Brainctl (TSchonleber) MCP Server
brainctl
PyPI
v2.8.0
Published by tschonleber — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 7 = 93. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 11
high Shell/command execution in server code (src/agentmemory/_impl.py)MTC-SRC-002
In the server's implementation (`src/agentmemory/_impl.py:5226`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: TIER_LABELS = { 0: "exec (unlimited)", 1: "senior-ic (5K)", 2: "specialist (2K)", 3: "worker (500)", }
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/agentmemory/_impl.py
high Shell/command execution in server code (src/agentmemory/code_ingest.py)MTC-SRC-002
In the server's implementation (`src/agentmemory/code_ingest.py:271`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: try: out = subprocess.run( ["git", "-C", str(root), "ls-files", "--cached", "--others",
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/agentmemory/code_ingest.py
high Shell/command execution in server code (src/agentmemory/hippocampus.py)MTC-SRC-002
In the server's implementation (`src/agentmemory/hippocampus.py:2418`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: n" / "brainctl" subprocess.run( [str(brainctl), "-a", event_agent, "event", "add", alert_summary,
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/agentmemory/hippocampus.py
high Shell/command execution in server code (src/agentmemory/marketplace_api.py)MTC-SRC-002
In the server's implementation (`src/agentmemory/marketplace_api.py:667`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: try: proc = subprocess.run( [node, str(helper), "--request", request_path], capture_
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/agentmemory/marketplace_api.py
high Shell/command execution in server code (src/agentmemory/mcp_cleanup.py)MTC-SRC-002
In the server's implementation (`src/agentmemory/mcp_cleanup.py:94`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ive). """ out = subprocess.run( ["ps", "-eo", "pid,ppid,etime,user,command"], capture_output=Tru
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/agentmemory/mcp_cleanup.py
high Shell/command execution in server code (src/agentmemory/mcp_tools_health.py)MTC-SRC-002
In the server's implementation (`src/agentmemory/mcp_tools_health.py:627`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: s _out: subprocess.run( ["sqlite3", str(DB_PATH), ".dump"], stdo
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/agentmemory/mcp_tools_health.py
high Shell/command execution in server code (src/agentmemory/minting.py)MTC-SRC-002
In the server's implementation (`src/agentmemory/minting.py:407`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: try: proc = subprocess.run( [node, str(helper), "--request", request_path], capture_
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/agentmemory/minting.py
high Shell/command execution in server code (src/agentmemory/update.py)MTC-SRC-002
In the server's implementation (`src/agentmemory/update.py:101`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: try: result = subprocess.run( [sys.executable, "-m", "pip", "show", "brainctl"], captu
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/agentmemory/update.py
medium Dynamic module load from a non-literal (src/agentmemory/code_ingest.py)MTC-SRC-005
In the server's implementation (`src/agentmemory/code_ingest.py:188`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: try: __import__(mod) except ImportError: missing.append(mod) if missing:
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/agentmemory/code_ingest.py
low Shell/command execution in packaging/dev tooling (tests/test_cli.py)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_cli.py:28`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: n()" ) result = subprocess.run( [sys.executable, "-c", patch_code], capture_output=True, text=Tr
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server tests/test_cli.py
low Shell/command execution in packaging/dev tooling (tests/test_cmd_update.py)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_cmd_update.py:6`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: nd mocks the underlying subprocess.run (and the small wrapper helpers in agentmemory.update). This is dramatically faste
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server tests/test_cmd_update.py
Tools 200
Each tool and what it can reach — statically extracted from the published source.
