Clash Control MCP Server
clash-control-mcp
npm
v1.0.0-rc.1
Published by huaqing0 — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
Adapter-backed, transaction-safe MCP control for Clash Verge Rev / Mihomo | Adapter 强绑定的安全事务化控制服务
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 6.3 = 94. What the published surface and source actually contain:
| Points | What was found | Category |
|---|---|---|
| −6.3 | Untrusted input concatenated into a command sink MTC-SRC-009 | injection |
2. Client adoption risk — 94 − 11 = 83. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −10 | capability blast radius (critical) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 11
high Shell/command execution in server code (dist/health-check.js)MTC-SRC-002
In the server's implementation (`dist/health-check.js:29`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: { execFile } from 'node:child_process'; import { connect } from 'node:net'; import { platform } from 'node:os'; import *
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/health-check.js
high Shell/command execution in server code (dist/optimizer/baseline.js)MTC-SRC-002
In the server's implementation (`dist/optimizer/baseline.js:10`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ecFileSync } from 'node:child_process'; import { platform } from 'node:os'; import { createHash } from 'node:crypto'; im
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/optimizer/baseline.js
high Shell/command execution in server code (dist/system-verifiers.js)MTC-SRC-002
In the server's implementation (`dist/system-verifiers.js:14`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: { execFile } from 'node:child_process'; import { platform } from 'node:os'; import { createConnection } from 'node:net';
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/system-verifiers.js
high Shell/command execution in server code (dist/tools/doctor.js)MTC-SRC-002
In the server's implementation (`dist/tools/doctor.js:6`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: { execSync } from 'node:child_process'; import { existsSync } from 'node:fs'; import { redactValue } from '../redaction.
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/tools/doctor.js
high Shell/command execution in server code (dist/verge-detector.js)MTC-SRC-002
In the server's implementation (`dist/verge-detector.js:16`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: { execSync } from 'node:child_process'; import { dirname, isAbsolute, join, relative, resolve } from 'node:path'; import
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/verge-detector.js
medium Untrusted input concatenated into a command sink (dist/verge-detector.js)MTC-SRC-009
In the server's implementation (`dist/verge-detector.js:76`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: { appVersion = execSync(`defaults read "${join(macAppPath, 'Contents/Info.plist')}" CFBundleShortVersionString`
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/verge-detector.js
low Shell/command execution in packaging/dev tooling (scripts/adapter-app-transaction.mjs)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/adapter-app-transaction.mjs:9`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: { execFile } from 'node:child_process'; import { constants as fsConstants } from 'node:fs'; import { isIP } from 'node:n
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server scripts/adapter-app-transaction.mjs
low Shell/command execution in packaging/dev tooling (scripts/adapter-cli.mjs)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/adapter-cli.mjs:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: spawnSync } from 'node:child_process'; import { dirname, join } from 'node:path'; import { fileURLToPath } from 'node:u
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server scripts/adapter-cli.mjs
low Shell/command execution in packaging/dev tooling (scripts/adapter-install-lib.mjs)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/adapter-install-lib.mjs:26`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ile, spawn } from 'node:child_process'; import { fileURLToPath } from 'node:url'; import { inspectAdapterApp, stageA
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server scripts/adapter-install-lib.mjs
low Shell/command execution in packaging/dev tooling (scripts/adapter-patch-lib.mjs)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/adapter-patch-lib.mjs:12`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: { execFile } from 'node:child_process'; import { dirname, join, relative, resolve, sep } from 'node:path'; import { ha
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server scripts/adapter-patch-lib.mjs
low Shell/command execution in packaging/dev tooling (scripts/install-adapter-patch.mjs)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`scripts/install-adapter-patch.mjs:5`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: rt { spawn } from 'node:child_process'; import { rm } from 'node:fs/promises'; import { dirname, join } from 'node:path'
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server scripts/install-adapter-patch.mjs
Tools 66
Each tool and what it can reach — statically extracted from the published source.
