← All scanned servers

Trust Card · Static snapshot

modelcontextprotocol__python-sdk D

47/100 · 7 findings (6 critical) · scope broad · Ranked #40 of 53 scanned.

Scanned 2026-09-09 · engine v0.1.0 (8 regex rules, OWASP-mapped) · upstream modelcontextprotocol/python-sdk @ 9972c21 (2026-09-07)

Score breakdown

Score constrained by 6 critical and 1 high-severity findings.

Fix first (7 critical/high)

Severity	Rule	Finding	Remediation
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret docs_src/identity_assertion/tutorial001.py:57 Evidence: client_secret="finance-agent-secret",	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret docs_src/identity_assertion/tutorial002.py:29 Evidence: client_secret="finance-agent-secret",	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret examples/snippets/clients/identity_assertion_client.py:63 Evidence: client_secret="enterprise-mcp-secret",	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret examples/snippets/servers/identity_assertion_server.py:59 Evidence: client_secret="enterprise-mcp-secret",	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret examples/stories/identity_assertion/server.py:23 Evidence: DEMO_CLIENT_SECRET = "demo-finance-agent-secret"	Move credentials to secure environment variables or a key vault. Never commit API keys.
CRITICAL	AT-SEC-002 (LLM02)	Hardcoded Credential or API Secret tests/docs_src/test_identity_assertion.py:73 Evidence: client_secret="finance-agent-secret",	Move credentials to secure environment variables or a key vault. Never commit API keys.
HIGH	AT-SEC-005 (ASI02)	Unrestricted Recursive File Deletion / Modification scripts/docs/translations.py:1099 Evidence: shutil.rmtree(target, ignore_errors=True)	Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions.

Permissions

Scope: broad · Shell: disabled · Network egress: yes · File deletion: enabled · Human approval: none

Provenance

License: MIT · Lockfile: no · Security policy: yes · Signals: unverified origin