MCP Observatory
2m ago Tracked 60,036 Last 2m ago 24h 2,463
pypi Python analyzed 1.24.17

n24q02m-mcp-core

v1.24.17
pypi

Unified MCP Streamable HTTP 2025-11-25 transport, OAuth 2.1 AS, lifecycle, install

maintainer
—
licence
Apache-2.0
first seen
2026-08-24
last seen
2026-09-19
releases · 30d
24
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 1 tools
transport stdio · streamable-http · http counts 1 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • config__open_relay
skills & danger signals pypi-sdist
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v1.24.17 · analyzer v33 · 1h ago

danger signals1

  • over-broad OAuth scope https://mail.google.com/ n24q02m_mcp_core-1.24.17/tests/schema/test_types.py :101 "scopes": ["https://mail.google.com/"],
code evidence v1.24.17 · pypi-sdist
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 156

filesystem 37

  • fs n24q02m_mcp_core-1.24.17/src/mcp_core/cli.py :39 from pathlib import Path
  • fs n24q02m_mcp_core-1.24.17/src/mcp_core/install/agents.py :29 from pathlib import Path
  • fs n24q02m_mcp_core-1.24.17/src/mcp_core/lifecycle/lock.py :33 from pathlib import Path
  • fs n24q02m_mcp_core-1.24.17/src/mcp_core/llm/catalog.py :13 from pathlib import Path
  • fs n24q02m_mcp_core-1.24.17/src/mcp_core/oauth/jwt_issuer.py :28 from pathlib import Path
  • fs n24q02m_mcp_core-1.24.17/src/mcp_core/oauth/user_store.py :7 from pathlib import Path
  • fs n24q02m_mcp_core-1.24.17/src/mcp_core/relay/browser.py :41 with open("/proc/version", encoding="utf-8") as f:
  • fs (weak) n24q02m_mcp_core-1.24.17/src/mcp_core/scripts/clean_state.py :22 import shutil
  • fs n24q02m_mcp_core-1.24.17/src/mcp_core/storage/backends.py :12 from pathlib import Path
  • fs n24q02m_mcp_core-1.24.17/src/mcp_core/storage/config_file.py :10 from pathlib import Path
  • fs n24q02m_mcp_core-1.24.17/src/mcp_core/storage/machine_id.py :34 with open("/etc/machine-id") as f:
  • fs n24q02m_mcp_core-1.24.17/src/mcp_core/storage/per_plugin_store.py :25 from pathlib import Path
show 25 more
  • fs n24q02m_mcp_core-1.24.17/src/mcp_core/storage/session_lock.py :15 from pathlib import Path
  • fs n24q02m_mcp_core-1.24.17/src/mcp_core/transport/cache.py :20 from pathlib import Path
  • fs n24q02m_mcp_core-1.24.17/src/mcp_core/transport/local_server.py :16 from pathlib import Path
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/auth/test_credential_form_baseline.py :9 from pathlib import Path
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/auth/test_local_oauth_app.py :953 from pathlib import Path
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/crypto/test_jwt_signing_seed.py :4 from pathlib import Path
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/crypto/test_vectors.py :8 from pathlib import Path
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/install/test_agents.py :6 from pathlib import Path
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/lifecycle/test_lock.py :11 from pathlib import Path
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/lifecycle/test_lock_error_paths.py :4 from pathlib import Path
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/lifecycle/test_lock_permissions.py :3 from pathlib import Path
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/lifecycle/test_lock_sweep.py :5 from pathlib import Path
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/oauth/test_jwt_issuer.py :88 with open(keys_dir / f"{server_name}_private.pem", "wb") as f:
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/oauth/test_user_store.py :3 from pathlib import Path
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/oauth/test_user_store_errors.py :3 from pathlib import Path
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/relay/test_browser.py :295 # webbrowser.open() -> subprocess.Popen(<list>) on Unix, os.startfile()
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/scripts/test_clean_state.py :2 import shutil
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/storage/test_backends.py :39 monkeypatch.setattr("pathlib.Path.home", lambda: tmp_path)
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/storage/test_per_plugin_store.py :6 from pathlib import Path
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/storage/test_session_lock.py :5 from pathlib import Path
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/test_cli.py :31 monkeypatch.setattr("pathlib.Path.home", lambda: tmp_path)
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/transport/test_cache.py :11 from pathlib import Path
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/transport/test_d17_wiring_integration.py :11 from pathlib import Path
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/transport/test_local_server.py :11 from pathlib import Path
  • fs (weak) n24q02m_mcp_core-1.24.17/tests/transport/test_oauth_middleware.py :10 from pathlib import Path

shell / exec 5

  • shell n24q02m_mcp_core-1.24.17/src/mcp_core/relay/browser.py :7 import subprocess
  • shell n24q02m_mcp_core-1.24.17/src/mcp_core/storage/machine_id.py :7 import subprocess
  • shell (weak) n24q02m_mcp_core-1.24.17/tests/lifecycle/test_lock.py :6 import subprocess
  • shell (weak) n24q02m_mcp_core-1.24.17/tests/relay/test_browser.py :4 import subprocess
  • shell (weak) n24q02m_mcp_core-1.24.17/tests/test_startup_warnings.py :3 import subprocess

