MCP Observatory
2m ago Tracked 59,469 Last 2m ago 24h 2,466
github Python re-analysis due

yatuk/mcpradar

github

Security scanner for Model Context Protocol servers. Catch tool poisoning, prompt injection, and supply-chain attacks before your AI agent runs them.

maintainer
yatuk
licence
MIT
first seen
2026-06-23
last seen
2026-09-17
releases · 30d
0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio · streamable-http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 3531afc · analyzer v33 · 1d ago

skills & prompt files 24

danger signals4

code evidence vHEAD · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 160

filesystem 58

  • fs (weak) yatuk-mcpradar-3531afc/docs/leaderboard/generate.py :11 from pathlib import Path
  • fs (weak) yatuk-mcpradar-3531afc/scripts/batch_results.py :11 from pathlib import Path
  • fs (weak) yatuk-mcpradar-3531afc/scripts/batch_scan.py :6 from pathlib import Path
  • fs (weak) yatuk-mcpradar-3531afc/scripts/check_coverage.py :7 from pathlib import Path
  • fs (weak) yatuk-mcpradar-3531afc/scripts/generate_rule_docs.py :3 from pathlib import Path
  • fs yatuk-mcpradar-3531afc/src/mcpradar/audit/auditor.py :9 from pathlib import Path
  • fs yatuk-mcpradar-3531afc/src/mcpradar/cli.py :8 from pathlib import Path
  • fs yatuk-mcpradar-3531afc/src/mcpradar/config.py :7 from pathlib import Path
  • fs yatuk-mcpradar-3531afc/src/mcpradar/config_scan/scanner.py :19 from pathlib import Path
  • fs yatuk-mcpradar-3531afc/src/mcpradar/cvefeed/syncer.py :9 from pathlib import Path
  • fs yatuk-mcpradar-3531afc/src/mcpradar/enrich.py :12 import shutil
  • fs yatuk-mcpradar-3531afc/src/mcpradar/fetch/fetcher.py :15 import shutil
show 28 more
  • fs yatuk-mcpradar-3531afc/src/mcpradar/init/initializer.py :5 from pathlib import Path
  • fs yatuk-mcpradar-3531afc/src/mcpradar/leaderboard/generator.py :10 from pathlib import Path
  • fs yatuk-mcpradar-3531afc/src/mcpradar/output/sarif.py :6 from pathlib import Path
  • fs yatuk-mcpradar-3531afc/src/mcpradar/output/sbom.py :13 from pathlib import Path
  • fs yatuk-mcpradar-3531afc/src/mcpradar/plugin/manager.py :8 import shutil
  • fs yatuk-mcpradar-3531afc/src/mcpradar/plugin/runtime.py :10 from pathlib import Path
  • fs yatuk-mcpradar-3531afc/src/mcpradar/plugin/scaffolder.py :5 import shutil
  • fs yatuk-mcpradar-3531afc/src/mcpradar/plugin/validator.py :10 from pathlib import Path
  • fs yatuk-mcpradar-3531afc/src/mcpradar/plugin/worker.py :8 from pathlib import Path
  • fs yatuk-mcpradar-3531afc/src/mcpradar/policy/engine.py :8 from pathlib import Path
  • fs yatuk-mcpradar-3531afc/src/mcpradar/registry/client.py :9 from pathlib import Path
  • fs (weak) yatuk-mcpradar-3531afc/src/mcpradar/sandbox/container.py :20 import shutil
  • fs yatuk-mcpradar-3531afc/src/mcpradar/snapshot/signing.py :9 from pathlib import Path
  • fs yatuk-mcpradar-3531afc/src/mcpradar/source/analyzer.py :25 from pathlib import Path
  • fs yatuk-mcpradar-3531afc/src/mcpradar/source/javascript.py :7 import shutil
  • fs yatuk-mcpradar-3531afc/src/mcpradar/storage/store.py :8 from pathlib import Path
  • fs yatuk-mcpradar-3531afc/src/mcpradar/supply/deps.py :15 from pathlib import Path
  • fs (weak) yatuk-mcpradar-3531afc/tests/test_audit.py :7 from pathlib import Path
  • fs (weak) yatuk-mcpradar-3531afc/tests/test_benchmark.py :5 from pathlib import Path
  • fs (weak) yatuk-mcpradar-3531afc/tests/test_cli.py :7 from pathlib import Path
  • fs (weak) yatuk-mcpradar-3531afc/tests/test_config.py :4 from pathlib import Path
  • fs (weak) yatuk-mcpradar-3531afc/tests/test_config_scan.py :6 from pathlib import Path
  • fs (weak) yatuk-mcpradar-3531afc/tests/test_coverage_gate.py :6 from pathlib import Path
  • fs (weak) yatuk-mcpradar-3531afc/tests/test_enrich.py :5 from pathlib import Path
  • fs (weak) yatuk-mcpradar-3531afc/tests/test_fetch.py :11 from pathlib import Path
  • fs (weak) yatuk-mcpradar-3531afc/tests/test_fuzz_boundaries.py :6 from pathlib import Path
  • fs (weak) yatuk-mcpradar-3531afc/tests/test_javascript_analyzer.py :5 from pathlib import Path
  • fs (weak) yatuk-mcpradar-3531afc/tests/test_leaderboard_refresh.py :7 from pathlib import Path

18 more not shown — this panel samples each group; the count above is the real total.

