github Python re-analysis due deep scan unknown

cuga-project/cuga-agent

v0.3.2
github

CUGA is an open-source generalist agent harness for the enterprise, supporting complex task execution on web and APIs, OpenAPI/MCP integrations, composable architecture, reasoning modes, and policy-aware features.

maintainer
cuga-project
licence
NOASSERTION
first seen
2026-06-01
last seen
2026-09-10
releases · 30d
2
short id

cuga-project/cuga-agent is an MCP server distributed on github, maintained by cuga-project, tracked here since June 2026. It has shipped 64 releases (currently 0.3.2) and exposes 14 tools. Tools include delete_knowledge_document, fetch_doc_page, filter_grep, get_ingestion_status, get_knowledge_status, ingest_knowledge, and 8 more. Its composite risk grade is E — an inferred review prompt computed from observed signals, not a verdict.

what we found

Reading the source raised 3 review prompts — dangerous code, tool shadowing and toxic flow (lethal trifecta) — each a pattern worth a human look rather than a finding of fault.

Its 14 tools appear to reach filesystem, shell / exec, network, secrets, database and untrusted content, inferred from tool names, descriptions and input schemas rather than from observed behaviour.

full security breakdown →
tools 14
  • delete_knowledge_document
  • fetch_doc_page
  • filter_grep
  • get_ingestion_status
  • get_knowledge_status
  • ingest_knowledge
  • ingest_knowledge_url
  • list_emails
  • list_knowledge_documents
  • perform_ui_task
  • read_email
  • search_doc
  • search_knowledge
  • send_email
release cadence · 90d 6 releases
06-13 00:00 07-27 00:00 now
recent releases last 10
version date src
v0.3.2 2026-08-20 github
0.3.2 2026-08-20 pypi
v0.3.1 2026-08-03 github
0.3.1 2026-08-03 pypi
v0.3.0 2026-06-30 github
0.3.0 2026-06-30 pypi
v0.2.28 2026-05-10 github
0.2.28 2026-05-10 pypi
0.2.27 2026-04-30 pypi
0.2.26 2026-04-29 pypi

view all →