MCP server connecting AI assistants to Redmine: issues, projects, wikis, time tracking, agile boards, and CRM, with OAuth2 multi-user support
Drift inferred · capture-to-capture
- HIGH code analysis flagged dynamic code execution in jztan/redmine-mcp-server
transport stdio · http counts 41 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
copy_issue
-
create_checklist_item
-
create_redmine_issue
-
delete_file
-
delete_redmine_issue
-
get_checklist
-
get_current_user
-
get_gantt_chart
-
get_mcp_server_info
-
get_private_notes
-
get_project_dashboard_data
-
get_project_modules
-
get_redmine_attachment
-
get_redmine_issue
-
get_triage_board_data
-
import_time_entries
-
list_files
-
list_project_issue_custom_fields
-
list_project_members
-
list_project_trackers
-
list_redmine_issue_priorities
-
list_redmine_issue_statuses
-
list_redmine_issues
-
list_redmine_projects
-
list_redmine_queries
-
list_redmine_roles
-
list_redmine_trackers
-
list_redmine_users
-
list_redmine_versions
-
list_subtasks
-
list_time_entries
-
list_time_entry_activities
-
manage_contact
-
manage_document
-
manage_product
-
search_entire_redmine
-
search_redmine_issues
-
summarize_project_status
-
update_checklist_item
-
update_redmine_issue
-
upload_file
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 980c78b · analyzer v28 · 1h ago
danger signals2
- dynamic code execution __import__() jztan-redmine-mcp-server-980c78b/tests/run_tests.py :100
__import__(package.replace("-", "_")) - suspicious endpoint 169.254.169.254 (cloud metadata) jztan-redmine-mcp-server-980c78b/tests/test_security_hardening.py :194
source_url="http://169.254.169.254/latest/meta-data/iam/",
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 121
filesystem 5
- fs jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/_client.py :21
from pathlib import Path - fs jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/_env.py :4
from pathlib import Path - fs jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/_http_routes.py :17
from pathlib import Path - fs jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/file_manager.py :5
from pathlib import Path - fs jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/files.py :12
from pathlib import Path
network 7
- net jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/_auth.py :28
import httpx - net jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/_errors.py :17
from requests.exceptions import ( - net jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/_http_routes.py :20
import httpx - net jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/_mount.py :6
from urllib.parse import urlparse - net jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/_serialization.py :7
from urllib.parse import urlsplit, urlunsplit - net jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/_ssrf.py :11
import socket - net jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/meta.py :55
import httpx
secrets 1
- secrets jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/_client.py :52
REDMINE_PASSWORD = os.getenv("REDMINE_PASSWORD")
tool registrations 41
- get_project_dashboard_data jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/apps/project_dashboard.py :281
- get_triage_board_data jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/apps/triage_board.py :145
- get_checklist jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/checklists.py :81
- update_checklist_item jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/checklists.py :123
- create_checklist_item jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/checklists.py :194
- manage_contact jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/contacts.py :397
- manage_document jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/documents.py :552
- list_redmine_trackers jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/enumeration.py :18
- list_redmine_issue_statuses jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/enumeration.py :52
- list_redmine_issue_priorities jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/enumeration.py :88
- list_redmine_users jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/enumeration.py :127
- get_current_user jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/enumeration.py :180
- list_redmine_queries jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/enumeration.py :214
- get_redmine_attachment jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/files.py :270
- list_files jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/files.py :493
- upload_file jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/files.py :542
- delete_file jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/files.py :674
- get_gantt_chart jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/gantt.py :73
- get_redmine_issue jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/issues.py :694
- list_redmine_issues jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/issues.py :837
- search_redmine_issues jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/issues.py :1075
- create_redmine_issue jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/issues.py :1274
- update_redmine_issue jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/issues.py :1475
- copy_issue jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/issues.py :1744
- list_subtasks jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/issues.py :1947
- delete_redmine_issue jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/issues.py :1980
- get_private_notes jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/issues.py :2304
- get_mcp_server_info jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/meta.py :88
- manage_product jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/products.py :259
- list_redmine_projects jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/projects.py :205
- list_project_issue_custom_fields jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/projects.py :228
- list_redmine_versions jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/projects.py :314
- summarize_project_status jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/projects.py :524
- list_project_members jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/projects.py :617
- list_redmine_roles jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/projects.py :661
- get_project_modules jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/projects.py :696
- list_project_trackers jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/projects.py :906
- search_entire_redmine jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/search.py :94
- list_time_entries jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/time_tracking.py :55
- list_time_entry_activities jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/time_tracking.py :251
- import_time_entries jztan-redmine-mcp-server-980c78b/src/redmine_mcp_server/tools/time_tracking.py :342
declared dependencies 15
- fastmcp@>=3.0.0,<4
- python-dotenv@>=1.0.0,<2
- httpx@>=0.27.0,<1
- python-redmine@>=2.5.0,<3
- starlette@>=1.3.1,<2
- uvicorn@>=0.24.0,<1
- python-multipart@>=0.0.30,<1
- urllib3@>=2.7.0,<3
- pytest@>=7.0.0,<10
- pytest-asyncio@>=0.21.0,<2
- pytest-cov@>=4.0.0,<8
- pytest-mock@>=3.10.0,<4
- flake8@>=6.0.0,<8
- black@>=23.0.0,<27
- pre-commit@>=3.0.0,<5