github Python analyzed · update queued c23daac (3 behind)

zz-plant/sabnzbd-mcp

MCP server for SABnzbd — control Usenet downloads from any AI agent. Zero external dependencies.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit c23daac · analyzer v30 · 4d ago

suspicious endpoint discord.com zz-plant-sabnzbd-mcp-c23daac/tests/test_formatters.py :146 monkeypatch.setattr("sabnzbd_mcp.server.SABNZBD_NOTIFY_WEBHOOK", "https://discord.com/api/webhooks/123/token")

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 12

fs zz-plant-sabnzbd-mcp-c23daac/src/sabnzbd_mcp/server.py :24 with open(path, "r") as f:

shell (weak) zz-plant-sabnzbd-mcp-c23daac/tests/test_integration.py :4 import subprocess
shell (weak) zz-plant-sabnzbd-mcp-c23daac/tests/test_mcp_features.py :5 import subprocess

net zz-plant-sabnzbd-mcp-c23daac/src/sabnzbd_mcp/server.py :10 import urllib.parse
net (weak) zz-plant-sabnzbd-mcp-c23daac/tests/test_formatters.py :145 monkeypatch.setattr("sabnzbd_mcp.server.urllib.request.urlopen", fake_urlopen)

secrets zz-plant-sabnzbd-mcp-c23daac/src/sabnzbd_mcp/server.py :35 SABNZBD_API_KEY = os.environ.get("SABNZBD_API_KEY", "")
secrets (weak) zz-plant-sabnzbd-mcp-c23daac/tests/test_integration.py :10 key = os.environ.get("SABNZBD_API_KEY")