shell / exec 14

  • shell yatuk-mcpradar-3531afc/src/mcpradar/fetch/fetcher.py :16 import subprocess
  • shell yatuk-mcpradar-3531afc/src/mcpradar/plugin/manager.py :9 import subprocess
  • shell yatuk-mcpradar-3531afc/src/mcpradar/plugin/runtime.py :7 import subprocess
  • shell yatuk-mcpradar-3531afc/src/mcpradar/plugin/validator.py :7 import subprocess
  • shell (weak) yatuk-mcpradar-3531afc/src/mcpradar/sandbox/container.py :21 import subprocess
  • shell yatuk-mcpradar-3531afc/src/mcpradar/source/javascript.py :8 import subprocess
  • shell yatuk-mcpradar-3531afc/src/mcpradar/watch/watcher.py :8 import subprocess
  • shell (weak) yatuk-mcpradar-3531afc/tests/test_javascript_analyzer.py :6 from subprocess import CompletedProcess, TimeoutExpired
  • shell (weak) yatuk-mcpradar-3531afc/tests/test_regression_gate.py :8 import subprocess
  • shell (weak) yatuk-mcpradar-3531afc/tests/test_source_analyzer.py :80 "import os, subprocess\ndef r(c):\n os.system(c)\n"
  • shell yatuk-mcpradar-3531afc/validation/run_benchmark.py :13 import subprocess
  • shell yatuk-mcpradar-3531afc/validation/run_trending.py :23 import subprocess
show 2 more
  • shell yatuk-mcpradar-3531afc/validation/run_validation.py :15 import subprocess
  • shell yatuk-mcpradar-3531afc/validation/setup_corpus.py :7 import subprocess

network 20

  • net (weak) yatuk-mcpradar-3531afc/scripts/batch_results.py :18 import urllib.request
  • net yatuk-mcpradar-3531afc/src/mcpradar/cvefeed/osv.py :12 import httpx
  • net yatuk-mcpradar-3531afc/src/mcpradar/cvefeed/syncer.py :12 import httpx
  • net yatuk-mcpradar-3531afc/src/mcpradar/fetch/fetcher.py :19 import urllib.parse
  • net yatuk-mcpradar-3531afc/src/mcpradar/fingerprint/transport_check.py :5 import socket
  • net yatuk-mcpradar-3531afc/src/mcpradar/network/safe_http.py :11 import socket
  • net yatuk-mcpradar-3531afc/src/mcpradar/output/sbom.py :10 import urllib.parse
  • net yatuk-mcpradar-3531afc/src/mcpradar/probe/oauth.py :27 from urllib.parse import urlparse
  • net yatuk-mcpradar-3531afc/src/mcpradar/registry/client.py :12 import httpx
  • net yatuk-mcpradar-3531afc/src/mcpradar/registry/popularity.py :27 from urllib.parse import quote, urlparse
  • net yatuk-mcpradar-3531afc/src/mcpradar/scanner/protocol_adapter.py :8 import httpx
  • net yatuk-mcpradar-3531afc/src/mcpradar/source/analyzer.py :35 "requests.get",
show 8 more
  • net yatuk-mcpradar-3531afc/src/mcpradar/watch/watcher.py :11 import httpx
  • net (weak) yatuk-mcpradar-3531afc/tests/test_cvefeed.py :59 monkeypatch.setattr("httpx.get", mock_get)
  • net (weak) yatuk-mcpradar-3531afc/tests/test_oauth_r112.py :5 import httpx
  • net (weak) yatuk-mcpradar-3531afc/tests/test_osv.py :95 with patch("httpx.post", return_value=mock_response) as mock_post:
  • net (weak) yatuk-mcpradar-3531afc/tests/test_popularity.py :7 import httpx
  • net (weak) yatuk-mcpradar-3531afc/tests/test_protocol_adapter.py :8 import httpx
  • net (weak) yatuk-mcpradar-3531afc/tests/test_safe_http.py :8 import httpx
  • net (weak) yatuk-mcpradar-3531afc/tests/test_source_analyzer.py :28 f = _scan("import requests\ndef go(u):\n requests.get(u)\n", tmp_path)

secrets 3

  • secrets yatuk-mcpradar-3531afc/src/mcpradar/cvefeed/syncer.py :91 self._api_key = api_key or os.environ.get("NVD_API_KEY", "")
  • secrets yatuk-mcpradar-3531afc/src/mcpradar/registry/popularity.py :92 token = os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN")
  • secrets (weak) yatuk-mcpradar-3531afc/tests/test_source_analyzer.py :264 " tok = os.getenv('MY_API_KEY')\n"

database 2

  • db yatuk-mcpradar-3531afc/src/mcpradar/storage/store.py :6 import sqlite3
  • db (weak) yatuk-mcpradar-3531afc/tests/test_storage_migrations.py :5 import sqlite3

declared dependencies 17

  • mcp@>=1.27,<2
  • cryptography@>=44
  • httpx@>=0.28
  • platformdirs@>=4.0
  • pyyaml@>=6.0
  • sarif-om@>=1.0
  • typer@>=0.15
  • rich@>=13.0
  • pydantic@>=2.0
  • tomli-w@>=1.0
  • pytest@>=8.0
  • pytest-asyncio@>=0.25
show 5 more
  • pytest-cov@>=6.0
  • pytest-benchmark@>=5.0
  • hypothesis@>=6.130
  • ruff@>=0.11
  • mypy@>=1.15

perm:untrusted 1

  • untrusted (weak) yatuk-mcpradar-3531afc/tests/test_source_analyzer.py :138 return requests.get(f'https://api.example.com/s?q={q}').json()

transport_posture 2

  • binds all interfaces (0.0.0.0) yatuk-mcpradar-3531afc/tests/test_javascript_analyzer.py :110 "const app = { host: '0.0.0.0' };",
  • binds all interfaces (0.0.0.0) yatuk-mcpradar-3531afc/tests/test_source_analyzer.py :200 f = _scan("import uvicorn\nuvicorn.run(app, host='0.0.0.0', port=8000)\n", tmp_path)