Aihydro Tools MCP Server
aihydro-tools
PyPI
v2.1.0
Published by ai-hydro — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 11 = 89. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −10 | capability blast radius (critical) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 7
critical Completed toxic-flow trifecta across toolsMTC-FLOW-002
This server (without client built-ins) exposes a complete data-exfiltration chain: check_record_length → list_available_tools → preview_list_modules. Untrusted input is ingested, private data is read, and it can be sent to an external sink via the agent composing the tools (→). Static analysis proves the primitive exists, not that a specific run will occur.
Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.
Location: flow check_record_length → list_available_tools → preview_list_modules
high Shell/command execution in server code (ai_hydro/gee/auth.py)MTC-SRC-002
In the server's implementation (`ai_hydro/gee/auth.py:84`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: try: proc = subprocess.run( ["gcloud", "projects", "list", "--format=json(projectId,name,project
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server ai_hydro/gee/auth.py
high Shell/command execution in server code (ai_hydro/mcp/tools_execution.py)MTC-SRC-002
In the server's implementation (`ai_hydro/mcp/tools_execution.py:90`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: onic() result = subprocess.run( [sys.executable, "-"], input=full_script, ca
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server ai_hydro/mcp/tools_execution.py
high Shell/command execution in server code (ai_hydro/mcp/tools_session.py)MTC-SRC-002
In the server's implementation (`ai_hydro/mcp/tools_session.py:56`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: p. result = subprocess.run( [sys.executable, "-m", "pip", "list", "--format=json"],
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server ai_hydro/mcp/tools_session.py
medium Hardcoded egress to an external endpoint (ai_hydro/gee/auth.py)MTC-SRC-003
In the server's implementation (`ai_hydro/gee/auth.py:131`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: t()) response = requests.get( "https://cloudresourcemanager.googleapis.com/v1/projects",
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server ai_hydro/gee/auth.py
low Shell/command execution in packaging/dev tooling (bench/gen_scorecard.py)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`bench/gen_scorecard.py:99`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: lush=True) result = subprocess.run(cmd, capture_output=False) print(f"Exit code: {result.returncode}", flush=Tru
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server bench/gen_scorecard.py
low Shell/command execution in packaging/dev tooling (tests/test_capsule.py)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_capsule.py:448`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: eypatch) proc = subprocess.run( [sys.executable, str(cap / "replay.py")], capture_output
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server tests/test_capsule.py
Tools 147
Each tool and what it can reach — statically extracted from the published source.
check_record_lengthingests untrusted inputcheck_usgs_qualification_codesingests untrusted inputcompute_flow_duration_curveingests untrusted inputdata_fetch_backgroundingests untrusted inputdescribe_toolingests untrusted inputdescribe_toolsingests untrusted inputfetch_camels_usingests untrusted inputfetch_forcing_dataingests untrusted inputfetch_streamflow_dataingests untrusted inputget_data_fetch_resultingests untrusted input
Show 137 more tools ↓
list_available_toolsreads sensitive datapreview_list_modulesnetwork egressadd_assumptionno sensitive capabilityadd_claimno sensitive capabilityadd_journal_entryno sensitive capabilityadd_noteno sensitive capabilityadd_session_to_projectno sensitive capabilityaihydro_chat_statusno sensitive capabilityaihydro_describe_capabilityno sensitive capabilityaihydro_rebind_chatno sensitive capabilityarchive_sessionno sensitive capabilityaudit_interpretationno sensitive capabilitybind_map_to_claimno sensitive capabilitycancel_jobno sensitive capabilitycheck_registry_stalenessno sensitive capabilitycheck_regulated_basinno sensitive capabilitycheck_stationarityno sensitive capabilitycheck_temporal_alignmentno sensitive capabilitycheck_unit_consistencyno sensitive capabilitycheck_water_balance_consistencyno sensitive capabilityclear_sessionno sensitive capabilitycompute_design_hydrographno sensitive capabilitycompute_drought_indexno sensitive capabilitycompute_flood_frequencyno sensitive capabilitycompute_soil_loss_rusleno sensitive capabilitycompute_spectral_indexno sensitive capabilitycompute_twino sensitive capabilitycourse_get_curriculumno sensitive capabilitycourse_get_stateno sensitive capabilitycourse_navigateno sensitive capabilitycourse_scaffoldno sensitive capabilitycourse_set_progressno sensitive