Client-neutral MCP server and secure desktop Control Center for Windows/Linux computer automation, with OAuth/Bearer auth, scoped access, UI/browser control, audit logging, and remote HTTPS support.
C elevated
- capability exposure inferred + 35
- recent drift inferred + 12
- tool safety inferred + 12
inferred
The A–E grade is our heuristic synthesis — a "review this" prompt, not a verdict. Each factor is tagged by what backs it: attested (a verifiable record), reported (a third party's claim), or inferred (our own heuristic, e.g. permissions). See methodology.
grade last moved 5d ago · see ecosystem CVEs →
Inferred surface — each links to servers holding it:
No known CVEs for this server.
- high dangerous code
dynamic exec: eval()/exec(), __import__(), marshal.loads(), pickle.loads()
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 6658923 · analyzer v33 · 5d ago
danger signals60
- dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/_pyrepl/console.py :181
exec(code, self.locals) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/_pyrepl/main.py :47
exec(startup_code, namespace) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/asyncio/__main__.py :103
exec(startup_code, console.locals) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/bdb.py :680
exec(cmd, globals, locals) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/cProfile.py :104
exec(cmd, globals, locals) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/code.py :92
exec(code, self.locals) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/collections/__init__.py :444
__new__ = eval(code, namespace) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/dataclasses.py :498
exec(txt, self.globals, ns) - dynamic code execution __import__() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/dbm/__init__.py :68
mod = __import__(name, fromlist=['open']) - dynamic code execution __import__() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/doctest.py :227
return __import__(module, globals(), locals(), ["*"]) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/doctest.py :1398
exec(compile(example.source, filename, "single", - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/idlelib/autocomplete.py :185
bigl = eval("dir()", namespace) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/idlelib/calltip.py :140
return eval(expression, namespace) # Only protect user code. - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/idlelib/debugobj.py :37
value = eval(text) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/idlelib/idle_test/test_run.py :55
eval(compile(code, '', 'eval')) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/idlelib/idle_test/test_squeezer.py :134
text = eval(text_code) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/idlelib/pyshell.py :282
breakpoint_linenumbers = eval(line[len(filename)+1:]) - dynamic code execution marshal.loads() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/idlelib/rpc.py :47
co = marshal.loads(ms) - dynamic code execution pickle.loads() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/idlelib/rpc.py :388
message = pickle.loads(packet) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/idlelib/run.py :644
exec(code, self.locals) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/importlib/_bootstrap.py :1176
exec(code, module.__dict__) - dynamic code execution __import__() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/importlib/_bootstrap.py :1462
def __import__(name, globals=None, locals=None, fromlist=(), level=0): - dynamic code execution marshal.loads() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/importlib/_bootstrap_external.py :781
code = marshal.loads(data) - dynamic code execution __import__() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/importlib/util.py :91
parent = __import__(parent_name, fromlist=['__path__']) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/inspect.py :294
else eval(_rewrite_star_unpack(value), globals, locals) - dynamic code execution __import__() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/logging/config.py :99
found = __import__(used) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/logging/config.py :133
defaults = eval(defaults, vars(logging)) - dynamic code execution marshal.loads() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/modulefinder.py :345
co = marshal.loads(memoryview(data)[16:]) - dynamic code execution __import__() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/multiprocessing/forkserver.py :196
__import__(modname) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/multiprocessing/sharedctypes.py :153
exec(template % ((name,)*7), d) - dynamic code execution __import__() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/optparse.py :873
__import__(modname) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/optparse.py :879
exec(open(filename).read(), vars) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/pdb.py :725
exec(source_with_closure, {}, ns) - dynamic code execution __import__() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/pickle.py :1077
__import__(module_name, level=0) - dynamic code execution __import__() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/pkgutil.py :78
__import__(info.name) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/profile.py :425
exec(cmd, globals, locals) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/pydoc.py :2071
doc(eval(request), 'Help on %s:', output=self._output, is_cli=is_cli) - dynamic code execution __import__() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/pydoc.py :2246
name = __import__(modname).__doc__ or '' - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/pydoc_data/topics.py :9045
The class body is executed (approximately) as "exec(body, globals(), - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/rlcompleter.py :158
thisobject = eval(expr, self.namespace) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/runpy.py :88
exec(code, run_globals) - dynamic code execution __import__() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/runpy.py :114
__import__(pkg_name) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/site.py :207
exec(line) - dynamic code execution __import__() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/sysconfig/__init__.py :361
_temp = __import__(name, globals(), locals(), ['build_time_vars'], 0) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/timeit.py :136
exec(code, global_ns, local_ns) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/tkinter/__init__.py :2553
exec('from tkinter import *', dir) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/trace.py :456
exec(cmd, globals, locals) - dynamic code execution __import__() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/traceback.py :1516
mod = __import__(exc_value.name) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/turtle.py :182
value = eval(value) - dynamic code execution __import__() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/turtle.py :3927
module = __import__(modname) - dynamic code execution __import__() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/turtledemo/__main__.py :336
__import__(modname) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/typing.py :1077
eval(self.__forward_code__, globalns, localns), - dynamic code execution __import__() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/unittest/loader.py :141
module = __import__(module_name) - dynamic code execution __import__() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/unittest/main.py :72
self.module = __import__(module) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/unittest/mock.py :204
exec (src, context) - dynamic code execution __import__() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/warnings.py :267
m = __import__(module, None, None, [klass]) - dynamic code execution __import__() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/xml/dom/domreg.py :56
mod = __import__(mod, {}, {}, ['getDOMImplementation']) - dynamic code execution __import__() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/xml/sax/__init__.py :93
drv_module = __import__(parser_name,{},{},['create_parser']) - dynamic code execution eval()/exec() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/zipimport.py :243
exec(code, mod.__dict__) - dynamic code execution marshal.loads() TNLegend-PortaMCP-6658923/runtime/python-bootstrap.zip!/Lib/zipimport.py :701
code = marshal.loads(data[16:])
- recent drift +12 capability drift →
[](https://mcpobservatory.com/servers/github:TNLegend/PortaMCP/security) Heuristic, inferred signals — false positives (legitimately powerful tools, forks, language ports) are expected. Treat each as "review this", not a verdict. See the ecosystem-wide picture on the security hub, or the fleet security of TNLegend.