MCP Observatory
3m ago Tracked 59,469 Last 3m ago 24h 2,466
github Python re-analysis due

Abidemialade/mylonite

v0.2.0
github

Open-source AI-layer security testing — probes your AI agent for weaknesses and writes a validated regression test for each one it finds, gating CI.

maintainer
Abidemialade
licence
Apache-2.0
first seen
2026-08-24
last seen
2026-09-15
releases · 30d
10
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio · streamable-http · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 4861414 · analyzer v33 · 4d ago

danger signals3

code evidence vv0.9.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 318

filesystem 120

  • fs (weak) Abidemialade-mylonite-4861414/scripts/check_no_local_context.py :52 from pathlib import Path
  • fs (weak) Abidemialade-mylonite-4861414/scripts/check_reference_target_inert.py :88 from pathlib import Path
  • fs (weak) Abidemialade-mylonite-4861414/scripts/check_verification_freshness.py :39 from pathlib import Path
  • fs (weak) Abidemialade-mylonite-4861414/scripts/measure_precision_recall.py :21 from pathlib import Path
  • fs (weak) Abidemialade-mylonite-4861414/scripts/normalize_secrets_baseline.py :49 from pathlib import Path
  • fs (weak) Abidemialade-mylonite-4861414/scripts/prepare_release.py :37 from pathlib import Path
  • fs (weak) Abidemialade-mylonite-4861414/scripts/record_demo_fixtures.py :91 from pathlib import Path
  • fs (weak) Abidemialade-mylonite-4861414/scripts/record_provider_fixtures.py :84 from pathlib import Path
  • fs (weak) Abidemialade-mylonite-4861414/scripts/record_reference_example.py :59 from pathlib import Path
  • fs (weak) Abidemialade-mylonite-4861414/scripts/regenerate_schemas.py :18 from pathlib import Path
  • fs (weak) Abidemialade-mylonite-4861414/scripts/release_version.py :22 from pathlib import Path
  • fs Abidemialade-mylonite-4861414/src/mylonite/_paths.py :6 step: a path from that document reached ``open()`` or a subprocess argv after
show 28 more
  • fs Abidemialade-mylonite-4861414/src/mylonite/_replay.py :56 wheel or zip. Record mode requires a real ``pathlib.Path`` — it has to
  • fs Abidemialade-mylonite-4861414/src/mylonite/cli.py :31 from pathlib import Path
  • fs Abidemialade-mylonite-4861414/src/mylonite/config.py :30 from pathlib import Path
  • fs Abidemialade-mylonite-4861414/src/mylonite/gate/annotate.py :21 from pathlib import Path
  • fs Abidemialade-mylonite-4861414/src/mylonite/gate/orchestrator.py :12 from pathlib import Path
  • fs Abidemialade-mylonite-4861414/src/mylonite/gate/pr.py :14 import shutil
  • fs Abidemialade-mylonite-4861414/src/mylonite/gate/recommend.py :35 from pathlib import PurePath
  • fs Abidemialade-mylonite-4861414/src/mylonite/gate/workflows.py :6 from pathlib import Path
  • fs Abidemialade-mylonite-4861414/src/mylonite/layout.py :33 from pathlib import Path
  • fs Abidemialade-mylonite-4861414/src/mylonite/plugins/_mcp/_session_adapter.py :31 from pathlib import Path
  • fs Abidemialade-mylonite-4861414/src/mylonite/plugins/_mcp/scaffold.py :15 from pathlib import Path
  • fs Abidemialade-mylonite-4861414/src/mylonite/plugins/_mcp/target_file.py :26 from pathlib import Path
  • fs Abidemialade-mylonite-4861414/src/mylonite/plugins/_mcp/target_registry.py :21 from pathlib import Path
  • fs Abidemialade-mylonite-4861414/src/mylonite/plugins/_reference/reference_pytest_generator.py :51 from pathlib import Path
  • fs Abidemialade-mylonite-4861414/src/mylonite/plugins/_reference/reference_validator.py :78 from pathlib import Path
  • fs Abidemialade-mylonite-4861414/src/mylonite/scan/artefacts.py :20 from pathlib import Path
  • fs Abidemialade-mylonite-4861414/src/mylonite/scan/engine.py :21 from pathlib import Path
  • fs Abidemialade-mylonite-4861414/src/mylonite/scan/pytest_runner.py :54 from pathlib import Path
  • fs Abidemialade-mylonite-4861414/src/mylonite/testkit/__init__.py :59 from pathlib import Path
  • fs (weak) Abidemialade-mylonite-4861414/tests/contracts/test_abort_reason_schema.py :22 from pathlib import Path
  • fs (weak) Abidemialade-mylonite-4861414/tests/contracts/test_facade_completeness.py :13 from pathlib import Path
  • fs (weak) Abidemialade-mylonite-4861414/tests/demo/test_record_demo_fixtures_script.py :25 from pathlib import Path
  • fs (weak) Abidemialade-mylonite-4861414/tests/demo/test_replay_invariants.py :24 from pathlib import Path
  • fs (weak) Abidemialade-mylonite-4861414/tests/e2e/test_real_target_generate_live.py :25 import shutil
  • fs (weak) Abidemialade-mylonite-4861414/tests/gate/test_action_yaml.py :1 from pathlib import Path
  • fs (weak) Abidemialade-mylonite-4861414/tests/gate/test_annotate.py :169 from pathlib import Path
  • fs (weak) Abidemialade-mylonite-4861414/tests/gate/test_gate_e2e_offline.py :20 from pathlib import Path
  • fs (weak) Abidemialade-mylonite-4861414/tests/gate/test_pr.py :2 from pathlib import Path

