github Python re-analysis due

alpacax/alpacon-mcp

v1.13.0

AI-Powered Server Management - Connect Claude, Cursor, and other AI tools directly to your Alpacon infrastructure

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio · streamable-http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 4e7892d · analyzer v33 · 4d ago

dynamic code execution eval()/exec() alpacax-alpacon-mcp-4e7892d/tests/test_input_validation.py :44 exec(func_code, namespace) # noqa: S102
dynamic code execution eval()/exec() alpacax-alpacon-mcp-4e7892d/tools/resources.py :38 exec(compile(src, __file__, 'exec'), ns) # noqa: S102

code evidence v1.11.0 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 86

fs alpacax-alpacon-mcp-4e7892d/main.py :3 from pathlib import Path
fs (weak) alpacax-alpacon-mcp-4e7892d/tests/test_alert_tools.py :5 from pathlib import Path
fs (weak) alpacax-alpacon-mcp-4e7892d/tests/test_input_validation.py :4 from pathlib import Path
fs (weak) alpacax-alpacon-mcp-4e7892d/tests/test_simple_integration.py :10 from pathlib import Path
fs (weak) alpacax-alpacon-mcp-4e7892d/tests/test_toolsets.py :7 from pathlib import Path
fs (weak) alpacax-alpacon-mcp-4e7892d/tests/test_webftp_tools.py :10 from pathlib import Path
fs alpacax-alpacon-mcp-4e7892d/tools/webftp_tools.py :9 from pathlib import Path
fs alpacax-alpacon-mcp-4e7892d/utils/logger.py :8 from pathlib import Path
fs alpacax-alpacon-mcp-4e7892d/utils/setup_wizard.py :13 from pathlib import Path
fs alpacax-alpacon-mcp-4e7892d/utils/token_manager.py :5 from pathlib import Path

net alpacax-alpacon-mcp-4e7892d/server.py :8 from urllib.parse import urlparse
net (weak) alpacax-alpacon-mcp-4e7892d/tests/integration/__init__.py :3 These tests use httpx.MockTransport to inject mock HTTP responses at the
net (weak) alpacax-alpacon-mcp-4e7892d/tests/integration/conftest.py :10 import httpx
net (weak) alpacax-alpacon-mcp-4e7892d/tests/integration/test_decorator_chain.py :21 import httpx
net (weak) alpacax-alpacon-mcp-4e7892d/tests/integration/test_error_scenarios.py :10 import httpx
net (weak) alpacax-alpacon-mcp-4e7892d/tests/integration/test_http_client_integration.py :11 import httpx
net (weak) alpacax-alpacon-mcp-4e7892d/tests/integration/test_tool_end_to_end.py :11 import httpx
net (weak) alpacax-alpacon-mcp-4e7892d/tests/test_auth.py :14 import httpx
net (weak) alpacax-alpacon-mcp-4e7892d/tests/test_http_client.py :13 import httpx
net (weak) alpacax-alpacon-mcp-4e7892d/tests/test_mfa_precheck.py :305 # httpx.Response methods (json, raise_for_status) are sync
net (weak) alpacax-alpacon-mcp-4e7892d/tests/test_oauth.py :18 from urllib.parse import parse_qs, urlparse
net (weak) alpacax-alpacon-mcp-4e7892d/tests/test_webftp_tools.py :41 with patch('httpx.AsyncClient') as mock_client_class:

show 5 more

net alpacax-alpacon-mcp-4e7892d/tools/webftp_tools.py :12 import httpx
net alpacax-alpacon-mcp-4e7892d/utils/auth.py :9 import httpx
net alpacax-alpacon-mcp-4e7892d/utils/http_client.py :7 from urllib.parse import urljoin
net alpacax-alpacon-mcp-4e7892d/utils/oauth.py :23 from urllib.parse import parse_qs, urlencode, urlparse, urlunparse
net alpacax-alpacon-mcp-4e7892d/utils/security_settings.py :15 import httpx

secrets alpacax-alpacon-mcp-4e7892d/utils/oauth.py :370 client_secret = os.getenv('AUTH0_CLIENT_SECRET', '')
secrets alpacax-alpacon-mcp-4e7892d/utils/setup_wizard.py :12 from getpass import getpass