🚀 The fast, Pythonic way to build MCP servers and clients.
Drift inferred · capture-to-capture
- HIGH code analysis flagged dynamic code execution ×6 in PrefectHQ/fastmcp
- HIGH code analysis flagged dynamic code execution in PrefectHQ/fastmcp
- HIGH code analysis flagged dynamic code execution in PrefectHQ/fastmcp
transport stdio · streamable-http · http · sse counts 20 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
add_expense
-
check_worker_status
-
crunch
-
custom_name
-
get_auth_type
-
get_client_ip
-
get_my_emails
-
get_user_id
-
introspect
-
list_files
-
log_progress
-
my_task
-
my_tool
-
read_file
-
run_query
-
save
-
save_contact
-
schedule_task
-
store_files
-
submit_form
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 44c0907 · analyzer v28 · 3d ago
skills & prompt files 13
- skill PrefectHQ-fastmcp-44c0907/.claude/skills/code-review/SKILL.md
- skill PrefectHQ-fastmcp-44c0907/.claude/skills/python-tests/SKILL.md
- skill PrefectHQ-fastmcp-44c0907/.claude/skills/review-issue/SKILL.md
- skill PrefectHQ-fastmcp-44c0907/.claude/skills/review-pr/SKILL.md
- agent-rules PrefectHQ-fastmcp-44c0907/.cursor/rules/core-mcp-objects.mdc
- agent-rules PrefectHQ-fastmcp-44c0907/CLAUDE.md
- agent-rules PrefectHQ-fastmcp-44c0907/docs/.cursor/rules/mintlify.mdc
- agent-rules PrefectHQ-fastmcp-44c0907/docs/integrations/gemini.mdx
- agent-rules PrefectHQ-fastmcp-44c0907/docs/v2/integrations/gemini.mdx
- agent-rules PrefectHQ-fastmcp-44c0907/docs/v3/integrations/gemini.mdx
- skill PrefectHQ-fastmcp-44c0907/examples/skills/sample_skills/code-review/SKILL.md
- skill PrefectHQ-fastmcp-44c0907/examples/skills/sample_skills/pdf-processing/SKILL.md
- skill PrefectHQ-fastmcp-44c0907/skills/fastmcp-client-cli/SKILL.md
danger signals7
- dynamic code execution __import__() PrefectHQ-fastmcp-44c0907/tests/docs/test_doc_examples.py :79
__import__(alias.name) - dynamic code execution eval()/exec() PrefectHQ-fastmcp-44c0907/tests/docs/test_upgrade_guide_equivalence.py :45
exec(compile(matches[0].source, str(path), "exec"), namespace) - dynamic code execution eval()/exec() PrefectHQ-fastmcp-44c0907/tests/docs/test_upgrade_guide_examples.py :101
exec(compile(example.source, str(example.path), "exec"), namespace) - dynamic code execution eval()/exec() PrefectHQ-fastmcp-44c0907/tests/experimental/transforms/test_code_mode.py :112
exec(wrapped, namespace, namespace) - dynamic code execution eval()/exec() PrefectHQ-fastmcp-44c0907/tests/experimental/transforms/test_code_mode_discovery.py :76
exec(wrapped, namespace, namespace) - dynamic code execution unsafe yaml.load() PrefectHQ-fastmcp-44c0907/tests/utilities/json_schema_type/test_real_world_schemas.py :204
spec = yaml.load(spec_file.read_text(), Loader=CSafeLoader) - suspicious endpoint 169.254.169.254 (cloud metadata) PrefectHQ-fastmcp-44c0907/tests/utilities/test_json_schema.py :1062
"evil": {"$ref": "http://169.254.169.254/latest/meta-data/"},
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 824
filesystem 43
- fs PrefectHQ-fastmcp-44c0907/fastmcp_remote/fastmcp_remote/cli.py :10
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/apps_dev.py :41
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/cimd.py :8
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/cli.py :11
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/client.py :7
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/discovery.py :14
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/generate.py :7
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/install/claude_code.py :3
import shutil - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/install/claude_desktop.py :5
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/install/cursor.py :5
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/install/gemini_cli.py :3
import shutil - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/install/goose.py :5
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/install/mcp_json.py :5
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/install/shared.py :8
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/install/stdio.py :6
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/run.py :12
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/client/auth/client_credentials.py :294
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/client/auth/oauth.py :400
webbrowser.open(authorization_url) - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/client/client.py :13
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/client/oauth_callback.py :266
webbrowser.open(f"http://localhost:{port}/callback?code=test123&state=xyz") - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/client/transports/inference.py :1
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/client/transports/stdio.py :4
import shutil - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/mcp_config.py :29
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/resources/types.py :6
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/providers/filesystem.py :19
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/providers/filesystem_discovery.py :17
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/providers/proxy.py :67
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/providers/skills/__init__.py :12
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/providers/skills/_common.py :8
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/providers/skills/claude_provider.py :5
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/providers/skills/directory_provider.py :6
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/providers/skills/skill_provider.py :8
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/providers/skills/vendor_providers.py :5
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/server.py :18
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/settings.py :5
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/utilities/cli.py :5
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/utilities/mcp_server_config/v1/environments/base.py :2
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/utilities/mcp_server_config/v1/environments/uv.py :1
import shutil - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/utilities/mcp_server_config/v1/mcp_server_config.py :13
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/utilities/mcp_server_config/v1/sources/filesystem.py :4
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/utilities/skills.py :8
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/utilities/types.py :9
from pathlib import Path - fs PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/utilities/version_check.py :7
from pathlib import Path
shell / exec 6
- shell PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/cli.py :8