80 more not shown — this panel samples each group; the count above is the real total.

shell / exec 16

  • shell (weak) Abidemialade-mylonite-4861414/scripts/check_no_local_context.py :50 import subprocess
  • shell (weak) Abidemialade-mylonite-4861414/scripts/prepare_release.py :35 import subprocess
  • shell Abidemialade-mylonite-4861414/src/mylonite/gate/pr.py :15 import subprocess
  • shell Abidemialade-mylonite-4861414/src/mylonite/scan/pytest_runner.py :50 import subprocess
  • shell (weak) Abidemialade-mylonite-4861414/tests/e2e/test_real_target_generate_live.py :26 import subprocess
  • shell (weak) Abidemialade-mylonite-4861414/tests/gate/test_gate_e2e_offline.py :19 import subprocess
  • shell (weak) Abidemialade-mylonite-4861414/tests/gate/test_recommend.py :15 import subprocess
  • shell (weak) Abidemialade-mylonite-4861414/tests/plugins/test_reference_pytest_generator.py :74 "foo\"); exec(\"import os; os.system('echo pwned')",
  • shell (weak) Abidemialade-mylonite-4861414/tests/scan/test_seed_synth.py :98 hostile_name = "evil\"); exec(\"import os; os.system('echo pwned')"
  • shell (weak) Abidemialade-mylonite-4861414/tests/scan/test_testkit_import_without_kitchen_sink.py :10 import subprocess
  • shell (weak) Abidemialade-mylonite-4861414/tests/test_bootstrap.py :11 import subprocess
  • shell (weak) Abidemialade-mylonite-4861414/tests/test_cli.py :1672 pid = "foo\"); exec(\"import os; os.system('echo pwned')"
show 4 more
  • shell (weak) Abidemialade-mylonite-4861414/tests/test_reference_target_guard.py :67 "import subprocess",
  • shell (weak) Abidemialade-mylonite-4861414/tests/test_schemas.py :11 import subprocess
  • shell Abidemialade-mylonite-4861414/verification/campaign.py :49 import subprocess
  • shell Abidemialade-mylonite-4861414/verification/fetch.py :16 import subprocess