acc_evaluateno sensitive capabilityacc_predictno sensitive capabilityacc_resolveno sensitive capabilityacc_statusno sensitive capabilityaccess_log_annotateno sensitive capabilityaffect_checkno sensitive capabilityaffect_classifyno sensitive capabilityaffect_logno sensitive capabilityaffect_monitorno sensitive capabilityagent_activityno sensitive capability
Show 190 more tools ↓
agent_adminno sensitive capabilityagent_listno sensitive capabilityagent_modelno sensitive capabilityagent_orientno sensitive capabilityagent_pingno sensitive capabilityagent_registerno sensitive capabilityagent_wrap_upno sensitive capabilityallostatic_primeno sensitive capabilityamygdala_extinguishno sensitive capabilityamygdala_query_valenceno sensitive capabilityamygdala_statusno sensitive capabilityamygdala_tagno sensitive capabilityaras_driveno sensitive capabilityaras_historyno sensitive capabilityaras_register_triggerno sensitive capabilityaras_statusno sensitive capabilityaras_transitionno sensitive capabilityattention_snapshotno sensitive capabilitybackupno sensitive capabilitybeliefno sensitive capabilitybelief_collapseno sensitive capabilitybelief_conflictsno sensitive capabilitybelief_conflicts_scanno sensitive capabilitybelief_consensusno sensitive capabilitybelief_diffno sensitive capabilitybelief_getno sensitive capabilitybelief_mergeno sensitive capabilitybelief_propagateno sensitive capabilitybelief_seedno sensitive capabilitybelief_setno sensitive capabilitybg_action_registerno sensitive capabilitybg_hold_releaseno sensitive capabilitybg_hold_triggerno sensitive capabilitybg_holds_activeno sensitive capabilitybg_modulator_setno sensitive capabilitybg_shadow_statsno sensitive capabilitybg_statusno sensitive capabilitybg_sweep_tracesno sensitive capabilitybg_td_emitno sensitive capabilitybg_weights_showno sensitive capabilitybudget_statusno sensitive capabilityca1_compareno sensitive capabilityca1_statusno sensitive capabilityca1_subiculum_historyno sensitive capabilitycerebellum_module_registerno sensitive capabilitycerebellum_observeno sensitive capabilitycerebellum_predictno sensitive capabilitycerebellum_statusno sensitive capabilityclaustrum_memory_bindingsno sensitive capabilityclaustrum_record_bindingno sensitive capabilityclaustrum_register_modalityno sensitive capabilityclaustrum_setno sensitive capabilityclaustrum_statusno sensitive capabilitycold_memoriesno sensitive capabilitycollapse_logno sensitive capabilitycollapse_statsno sensitive capabilitycolliculi_historyno sensitive capabilitycolliculi_orientno sensitive capabilitycolliculi_register_patternno sensitive capabilitycolliculi_statusno sensitive capabilityconnectome_neighborsno sensitive capabilityconnectome_node_getno sensitive capabilityconnectome_register_edgeno sensitive capabilityconnectome_register_nodeno sensitive capabilityconnectome_statusno sensitive capabilityconsolidationno sensitive capabilityconsolidation_runno sensitive capabilityconsolidation_scheduleno sensitive capabilityconsolidation_statsno sensitive capabilitycontextno sensitive capabilitycontext_addno sensitive capabilitycontext_searchno sensitive capabilitydecision_addno sensitive capabilitydemand_forecastno sensitive capabilitydmn_schedule_statusno sensitive capabilitydmn_simulateno sensitive capabilitydmn_speculative_listno sensitive capabilitydmn_validateno sensitive capabilitydream_cycleno sensitive capabilitydrive_recommend_modeno sensitive capabilitydrive_registerno sensitive capabilitydrive_sampleno sensitive capabilitydrive_statusno sensitive capabilityentity_adminno sensitive capabilityentity_createno sensitive capabilityentity_getno sensitive capabilityentity_observeno sensitive capabilityentity_relateno sensitive capabilityentity_searchno sensitive capabilityentorhinal_activateno sensitive capabilityentorhinal_lookupno sensitive capabilityentorhinal_statusno sensitive capabilityepochno sensitive capabilityevent_addno sensitive capabilityevent_searchno sensitive capabilityexpertiseno sensitive capabilityexpertise_buildno sensitive capabilityexpertise_listno sensitive