Agent Fleet MCP Server
agent-fleet
npm
v1.0.1
Published by an unidentified publisher — no publish provenance and no vendor-owned scope, so the publisher could not be verified. The repository link below is self-declared.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 36.9 = 63. What the published surface and source actually contain:
| Points | What was found | Category |
|---|---|---|
| −23.1 | Dynamic evaluation of a non-literal value ×2 MTC-SRC-010 | injection |
| −11.7 | Unsafe deserialization ×4 MTC-SRC-007 | permissions |
| −2.1 | Package has no source repository MTC-SUP-011 | supply-chain |
2. Client adoption risk — 63 − your exposure = 52. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
| −5 | publisher verification (none) — trust in the source of the package |
| 0 | inspection depth (source) — how much of the target the scan could see |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 23
high Dynamic evaluation of a non-literal value (example-mcp-servers/example-python/fastmcp_server.py)MTC-SRC-010
In the server's implementation (`example-mcp-servers/example-python/fastmcp_server.py:72`): Evaluating a runtime value as code (rather than a fixed literal) executes whatever reaches it — a direct RCE primitive, and almost never necessary in legitimate code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: eval(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server example-mcp-servers/example-python/fastmcp_server.py
high Dynamic evaluation of a non-literal value (example-mcp-servers/example-python/server.py)MTC-SRC-010
In the server's implementation (`example-mcp-servers/example-python/server.py:40`): Evaluating a runtime value as code (rather than a fixed literal) executes whatever reaches it — a direct RCE primitive, and almost never necessary in legitimate code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: eval(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server example-mcp-servers/example-python/server.py
high Dynamic code execution in server code (dist/cli.js)MTC-SRC-001
In the server's implementation (`dist/cli.js:6677`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: Function(`
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/cli.js
high Dynamic code execution in server code (dist/index.js)MTC-SRC-001
In the server's implementation (`dist/index.js:2444`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: Function(`
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/index.js
high Dynamic code execution in server code (example-mcp-servers/example-python/fastmcp_server.py)MTC-SRC-001
In the server's implementation (`example-mcp-servers/example-python/fastmcp_server.py:72`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: eval(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server example-mcp-servers/example-python/fastmcp_server.py
high Dynamic code execution in server code (example-mcp-servers/example-python/server.py)MTC-SRC-001
In the server's implementation (`example-mcp-servers/example-python/server.py:40`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: eval(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server example-mcp-servers/example-python/server.py
high Dynamic code execution in server code (memory/tool-templates/data-transformer/data-transformer-tool.ts)MTC-SRC-001
In the server's implementation (`memory/tool-templates/data-transformer/data-transformer-tool.ts:396`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: new Function(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server memory/tool-templates/data-transformer/data-transformer-tool.ts
high Dynamic code execution in server code (packages/runtime/src/built-in-tools.ts)MTC-SRC-001
In the server's implementation (`packages/runtime/src/built-in-tools.ts:147`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: Function(`
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server packages/runtime/src/built-in-tools.ts
high Dynamic code execution in server code (src/tools/built-in/index.ts)MTC-SRC-001
In the server's implementation (`src/tools/built-in/index.ts:144`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: Function(`
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/tools/built-in/index.ts
high Shell/command execution in server code (dist/cli.js)MTC-SRC-002
In the server's implementation (`dist/cli.js:2020`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: child_process
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/cli.js
high Shell/command execution in server code (dist/index.js)MTC-SRC-002
In the server's implementation (`dist/index.js:2316`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: child_process
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/index.js
high Shell/command execution in server code (packages/runtime/src/built-in-tools.ts)MTC-SRC-002
In the server's implementation (`packages/runtime/src/built-in-tools.ts:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: child_process
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server packages/runtime/src/built-in-tools.ts
high Shell/command execution in server code (src/agents/agent-repository-manager.ts)MTC-SRC-002
In the server's implementation (`src/agents/agent-repository-manager.ts:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: child_process
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/agents/agent-repository-manager.ts
high Shell/command execution in server code (src/git/git-manager.ts)MTC-SRC-002
In the server's implementation (`src/git/git-manager.ts:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: child_process
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/git/git-manager.ts
high Shell/command execution in server code (src/mcp/mcp-bundler.ts)MTC-SRC-002
In the server's implementation (`src/mcp/mcp-bundler.ts:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: child_process
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/mcp/mcp-bundler.ts
high Shell/command execution in server code (src/tools/built-in/index.ts)MTC-SRC-002
In the server's implementation (`src/tools/built-in/index.ts:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: child_process
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/tools/built-in/index.ts
high Shell/command execution in server code (src/web/server.ts)MTC-SRC-002
In the server's implementation (`src/web/server.ts:13`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: child_process
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/web/server.ts
medium Hardcoded egress to an external endpoint (src/web/server.ts)MTC-SRC-003
In the server's implementation (`src/web/server.ts:136`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: fetch('https://oauth2.googleapis.com/token'
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/web/server.ts
medium Unsafe deserialization (dist/cli.js)MTC-SRC-007
In the server's implementation (`dist/cli.js:2112`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: yaml.load(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/cli.js
medium Unsafe deserialization (packages/runtime/src/utils.ts)MTC-SRC-007
In the server's implementation (`packages/runtime/src/utils.ts:54`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: yaml.load(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server packages/runtime/src/utils.ts
medium Unsafe deserialization (src/commands/template.ts)MTC-SRC-007
In the server's implementation (`src/commands/template.ts:343`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: yaml.load(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/commands/template.ts
medium Unsafe deserialization (src/git/git-manager.ts)MTC-SRC-007
In the server's implementation (`src/git/git-manager.ts:131`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: yaml.load(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/git/git-manager.ts
low Package has no source repositoryMTC-SUP-011
"agent-fleet" declares no repository URL, so its published artifact cannot be compared against reviewable source.
Fix: Prefer packages that link to public, reviewable source.
Location: package agent-fleet
What this scan could not see
- No tools were enumerated, so prompt-injection, capability and toxic-flow analysis had no tool surface to inspect. To grade a package’s real runtime tools, scan the running server: --command "npx -y <package>".
Versions
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.0.1 latest |
D 63/100 | 23 | 1.5.0 | 2026-07-23 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan agent-fleet --onlineMore in Developer Tools
Security scan results for the Apify MCP server.
Security scan results for the Basic React MCP server.
Security scan results for the Cloudflare MCP server.
Up-to-date, version-specific library documentation injected straight into prompts.
The official reference server exercising every MCP feature — tools, prompts, resources and sampling.
Security scan results for the Flint Chart MCP server.