MCP Observatory
2m ago Tracked 55,861 Last 2m ago 24h 2,736
github Python analyzed 283f2f5

cognis-digital/mcpscan

github

Scan MCP servers for RCE/SSRF/no-auth/tool-poisoning vulnerabilities

maintainer
cognis-digital
licence
NOASSERTION
first seen
2026-06-11
last seen
2026-08-19
releases · 30d
0
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged committed secret ×2, dynamic code execution ×2 in cognis-digital/mcpscan
  2. HIGH code analysis flagged committed secret ×2 in cognis-digital/mcpscan
  3. HIGH code analysis flagged dynamic code execution in cognis-digital/mcpscan
  4. HIGH code analysis flagged dynamic code execution ×2 in cognis-digital/mcpscan
  5. HIGH code analysis flagged committed secret, dynamic code execution ×2 in cognis-digital/mcpscan
  6. HIGH code analysis flagged committed secret, dynamic code execution ×2 in cognis-digital/mcpscan
  7. HIGH code analysis flagged committed secret, dynamic code execution ×2 in cognis-digital/mcpscan
capabilities 13 tools
transport stdio · streamable-http · http · sse counts 13 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • calc
  • cleanup
  • deploy
  • fetch_url
  • greet
  • load_state
  • mcpauth_demo
  • mcpauth_verify
  • proxy_call
  • read_note
  • run_shell
  • safe_echo
  • summarize
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 283f2f5 · analyzer v33 · 3w ago

danger signals11

code evidence vHEAD · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 110

filesystem 33

  • fs cognis-digital-mcpscan-283f2f5/demos/02-deep/vulnerable_agent_server.py :43 return open(filename).read()
  • fs cognis-digital-mcpscan-283f2f5/mcpauth/connect.py :76 text = sys.stdin.read() if a.input == "-" else open(a.input, encoding="utf-8").read()
  • fs cognis-digital-mcpscan-283f2f5/mcpauth/core.py :33 from pathlib import Path
  • fs cognis-digital-mcpscan-283f2f5/mcpharden/cli.py :88 with open(out, "w", encoding="utf-8") as fh:
  • fs cognis-digital-mcpscan-283f2f5/mcpharden/configaudit.py :146 with open(path, "r", encoding="utf-8") as fh:
  • fs cognis-digital-mcpscan-283f2f5/mcpharden/connect.py :73 text = sys.stdin.read() if a.input == "-" else open(a.input, encoding="utf-8").read()
  • fs cognis-digital-mcpscan-283f2f5/mcpharden/core.py :120 with open(path, "r", encoding="utf-8") as fh:
  • fs cognis-digital-mcpscan-283f2f5/mcppin/cli.py :20 from pathlib import Path
  • fs cognis-digital-mcpscan-283f2f5/mcppin/connect.py :74 text = sys.stdin.read() if a.input == "-" else open(a.input, encoding="utf-8").read()
  • fs cognis-digital-mcpscan-283f2f5/mcppin/core.py :89 with open(self.path, encoding="utf-8") as handle:
  • fs cognis-digital-mcpscan-283f2f5/mcpscan/authz.py :33 from pathlib import Path
  • fs cognis-digital-mcpscan-283f2f5/mcpscan/cli.py :102 with open(out_path, "w", encoding="utf-8") as fh:
show 21 more
  • fs cognis-digital-mcpscan-283f2f5/mcpscan/connect.py :73 text = sys.stdin.read() if a.input == "-" else open(a.input, encoding="utf-8").read()
  • fs cognis-digital-mcpscan-283f2f5/mcpscan/core.py :43 from pathlib import Path
  • fs cognis-digital-mcpscan-283f2f5/mcpscan/supplychain.py :44 from pathlib import Path
  • fs cognis-digital-mcpscan-283f2f5/promptmirror/cli.py :26 with open(path, "r", encoding="utf-8") as fh:
  • fs cognis-digital-mcpscan-283f2f5/promptmirror/connect.py :78 text = sys.stdin.read() if a.input == "-" else open(a.input, encoding="utf-8").read()
  • fs (weak) cognis-digital-mcpscan-283f2f5/promptmirror/tests/test_deep.py :150 with open(POISONED, encoding="utf-8") as fh:
  • fs (weak) cognis-digital-mcpscan-283f2f5/qa/mcpharden/tests/test_deep.py :102 with open(p, "w", encoding="utf-8") as fh:
  • fs (weak) cognis-digital-mcpscan-283f2f5/qa/mcpharden/tests/test_posture.py :470 with open(os.path.join(d, "good.json"), "w") as fh:
  • fs (weak) cognis-digital-mcpscan-283f2f5/qa/mcpharden/tests/test_smoke.py :22 with open(path, "w", encoding="utf-8") as fh:
  • fs (weak) cognis-digital-mcpscan-283f2f5/qa/mcppin/tests/test_core.py :97 with open(path, encoding="utf-8") as handle:
  • fs (weak) cognis-digital-mcpscan-283f2f5/qa/trustgate/demos/01-basic/run_demo.py :17 import shutil
  • fs (weak) cognis-digital-mcpscan-283f2f5/qa/trustgate/tests/test_deep.py :9 from pathlib import Path
  • fs (weak) cognis-digital-mcpscan-283f2f5/qa/trustgate/tests/test_deep_v2.py :13 from pathlib import Path
  • fs (weak) cognis-digital-mcpscan-283f2f5/qa/trustgate/tests/test_smoke.py :9 from pathlib import Path
  • fs cognis-digital-mcpscan-283f2f5/ssrfmcp/connect.py :73 text = sys.stdin.read() if a.input == "-" else open(a.input, encoding="utf-8").read()
  • fs (weak) cognis-digital-mcpscan-283f2f5/tests/test_supplychain.py :12 from pathlib import Path
  • fs (weak) cognis-digital-mcpscan-283f2f5/tests/test_v2.py :51 _rules("def f(name):\n return open(name).read()\n"))
  • fs (weak) cognis-digital-mcpscan-283f2f5/tests/test_v3.py :35 with open(os.path.join(CFG_DIR, name), encoding="utf-8") as fh:
  • fs cognis-digital-mcpscan-283f2f5/trustgate/cli.py :124 with open(out_path, "w", encoding="utf-8") as fh:
  • fs cognis-digital-mcpscan-283f2f5/trustgate/connect.py :73 text = sys.stdin.read() if a.input == "-" else open(a.input, encoding="utf-8").read()
  • fs cognis-digital-mcpscan-283f2f5/trustgate/core.py :18 folder open (VS Code runOptions.runOn, tasks, devcontainer