capabilityexpertise_showno sensitive capabilityexpertise_updateno sensitive capabilityfederatedno sensitive capabilityfederated_entity_searchno sensitive capabilityfederated_memory_searchno sensitive capabilityfederated_searchno sensitive capabilityfederated_statsno sensitive capabilityfree_energy_checkno sensitive capabilitygapsno sensitive capabilitygaps_listno sensitive capabilitygaps_refreshno sensitive capabilitygaps_resolveno sensitive capabilitygaps_scanno sensitive capabilityhabenula_fireno sensitive capabilityhabenula_historyno sensitive capabilityhabenula_register_triggerno sensitive capabilityhabenula_resetno sensitive capabilityhabenula_statusno sensitive capabilityhandoff_addno sensitive capabilityhandoff_adminno sensitive capabilityhandoff_consumeno sensitive capabilityhandoff_expireno sensitive capabilityhandoff_latestno sensitive capabilityhandoff_pinno sensitive capabilityhealthno sensitive capabilityhippocampus_ca3_completeno sensitive capabilityhippocampus_dg_checkno sensitive capabilityhippocampus_dg_separateno sensitive capabilityhippocampus_subfields_statusno sensitive capabilityhot_memoriesno sensitive capabilityinsula_sampleno sensitive capabilityinsula_stateno sensitive capabilityinsula_subscribeno sensitive capabilityknowledgeno sensitive capabilitylifecycleno sensitive capabilitylintno sensitive capabilitymebno sensitive capabilitymemory_addno sensitive capabilitymemory_adminno sensitive capabilitymemory_calibrationno sensitive capabilitymemory_promoteno sensitive capabilitymemory_searchno sensitive capabilitymemory_utility_rateno sensitive capabilityneurono sensitive capabilitypagerankno sensitive capabilitypolicyno sensitive capabilityprocedure_adminno sensitive capabilityquarantineno sensitive capabilityquarantine_listno sensitive capabilityquarantine_purgeno sensitive capabilityquarantine_reviewno sensitive capabilityreconsolidateno sensitive capabilityreconsolidation_checkno sensitive capabilityreflexionno sensitive capabilityreplay_boostno sensitive capabilityreplay_queueno sensitive capabilityresolve_conflictno sensitive capabilityretrieval_effectivenessno sensitive capabilityscheduleno sensitive capabilitysearchno sensitive capabilitysearch_patternsno sensitive capabilitystatsno sensitive capabilitysubiculum_outputno sensitive capabilitysubsystem_configureno sensitive capabilitysubsystem_emitno sensitive capabilitysubsystem_historyno sensitive capabilitysubsystem_listno sensitive capabilitysubsystem_list_actionsno sensitive capabilitysubsystem_registerno sensitive capabilitysubsystem_statusno sensitive capabilitytaskno sensitive capabilitytask_addno sensitive capabilitytask_listno sensitive capabilitytask_updateno sensitive capabilitytemporalno sensitive capabilitythinkno sensitive capabilitytier_statsno sensitive capabilitytomno sensitive capabilitytrigger_adminno sensitive capabilitytrigger_checkno sensitive capabilitytrigger_createno sensitive capabilitytrigger_deleteno sensitive capabilitytrigger_listno sensitive capabilitytrigger_updateno sensitive capabilitytrustno sensitive capabilityusageno sensitive capabilityvalidateno sensitive capabilitywallet_createno sensitive capabilitywallet_showno sensitive capabilitywhosknowsno sensitive capabilityworkspaceno sensitive capabilityworldno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (200 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v2.8.0 latest |
A 93/100 | 11 | 1.8.0 | 2026-07-23 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan brainctl --online --registry pypiOther implementations of Brainctl 1
Independent packages implementing the same tool, scanned with the same engine. Compare all 2 side by side →
Security scan results for the Brainctl (Rorogogogo) MCP server.
More in Developer Tools
Security scan results for the 1stay MCP server.
Security scan results for the Adguard Home MCP server.
Security scan results for the Ado Browser MCP server.
Security scan results for the Adobe Experience Dev MCP server.
Security scan results for the Aemet MCP server.
Security scan results for the Affinity Mcp Bridge MCP server.