network 24

  • net n24q02m_mcp_core-1.24.17/src/mcp_core/auth/delegated_oauth_app.py :47 import httpx
  • net n24q02m_mcp_core-1.24.17/src/mcp_core/auth/local_oauth_app.py :390 from urllib.parse import quote
  • net n24q02m_mcp_core-1.24.17/src/mcp_core/auth/relay_login.py :23 from urllib.parse import quote
  • net n24q02m_mcp_core-1.24.17/src/mcp_core/http/ssrf.py :15 import socket
  • net n24q02m_mcp_core-1.24.17/src/mcp_core/relay/client.py :10 from urllib.parse import quote, urljoin
  • net n24q02m_mcp_core-1.24.17/src/mcp_core/relay/transient.py :22 import socket
  • net n24q02m_mcp_core-1.24.17/src/mcp_core/storage/backends.py :14 from urllib.parse import quote
  • net n24q02m_mcp_core-1.24.17/src/mcp_core/storage/d1.py :21 import httpx
  • net n24q02m_mcp_core-1.24.17/src/mcp_core/storage/machine_id.py :6 import socket
  • net n24q02m_mcp_core-1.24.17/src/mcp_core/storage/vectorize.py :20 import httpx
  • net n24q02m_mcp_core-1.24.17/src/mcp_core/transport/local_server.py :14 import socket
  • net (weak) n24q02m_mcp_core-1.24.17/tests/auth/test_delegated_oauth_app.py :3 Stubs the upstream endpoints via ``httpx.MockTransport`` so the flow runs
show 12 more
  • net (weak) n24q02m_mcp_core-1.24.17/tests/auth/test_delegated_oauth_app_coverage.py :3 import httpx
  • net (weak) n24q02m_mcp_core-1.24.17/tests/auth/test_delegated_oauth_relay_gate.py :16 from urllib.parse import urlparse
  • net (weak) n24q02m_mcp_core-1.24.17/tests/auth/test_local_oauth_app.py :6 from urllib.parse import parse_qs, urlparse
  • net (weak) n24q02m_mcp_core-1.24.17/tests/http/test_ssrf.py :3 import socket
  • net (weak) n24q02m_mcp_core-1.24.17/tests/llm/test_dispatch.py :10 import socket
  • net (weak) n24q02m_mcp_core-1.24.17/tests/llm/test_gateway_default_base.py :11 import socket
  • net (weak) n24q02m_mcp_core-1.24.17/tests/llm/test_vertex_express.py :9 import socket
  • net (weak) n24q02m_mcp_core-1.24.17/tests/relay/test_client.py :106 with patch("mcp_core.relay.client.httpx.AsyncClient") as mock_client_cls:
  • net (weak) n24q02m_mcp_core-1.24.17/tests/storage/test_d1_backend.py :207 import httpx
  • net (weak) n24q02m_mcp_core-1.24.17/tests/storage/test_string_session_store.py :3 from urllib.parse import unquote
  • net (weak) n24q02m_mcp_core-1.24.17/tests/storage/test_vectorize.py :10 with patch("httpx.request") as mock_request:
  • net (weak) n24q02m_mcp_core-1.24.17/tests/transport/test_local_server.py :10 import socket

secrets 9

  • secrets n24q02m_mcp_core-1.24.17/src/mcp_core/auth/delegated_oauth_app.py :230 signing_secret = os.environ.get("MCP_JWT_SIGNING_SECRET") or os.environ.get("CREDENTIAL_SECRET")
  • secrets n24q02m_mcp_core-1.24.17/src/mcp_core/auth/local_oauth_app.py :154 signing_secret = os.environ.get("MCP_JWT_SIGNING_SECRET") or os.environ.get("CREDENTIAL_SECRET")
  • secrets n24q02m_mcp_core-1.24.17/src/mcp_core/storage/backends.py :228 return CfKvBackend(base_url=base_url, token=os.environ.get("MCP_KV_TOKEN"))
  • secrets n24q02m_mcp_core-1.24.17/src/mcp_core/storage/d1.py :176 return D1Backend(base_url=base, token=os.environ.get("MCP_D1_TOKEN"))
  • secrets n24q02m_mcp_core-1.24.17/src/mcp_core/storage/machine_id.py :3 import getpass
  • secrets n24q02m_mcp_core-1.24.17/src/mcp_core/storage/per_plugin_store.py :70 master = os.environ.get("CREDENTIAL_SECRET")
  • secrets n24q02m_mcp_core-1.24.17/src/mcp_core/storage/vectorize.py :130 return VectorizeBackend(base_url=base, idx=idx, token=os.environ.get("MCP_VECTORIZE_TOKEN"))
  • secrets n24q02m_mcp_core-1.24.17/src/mcp_core/transport/local_server.py :262 jwt_signing_secret = os.environ.get("MCP_JWT_SIGNING_SECRET") or os.environ.get("CREDENTIAL_SECRET")
  • secrets (weak) n24q02m_mcp_core-1.24.17/tests/storage/test_resolver.py :25 os.environ["MCP_TELEGRAM_BOT_TOKEN"] = "env-token"

database 3

  • db n24q02m_mcp_core-1.24.17/src/mcp_core/oauth/user_store.py :5 import sqlite3
  • db (weak) n24q02m_mcp_core-1.24.17/tests/oauth/test_user_store.py :2 import sqlite3
  • db (weak) n24q02m_mcp_core-1.24.17/tests/oauth/test_user_store_errors.py :2 import sqlite3

tool registrations 2

  • config__open_relay n24q02m_mcp_core-1.24.17/src/mcp_core/relay/tool_helpers.py :144
  • config__open_relay n24q02m_mcp_core-1.24.17/src/mcp_core/relay/transient.py :270

declared dependencies 14

  • fastmcp@>=3.4.7,<4
  • mcp@>=1.30.0,<2
  • httpx@>=0.28.1
  • httpcore@>=1.0.9
  • cryptography@>=50.0.1
  • authlib@>=1.8.0
  • starlette@>=1.6.0
  • s@resolve.
  • pydantic-settings@>=2.14.2,<3
  • loguru@>=0.7.3
  • platformdirs@>=4.11.7
  • tomli-w@>=1.2.0
show 2 more
  • filelock@>=3.32.5
  • litellm@>=1.100.0