shell / exec 15

  • shell cognis-digital-mcpscan-283f2f5/demos/01-basic/vulnerable_mcp_server.py :8 import subprocess
  • shell cognis-digital-mcpscan-283f2f5/demos/02-deep/vulnerable_agent_server.py :12 import subprocess
  • shell cognis-digital-mcpscan-283f2f5/demos/03-config/clean_server.py :8 import subprocess
  • shell cognis-digital-mcpscan-283f2f5/demos/03-config/shell_tool_server.py :8 import subprocess
  • shell cognis-digital-mcpscan-283f2f5/mcpscan/core.py :708 + x; os.system(cmd)` is caught even though no sink and source share a line.
  • shell (weak) cognis-digital-mcpscan-283f2f5/qa/mcpauth/tests/test_smoke.py :5 import subprocess
  • shell (weak) cognis-digital-mcpscan-283f2f5/qa/mcpharden/tests/test_smoke.py :5 import subprocess
  • shell (weak) cognis-digital-mcpscan-283f2f5/qa/ssrfmcp/tests/test_smoke.py :5 import subprocess
  • shell (weak) cognis-digital-mcpscan-283f2f5/qa/trustgate/tests/test_deep.py :5 import subprocess
  • shell (weak) cognis-digital-mcpscan-283f2f5/qa/trustgate/tests/test_deep_v2.py :9 import subprocess
  • shell (weak) cognis-digital-mcpscan-283f2f5/qa/trustgate/tests/test_smoke.py :5 import subprocess
  • shell (weak) cognis-digital-mcpscan-283f2f5/tests/test_agentic.py :60 src.write_text("import os\n\ndef run(cmd):\n os.system(cmd)\n", encoding="utf-8")
show 3 more
  • shell (weak) cognis-digital-mcpscan-283f2f5/tests/test_smoke.py :5 import subprocess
  • shell (weak) cognis-digital-mcpscan-283f2f5/tests/test_v2.py :89 " os.system(cmd)\n")
  • shell (weak) cognis-digital-mcpscan-283f2f5/tests/test_v3.py :153 src = ("import subprocess\n"

