowww.patreon.comwww.youtube.comyoutu.be
Environment read: APPDATAPROGRAMDATATEMPTMP
Shell execution: yes — code or scripts can run shell commands
Install hooks: none
Credential material: Enumerates the full process environment (all variables, not one named key)
Reads named environment variables (normal for API keys; listed in the permission summary)

Provenance

Source: GitHub
Repository: AhmedLaminou/windows-mcp-server

Badge for the author

[![Preflight: Caution](https://preflight.orbitaldeskllc.com/badge/9f8836ba1616c40b.svg)](https://preflight.orbitaldeskllc.com/b/9f8836ba1616c40b)

The badge links back to this report and updates if the package is re-scanned at a new version.

Watch this package

Interest list only. We store the address and this report link, nothing else. No mail is sent in v1.

Share this report: https://preflight.orbitaldeskllc.com/r/9f8836ba1616c40b