clash.optimize.githubingests untrusted inputreads sensitive dataclash.capabilitiesreads sensitive dataclash.config.apply_transactionno sensitive capabilityclash.config.auditno sensitive capabilityclash.config.create_workspaceno sensitive capabilityclash.config.get_effectiveno sensitive capabilityclash.config.get_generatedno sensitive capabilityclash.config.get_persistentno sensitive capabilityclash.config.preview_changeno sensitive capabilityclash.config.rollbackno sensitive capability
Show 56 more tools ↓
clash.config.validate_changeno sensitive capabilityclash.doctorno sensitive capabilityclash.merge.inspectno sensitive capabilityclash.merge.updateno sensitive capabilityclash.optimize.compare_probesno sensitive capabilityclash.optimize.diagnose_networkno sensitive capabilityclash.optimize.dnsno sensitive capabilityclash.optimize.execution_planno sensitive capabilityclash.optimize.health_checksno sensitive capabilityclash.optimize.openaino sensitive capabilityclash.optimize.proxy_groupsno sensitive capabilityclash.optimize.rulesno sensitive capabilityclash.optimize.streamingno sensitive capabilityclash.optimize.verify_baselineno sensitive capabilityclash.optimize.youtubeno sensitive capabilityclash.override.inspectno sensitive capabilityclash.override.updateno sensitive capabilityclash.profiles.activateno sensitive capabilityclash.profiles.inspectno sensitive capabilityclash.profiles.inspect_chainno sensitive capabilityclash.profiles.listno sensitive capabilityclash.profiles.refreshno sensitive capabilityclash.profiles.update_metadatano sensitive capabilityclash.recovery.statusno sensitive capabilityclash.rules.addno sensitive capabilityclash.rules.inspectno sensitive capabilityclash.rules.removeno sensitive capabilityclash.runtime.close_connectionno sensitive capabilityclash.runtime.get_proxy_groupno sensitive capabilityclash.runtime.get_statusno sensitive capabilityclash.runtime.list_connectionsno sensitive capabilityclash.runtime.list_proxy_groupsno sensitive capabilityclash.runtime.list_proxy_providersno sensitive capabilityclash.runtime.list_rule_providersno sensitive capabilityclash.runtime.refresh_proxy_providerno sensitive capabilityclash.runtime.refresh_rule_providerno sensitive capabilityclash.runtime.select_proxyno sensitive capabilityclash.runtime.test_proxy_delayno sensitive capabilityclash.transaction.resumeno sensitive capabilityclash.verge.configure_dns_overrideno sensitive capabilityclash.verge.configure_lan_accessno sensitive capabilityclash.verge.configure_portsno sensitive capabilityclash.verge.configure_tunno sensitive capabilityclash.verge.detectno sensitive capabilityclash.verge.get_active_profileno sensitive capabilityclash.verge.get_directoriesno sensitive capabilityclash.verge.get_settingsno sensitive capabilityclash.verge.preferences.configure_hotkeysno sensitive capabilityclash.verge.preferences.configure_layoutno sensitive capabilityclash.verge.preferences.configure_themeno sensitive capabilityclash.verge.preferences.inspectno sensitive capabilityclash.verge.preferences.set_basicno sensitive capabilityclash.verge.set_auto_close_connectionno sensitive capabilityclash.verge.set_ipv6no sensitive capabilityclash.verge.set_log_levelno sensitive capabilityclash.verge.set_unified_delayno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (66 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.0.0-rc.1 latest |
B 83/100 | 11 | 1.13.0 | 2026-09-05 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan clash-control-mcp --onlineMore in Security & Testing
The Stripe Agent Toolkit enables popular agent frameworks including LangChain and Vercel's AI SDK to integrate with Stripe APIs through function calling.
MCP (Model Context Protocol) server for AgentGate. Enables Claude and other MCP-compatible AI assistants to request approvals.
Scan any website for AI agent readiness, payment protocols, and discovery endpoints
MCP server for aigently security guardrails — reads static catalog-data JSON, zero API dependency
Governed threat modeling, code threat verification, traceability & compliance, as MCP tools.
Governed threat modeling, code threat verification, traceability & compliance, as MCP tools.