https://github.com/atlaso-labs/mcp
mcp
Hostile
Score 53 / 100 · 2 files read · 1 critical, 0 high, 1 medium, 0 low findings
Report bc32afe287b47530 · first scanned 2026-10-28 · scanned 1× · keyed to the exact package contents, so this link always shows this version
Subscores
100 is clean. Deductions come only from the cited findings below.
Findings
criticalDownloads a remote file and pipes it straight into a shell interpreter
README.md · line 49 · rule C1
f them up: ```bash curl -fsSL https://atlaso.ai/install.sh | bash # macOS / Linux irm https://atlaso.ai/install.ps1 | iex
mediumCode contacts static.modelcontextprotocol.io, which the documentation never mentions
(package) · line 1 · rule M3
static.modelcontextprotocol.io
Permission surface
- Network endpoints
- atlaso.aidocs.atlaso.aigithub.commcp.atlaso.aistatic.modelcontextprotocol.iowww.atlaso.ai
- Environment read
- no named variables
- Shell execution
- no
- Install hooks
- none
- Credential material
- none referenced
Provenance
- Source
- GitHub
- Repository
- atlaso-labs/mcp
- Owner
- atlaso-labs
- Stars
- 0
- Forks
- 0
- Repo created
- 2026-07-27
- Last push
- 2026-10-26
Watch this package
Interest list only. We store the address and this report link, nothing else. No mail is sent in v1.
Share this report: https://preflight.orbitaldeskllc.com/r/bc32afe287b47530