Security Audit: 2 finding(s) in mcp

[starbuck100]

AgentAudit Security Audit Report

Metric	Value
Package	`mcp`
Risk Score	20/100
Result	safe
Findings	2 total (0 critical, 1 high, 1 medium, 0 low)

Findings Summary

1. HIGH - shell=True with subprocess on Windows (mcp/cli/cli.py:48)

   • The CLI module uses subprocess.run with shell=True on Windows when checking for npx command availability and when launching the MCP Inspector. Using shell=True expands attack surface.

2. MEDIUM - Environment variable function filtering may be incomplete (mcp/client/stdio/init.py:63)

   • Code filters environment variables starting with '()' to prevent shell function injection, but this only covers bash shellshock-style attacks and may not cover all edge cases.

Full Report

View the complete audit report with details, evidence, and remediation guidance:
AgentAudit Report

---

This audit was performed automatically by AgentAudit, the security registry for AI agent packages. If you believe any finding is incorrect, you can dispute it on the platform.