Least-privilege governance for ERPNext — the credential floor + a governed agent broker, MCP · A2A · API, one spine. No debit without a credit: PLAN · CONSENT · PROVE · UNDO.
Drift inferred · capture-to-capture
- HIGH code analysis flagged dynamic code execution in john-broadway/pacioli
transport stdio · streamable-http · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 10b45ce · analyzer v28 · 1d ago
danger signals1
- dynamic code execution eval()/exec() john-broadway-pacioli-10b45ce/guard/pacioli_guard/tests/test_act.py :383
exec(compile( # noqa: S102 — building a frame double, not evaluating input
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 108
filesystem 11
- fs john-broadway-pacioli-10b45ce/broker/pacioli/a2a.py :54
from pathlib import Path - fs john-broadway-pacioli-10b45ce/broker/pacioli/cli.py :1122
from pathlib import Path - fs john-broadway-pacioli-10b45ce/broker/pacioli/consent.py :14
window a verify-now/consume-later design leaves open (two concurrent submits both passing the gate). - fs john-broadway-pacioli-10b45ce/broker/pacioli/doctor.py :33
from pathlib import Path - fs john-broadway-pacioli-10b45ce/broker/pacioli/erpnext.py :10539
with _OPENER.open(req, timeout=timeout) as resp: # noqa: S310 — scheme validated by registry - fs john-broadway-pacioli-10b45ce/broker/pacioli/reconcile.py :337
# second act. The intent stays open (only "committed" finalizes, like the rest of the spine). - fs john-broadway-pacioli-10b45ce/broker/pacioli/registry.py :174
with open(path, "rb") as f: - fs john-broadway-pacioli-10b45ce/broker/pacioli/runtime.py :24
from pathlib import Path - fs john-broadway-pacioli-10b45ce/broker/pacioli/server.py :81
reader = read_file or (lambda p: open(p, encoding="utf-8").read()) - fs john-broadway-pacioli-10b45ce/broker/pacioli/store.py :54
from pathlib import Path - fs john-broadway-pacioli-10b45ce/broker/pacioli/tools.py :7962
# A torn/sub-header store file caught at open (refuse_if_torn). On the agent-facing
network 6
- net john-broadway-pacioli-10b45ce/broker/pacioli/a2a.py :403
from urllib.parse import urlparse - net john-broadway-pacioli-10b45ce/broker/pacioli/doctor.py :32
import urllib.parse - net john-broadway-pacioli-10b45ce/broker/pacioli/erpnext.py :7069
import urllib.error - net john-broadway-pacioli-10b45ce/broker/pacioli/registry.py :23
from urllib.parse import urlparse - net john-broadway-pacioli-10b45ce/broker/pacioli/webguard.py :50
from urllib.parse import urlparse - net john-broadway-pacioli-10b45ce/guard/pacioli_guard/scope.py :18
from urllib.parse import unquote
database 3
- db john-broadway-pacioli-10b45ce/broker/pacioli/runtime.py :94
import sqlite3 - db john-broadway-pacioli-10b45ce/broker/pacioli/store.py :51
import sqlite3 - db john-broadway-pacioli-10b45ce/broker/pacioli/tools.py :1922
import sqlite3
declared dependencies 1
- mcp@>=1.0