import subprocess - shell PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/install/claude_code.py :4
import subprocess - shell PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/install/gemini_cli.py :4
import subprocess - shell PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/install/shared.py :6
import subprocess - shell PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/run.py :9
import subprocess - shell PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/utilities/mcp_server_config/v1/environments/uv.py :2
import subprocess
network 27
- net PrefectHQ-fastmcp-44c0907/fastmcp_remote/fastmcp_remote/cli.py :12
from urllib.parse import urlparse - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/apps_dev.py :43
from urllib.parse import urlencode - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/generate.py :9
from urllib.parse import urlparse - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/install/cursor.py :7
from urllib.parse import quote - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/install/goose.py :7
from urllib.parse import quote - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/cli/install/shared.py :9
from urllib.parse import urlparse - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/mcp_config.py :31
from urllib.parse import urlparse - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/resources/template.py :10
from urllib.parse import parse_qs, quote, unquote - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/auth/auth.py :5
from urllib.parse import urlparse - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/auth/cimd.py :27
from urllib.parse import urlparse - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/auth/handlers/authorize.py :18
from urllib.parse import parse_qs, urlparse - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/auth/identity_assertion.py :32
from urllib.parse import urlparse, urlunparse - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/auth/oauth_proxy/consent.py :17
from urllib.parse import urlparse - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/auth/oauth_proxy/models.py :10
from urllib.parse import urlparse - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/auth/oauth_proxy/proxy.py :30
from urllib.parse import urlencode - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/auth/providers/descope.py :11
from urllib.parse import urlparse - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/auth/redirect_validation.py :9
from urllib.parse import unquote, urlencode, urlparse, urlunparse - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/auth/ssrf.py :23
import socket - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/http.py :9
from urllib.parse import urlsplit - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/mixins/transport.py :5
import socket - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/providers/openapi/components.py :181
# httpx.AsyncClient cannot send an httpx2.Request). Primitive - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/providers/skills/skill_provider.py :10
from urllib.parse import quote, unquote - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/utilities/asgi_transport.py :1
"""An in-process, full-duplex HTTP transport for driving ASGI applications from httpx. - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/utilities/exceptions.py :16
import httpx - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/utilities/http.py :1
import socket - net PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/utilities/openapi/director.py :6
from urllib.parse import quote, urljoin - net PrefectHQ-fastmcp-44c0907/fastmcp_tasks/fastmcp_tasks/keys.py :20
from urllib.parse import quote, unquote
secrets 1
- secrets PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/auth/providers/oci.py :30
client_secret = os.environ.get("OCI_CLIENT_SECRET") # Client secret configured for the OCI IAM Domain Integrated Application
tool registrations 22
- save_contact PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/apps/app.py :20
- save PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/apps/app.py :216
- save PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/apps/app.py :219
- store_files PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/apps/file_upload.py :282
- list_files PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/apps/file_upload.py :297
- read_file PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/apps/file_upload.py :302
- submit_form PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/apps/form.py :150
- get_my_emails PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/auth/providers/azure.py :895
- my_task PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/context.py :233
- log_progress PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/dependencies.py :961
- introspect PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/dependencies.py :1005
- get_client_ip PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/dependencies.py :1048
- get_auth_type PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/dependencies.py :1086
- get_user_id PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/dependencies.py :1306
- add_expense PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/dependencies.py :1366
- my_tool PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/providers/local_provider/decorators/tools.py :273
- my_tool PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/server.py :1913
- custom_name PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/server/server.py :1917
- run_query PrefectHQ-fastmcp-44c0907/fastmcp_slim/fastmcp/types.py :15
- schedule_task PrefectHQ-fastmcp-44c0907/fastmcp_tasks/fastmcp_tasks/dependencies.py :122
- check_worker_status PrefectHQ-fastmcp-44c0907/fastmcp_tasks/fastmcp_tasks/dependencies.py :178
- crunch PrefectHQ-fastmcp-44c0907/fastmcp_tasks/fastmcp_tasks/extension.py :15
declared dependencies 2
- fastmcp@*
- python-dotenv@*
cursor-plugin 1
- opaque (low) PrefectHQ-fastmcp-44c0907/.cursor/rules/core-mcp-objects.mdc
bundled .cursor/ plugin descriptor (PrefectHQ-fastmcp-44c0907/.cursor/rules/core-mcp-objects.mdc) — presence-detected; review the descriptor
transport_posture 3
- binds all interfaces (0.0.0.0) PrefectHQ-fastmcp-44c0907/examples/auth/mounted/server.py :121
uvicorn.run(app, host="0.0.0.0", port=8000) - network-listening, binds all interfaces, no auth detected PrefectHQ-fastmcp-44c0907/examples/get_file.py :39
create_server().run(transport="sse", host="0.0.0.0", port=8001, path="/sse") - network-listening, binds all interfaces, no auth detected PrefectHQ-fastmcp-44c0907/tests/cli/test_run.py :491
str(test_file), transport="http", host="0.0.0.0", port=9000