API Star

Async (PyPI) MCP Server

async PyPI v0.6.2

Published by an unidentified publisher — no publish provenance and no vendor-owned scope, so the publisher could not be verified. The repository link below is self-declared.

View on PyPI ↗ Repository ↗ Raw report (JSON) ↗
Trust grade
A
100/100
Last scanned
Trust
A · 100/100
How safe the published surface and source look. Deterministic; every point is auditable.
Capability
High
Blast radius if it went rogue — what the server’s tools could reach. Independent of trust.
Coverage
Source
How much the scan could actually inspect. Shallow coverage is stated, never hidden.
A Why this grade

Started at 100 and nothing was deducted: the deterministic scan raised no scored threat in the published surface it inspected. Capability observations and advisory notes are recorded but never lower the score.

Findings 1

high Shell/command execution in server code (async/util.py)MTC-SRC-002

In the server's implementation (`async/util.py:33`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: os.popen(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server async/util.py

What this scan could not see

Versions

Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.

VersionScoreFindingsEngineScanned
v0.6.2 latest A 100/100 1 1.5.0 2026-07-22

Embed this score

Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.

MCP Trust Score: A · 100/100
Markdown (GitHub README)
[![MCP Trust Score](https://mcptrustchecker.com/registry/async/badge.svg)](https://mcptrustchecker.com/registry/async)
HTML
<a href="https://mcptrustchecker.com/registry/async"><img src="https://mcptrustchecker.com/registry/async/badge.svg" alt="MCP Trust Score" height="20"></a>
Prefer shields.io styling? Point it at https://mcptrustchecker.com/registry/async/badge.json via https://img.shields.io/endpoint?url=…

Verify this score yourself

The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.

npx mcptrustchecker scan async --online --registry pypi

Use the free API → How scoring works

Other implementations of Async 1

Independent packages implementing the same tool, scanned with the same engine. Compare all 2 side by side →

Async (mako10k) npm
A
@mako10k/mcp-async

Security scan results for the Async (mako10k) MCP server.

Developer Tools Score 100/100 0 findings Cap. Minimal

More in Other

0xgasless npm
A
0xgasless-mcp

Security scan results for the 0xgasless MCP server.

Other Score 100/100 0 findings Cap. Minimal
24htrack npm
A
24htrack-mcp

Security scan results for the 24htrack MCP server.

Other Score 100/100 0 findings Cap. Minimal
3d Asset Processing npm
A
3d-asset-processing-mcp

Security scan results for the 3d Asset Processing MCP server.

Other Score 100/100 8 findings Cap. High
A2amarket npm
A
@hz-abyssal-heart/a2amarket-mcp-server

Security scan results for the A2amarket MCP server.

Other Score 100/100 0 findings Cap. Minimal
Ableton Copilot npm
A
@xiaolaa2/ableton-copilot-mcp

Security scan results for the Ableton Copilot MCP server.

Other Score 100/100 0 findings Cap. Minimal
Academy npm
A
mcp-academy

Security scan results for the Academy MCP server.

Other Score 100/100 0 findings Cap. Minimal