network 17

  • net cognis-digital-mcpscan-283f2f5/demos/01-basic/vulnerable_mcp_server.py :40 import urllib.request
  • net cognis-digital-mcpscan-283f2f5/demos/02-deep/vulnerable_agent_server.py :14 import requests
  • net cognis-digital-mcpscan-283f2f5/livesearch.py :28 import urllib.parse
  • net cognis-digital-mcpscan-283f2f5/mcpauth/core.py :25 import socket
  • net cognis-digital-mcpscan-283f2f5/mcpscan/ai_backend.py :43 import urllib.error
  • net cognis-digital-mcpscan-283f2f5/mcpscan/authz.py :29 import socket
  • net cognis-digital-mcpscan-283f2f5/mcpscan/core.py :38 import socket
  • net cognis-digital-mcpscan-283f2f5/mcpscan/supplychain.py :41 import urllib.error
  • net (weak) cognis-digital-mcpscan-283f2f5/qa/mcpauth/tests/test_deep.py :9 import urllib.error
  • net (weak) cognis-digital-mcpscan-283f2f5/qa/ssrfmcp/tests/test_deep.py :107 import urllib.request
  • net cognis-digital-mcpscan-283f2f5/ssrfmcp/ai_backend.py :38 import urllib.error
  • net cognis-digital-mcpscan-283f2f5/ssrfmcp/core.py :30 import socket
show 5 more
  • net cognis-digital-mcpscan-283f2f5/ssrfmcp/mockserver.py :18 import socket
  • net (weak) cognis-digital-mcpscan-283f2f5/tests/test_smoke.py :42 src = ("import requests\ndef f(u):\n return requests.get(u)\n")
  • net (weak) cognis-digital-mcpscan-283f2f5/tests/test_supplychain.py :574 monkeypatch.setattr(sc.urllib.request, "urlopen", _boom)
  • net (weak) cognis-digital-mcpscan-283f2f5/tests/test_v2.py :58 src = ("import requests\n"
  • net cognis-digital-mcpscan-283f2f5/trustgate/ai_backend.py :41 import urllib.error

secrets 3

  • secrets cognis-digital-mcpscan-283f2f5/mcpscan/ai_backend.py :116 self.api_key = api_key or os.environ.get("COGNIS_AI_KEY") or None
  • secrets cognis-digital-mcpscan-283f2f5/ssrfmcp/ai_backend.py :111 self.api_key = api_key or os.environ.get("COGNIS_AI_KEY") or None
  • secrets cognis-digital-mcpscan-283f2f5/trustgate/ai_backend.py :114 self.api_key = api_key or os.environ.get("COGNIS_AI_KEY") or None

tool registrations 14

  • run_shell cognis-digital-mcpscan-283f2f5/demos/01-basic/vulnerable_mcp_server.py :15
  • calc cognis-digital-mcpscan-283f2f5/demos/01-basic/vulnerable_mcp_server.py :22
  • cleanup cognis-digital-mcpscan-283f2f5/demos/01-basic/vulnerable_mcp_server.py :29
  • fetch_url cognis-digital-mcpscan-283f2f5/demos/01-basic/vulnerable_mcp_server.py :37
  • summarize cognis-digital-mcpscan-283f2f5/demos/01-basic/vulnerable_mcp_server.py :45
  • safe_echo cognis-digital-mcpscan-283f2f5/demos/01-basic/vulnerable_mcp_server.py :53
  • load_state cognis-digital-mcpscan-283f2f5/demos/02-deep/vulnerable_agent_server.py :25
  • greet cognis-digital-mcpscan-283f2f5/demos/02-deep/vulnerable_agent_server.py :32
  • read_note cognis-digital-mcpscan-283f2f5/demos/02-deep/vulnerable_agent_server.py :39
  • proxy_call cognis-digital-mcpscan-283f2f5/demos/02-deep/vulnerable_agent_server.py :46
  • deploy cognis-digital-mcpscan-283f2f5/demos/02-deep/vulnerable_agent_server.py :56
  • safe_echo cognis-digital-mcpscan-283f2f5/demos/02-deep/vulnerable_agent_server.py :66
show 2 more
  • mcpauth_verify cognis-digital-mcpscan-283f2f5/mcpauth/mcp_server.py :53
  • mcpauth_demo cognis-digital-mcpscan-283f2f5/mcpauth/mcp_server.py :67

declared dependencies 4

  • mcp@>=1.0
  • cognis-connect@@ git+https://github.com/cognis-digital/cognis-connect.git
  • pytest@>=8.0
  • serde_json@1

cursor-plugin 1

  • opaque (low) cognis-digital-mcpscan-283f2f5/qa/trustgate/demos/01-basic/sample-project/.cursor/mcp.json bundled .cursor/ plugin descriptor (cognis-digital-mcpscan-283f2f5/qa/trustgate/demos/01-basic/sample-project/.cursor/mcp.json) — presence-detected; review the descriptor

transport_posture 3

  • network-listening, binds all interfaces, no auth detected cognis-digital-mcpscan-283f2f5/demos/01-basic/vulnerable_mcp_server.py :61 app.run(transport="streamable-http", host="0.0.0.0", port=8080)
  • binds all interfaces (0.0.0.0) cognis-digital-mcpscan-283f2f5/demos/02-deep/vulnerable_agent_server.py :73 app.run(transport="streamable-http", host="0.0.0.0", port=8080)
  • binds all interfaces (0.0.0.0) cognis-digital-mcpscan-283f2f5/tests/test_v3.py :92 src = "def serve():\n server = HTTPServer(host='0.0.0.0', port=80)\n"