network 16

  • net Abidemialade-mylonite-4861414/reference_targets/mcp_kitchen_sink/src/mcp_kitchen_sink/server_guarded.py :38 from urllib.parse import urlparse
  • net (weak) Abidemialade-mylonite-4861414/scripts/check_reference_target_inert.py :40 ``from urllib.parse import urlparse`` binds ``urlparse``; ``import
  • net Abidemialade-mylonite-4861414/src/mylonite/cli.py :3201 from urllib.parse import parse_qsl, urlencode, urlsplit, urlunsplit
  • net Abidemialade-mylonite-4861414/src/mylonite/gate/recommend.py :241 from urllib.parse import urlparse
  • net Abidemialade-mylonite-4861414/src/mylonite/plugins/_http/http_adapter.py :25 import httpx
  • net Abidemialade-mylonite-4861414/src/mylonite/plugins/_mcp/remote_adapter.py :27 from urllib.parse import urlsplit
  • net Abidemialade-mylonite-4861414/src/mylonite/scan/_control_primitives.py :21 from urllib.parse import urlparse
  • net Abidemialade-mylonite-4861414/src/mylonite/scan/llm_policy.py :37 from urllib.parse import parse_qs, urlsplit
  • net Abidemialade-mylonite-4861414/src/mylonite/scan/predicates.py :23 from urllib.parse import urlparse
  • net (weak) Abidemialade-mylonite-4861414/tests/_hosts.py :16 from urllib.parse import urlparse
  • net (weak) Abidemialade-mylonite-4861414/tests/plugins/test_http_adapter.py :3 Uses ``httpx.MockTransport`` so no network is touched: we inject a mock client
  • net (weak) Abidemialade-mylonite-4861414/tests/scan/test_seed_synth.py :12 from urllib.parse import urlparse
show 4 more
  • net (weak) Abidemialade-mylonite-4861414/tests/test_reference_target_guard.py :56 "import urllib.parse",
  • net (weak) Abidemialade-mylonite-4861414/tests/test_taxonomy.py :11 from urllib.parse import urlparse
  • net (weak) Abidemialade-mylonite-4861414/tests/verification/test_fetch.py :40 monkeypatch.setattr(fetch.urllib.request, "urlopen", _boom_urlopen)
  • net Abidemialade-mylonite-4861414/verification/fetch.py :18 import urllib.request

secrets 7

  • secrets (weak) Abidemialade-mylonite-4861414/tests/e2e/test_real_target_generate_live.py :52 if not os.environ.get("ANTHROPIC_API_KEY"):
  • secrets (weak) Abidemialade-mylonite-4861414/tests/e2e/test_validate_live.py :82 if not os.environ.get("ANTHROPIC_API_KEY"):
  • secrets (weak) Abidemialade-mylonite-4861414/tests/integration/test_scan_mcp_fetch_live.py :37 if not os.environ.get("ANTHROPIC_API_KEY"):
  • secrets (weak) Abidemialade-mylonite-4861414/tests/integration/test_scan_mcp_filesystem_live.py :46 if not os.environ.get("ANTHROPIC_API_KEY"):
  • secrets (weak) Abidemialade-mylonite-4861414/tests/integration/test_scan_mcp_github_live.py :43 if not os.environ.get("GITHUB_TOKEN"):
  • secrets (weak) Abidemialade-mylonite-4861414/tests/test_cli.py :718 assert os.environ.get("GEMINI_API_KEY") == "sk-test-1234567890abcdef"
  • secrets (weak) Abidemialade-mylonite-4861414/tests/test_cli_keyless.py :430 assert os.environ["ANTHROPIC_API_KEY"] == fake_key

declared dependencies 24

  • mcp@>=1.0,<2.0
  • typer@>=0.12
  • pydantic@>=2.7
  • pydantic-settings@>=2.3
  • litellm@>=1.83.10
  • jsonschema@>=4.22
  • json-repair@>=0.30
  • pyyaml@>=6.0
  • httpx@>=0.27
  • rich@>=13.7
  • truststore@>=0.9
  • pytest@>=8.2
show 12 more
  • aiohttp@>=3.14.0
  • python-dotenv@>=1.2.2
  • ruff@==0.16.4
  • mypy@>=1.10
  • pytest-cov@>=5.0
  • pytest-asyncio@>=0.23
  • pre-commit@>=3.7
  • types-PyYAML@>=6.0
  • types-jsonschema@>=4.22
  • mcp-kitchen-sink@==0.1.0
  • mkdocs@>=1.6
  • mkdocs-material@>=9.5

transport_posture 1

  • network-listening, binds all interfaces, no auth detected Abidemialade-mylonite-4861414/tests/verification/test_layer1_dvmcp.py :34 sp.write_text('uvicorn.run("server:mcp", host="0.0.0.0", port=8002)\n', encoding="utf-8")