capabilitycreate_cn_gridno sensitive capabilitydefine_experimentno sensitive capabilitydelineate_watershedno sensitive capabilitydelineate_watershed_from_pointno sensitive capabilitydelineation_doctorno sensitive capabilitydescribe_model_spaceno sensitive capabilitydraft_claim_from_runno sensitive capabilityexport_inundation_surrogate_datasetno sensitive capabilityexport_sessionno sensitive capabilityextract_geomorphic_parametersno sensitive capabilityextract_hydrological_signaturesno sensitive capabilitygee.extract_timeseriesno sensitive capabilitygee.preview_layerno sensitive capabilitygee.statusno sensitive capabilityget_citation_by_doino sensitive capabilityget_dataset_infono sensitive capabilityget_equation_definitionno sensitive capabilityget_experiment_tableno sensitive capabilityget_inundation_physics_resultno sensitive capabilityget_inundation_surrogate_resultno sensitive capabilityget_leaderboardno sensitive capabilityget_library_referenceno sensitive capabilityget_metric_definitionno sensitive capabilityget_model_resultsno sensitive capabilityget_project_summaryno sensitive capabilityget_researcher_profileno sensitive capabilityget_session_healthno sensitive capabilityget_session_raw_stateno sensitive capabilityget_session_summaryno sensitive capabilityget_training_statusno sensitive capabilityget_variable_definitionno sensitive capabilityget_workflow_manifestno sensitive capabilityindex_literatureno sensitive capabilityindex_passagesno sensitive capabilitylist_assumptionsno sensitive capabilitylist_available_workflowsno sensitive capabilitylist_cached_citationsno sensitive capabilitylist_claimsno sensitive capabilitylist_featuresno sensitive capabilitylist_jobsno sensitive capabilitylist_known_datasetsno sensitive capabilitylist_known_metricsno sensitive capabilitylist_known_variablesno sensitive capabilitylist_registry_claimsno sensitive capabilitylist_relevant_clisno sensitive capabilitylist_skillsno sensitive capabilitylist_spectral_indicesno sensitive capabilityload_skillno sensitive capabilitylog_researcher_observationno sensitive capabilitylookup_citationno sensitive capabilitymap_add_layer_from_runno sensitive capabilitymap_apply_symbologyno sensitive capabilitymap_fit_extentno sensitive capabilitymap_fit_layerno sensitive capabilitymap_flood_inundationno sensitive capabilitymap_flood_inundation_hydrographno sensitive capabilitymap_fly_tono sensitive capabilitymap_get_stateno sensitive capabilitymap_list_layersno sensitive capabilitymap_remove_layerno sensitive capabilitymap_save_roino sensitive capabilitymap_set_basemapno sensitive capabilitymap_set_roino sensitive capabilitymap_set_time_rangeno sensitive capabilitymap_set_working_geometryno sensitive capabilitymap_showno sensitive capabilitymap_update_layerno sensitive capabilitymerge_session_shardsno sensitive capabilitymerit_add_map_layersno sensitive capabilitymerit_ensure_basinno sensitive capabilitymerit_ensure_basins_regionno sensitive capabilitymerit_ensure_regionno sensitive capabilitymerit_ensure_routing_regionno sensitive capabilitypreview_address_commentno sensitive capabilitypreview_focus_cellno sensitive capabilitypreview_get_pending_changesno sensitive capabilitypreview_get_stateno sensitive capabilitypreview_recent_eventsno sensitive capabilitypreview_revise_sectionno sensitive capabilitypromote_claim_to_registryno sensitive capabilitypropose_and_trainno sensitive capabilityregister_featureno sensitive capabilityregister_research_planno sensitive capabilityresolve_passageno sensitive capabilityrun_autoresearchno sensitive capabilityrun_experimentno sensitive capabilityrun_inundation_physics_validationno sensitive capabilityrun_pythonno sensitive capabilityrun_skepticno sensitive capabilitysave_skillno sensitive capabilitysearch_experimentsno sensitive capabilitysearch_literatureno sensitive capabilitysearch_passages_toolno sensitive capabilityseparate_baseflowno sensitive capabilityset_active_featureno sensitive capabilityshow_html_previewno sensitive capabilityshow_on_mapno sensitive capabilitystart_projectno sensitive capabilitystart_sessionno sensitive capabilitytrain_hydro_modelno sensitive capabilitytrain_inundation_surrogateno sensitive capabilityupdate_claim_statusno sensitive capabilityupdate_researcher_profileno sensitive capabilitywait_for_jobno sensitive capabilitywrite_research_interpretationno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (147 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v2.1.0 latest |
B 89/100 | 7 | 1.9.0 | 2026-07-23 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan aihydro-tools --online --registry pypiMore in Analytics & Monitoring
Security scan results for the Admin Contracts MCP server.
Security scan results for the Ai Rotom MCP server.
Security scan results for the Airflow MCP server.
Security scan results for the Analytics MCP server.
Security scan results for the Clarity MCP server.
Security scan results for the Cryptoquant MCP server.