Graqle MCP Server
graqle
PyPI
v0.83.0
Published by quantamixsol — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
Give your AI tools architecture-aware reasoning. Build a knowledge graph from any codebase — dependency analysis, impact analysis, governed AI answers with confidence scores. Works with Claude Code, Cursor, VS Code Copilot. 14 LLM backends, fully offline capable.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 11 = 89. What the published surface and source actually contain:
| Points | What was found | Category |
|---|---|---|
| −11 | Unsafe deserialization ×3 MTC-SRC-007 | permissions |
2. Client adoption risk — 89 − 7 = 82. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 16
high Reads a sensitive credential path or dumps the environment (graqle/cli/commands/doctor.py)MTC-SRC-006
In the server's implementation (`graqle/cli/commands/doctor.py:232`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: y: AWS credentials", f"~/.aws/credentials: {masked}")) else: results.append((PASS, "
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server graqle/cli/commands/doctor.py
high Shell/command execution in server code (graqle/cli/commands/grow.py)MTC-SRC-002
In the server's implementation (`graqle/cli/commands/grow.py:48`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: try: result = subprocess.run( ["git", "diff", "--name-only", "HEAD~1", "HEAD"], captur
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server graqle/cli/commands/grow.py
high Shell/command execution in server code (graqle/cli/commands/init.py)MTC-SRC-002
In the server's implementation (`graqle/cli/commands/init.py:1785`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: result = subprocess.run( [sys.executable, "-m", "pip", "install", pip_pkg],
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server graqle/cli/commands/init.py
high Shell/command execution in server code (graqle/cli/commands/mcp_install.py)MTC-SRC-002
In the server's implementation (`graqle/cli/commands/mcp_install.py:86`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: etedProcess: return subprocess.run(cmd, capture_output=True, text=True, timeout=timeout) # ── graq mcp install cod
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server graqle/cli/commands/mcp_install.py
high Shell/command execution in server code (graqle/cli/commands/plugins.py)MTC-SRC-002
In the server's implementation (`graqle/cli/commands/plugins.py:242`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: }...") try: subprocess.run( ["git", "clone", "--depth", "1", repo_url, str(target)],
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server graqle/cli/commands/plugins.py
high Shell/command execution in server code (graqle/cli/commands/release_gate.py)MTC-SRC-002
In the server's implementation (`graqle/cli/commands/release_gate.py:173`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ".join(body_lines) subprocess.run( ["gh", "pr", "comment", str(pr), "--repo", repo, "--body", body],
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server graqle/cli/commands/release_gate.py
high Shell/command execution in server code (graqle/cli/commands/selfupdate.py)MTC-SRC-002
In the server's implementation (`graqle/cli/commands/selfupdate.py:84`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: [/cyan]") result = subprocess.run( [sys.executable, "-m", "pip", "install", "--upgrade", pkg], capt
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server graqle/cli/commands/selfupdate.py
high Shell/command execution in server code (graqle/cli/commands/trustctl.py)MTC-SRC-002
In the server's implementation (`graqle/cli/commands/trustctl.py:52`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: xplicit arg list (never shell=True).""" return subprocess.run( # noqa: S603 args, capture_output=ca
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server graqle/cli/commands/trustctl.py
high Shell/command execution in server code (graqle/cli/main.py)MTC-SRC-002
In the server's implementation (`graqle/cli/main.py:381`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: == "win32": subprocess.Popen( [sys.executable, "-m", "graqle.cli.main", "mcp", "serve"],
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server graqle/cli/main.py
high Shell/command execution in server code (graqle/compliance/baseline_doc.py)MTC-SRC-002
In the server's implementation (`graqle/compliance/baseline_doc.py:226`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: try: result = subprocess.run( ["git", "rev-parse", "HEAD"], cwd=str(cwd) if cwd else N
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server graqle/compliance/baseline_doc.py
high Shell/command execution in server code (graqle/config/secrets.py)MTC-SRC-002
In the server's implementation (`graqle/config/secrets.py:30`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: out a shell** (no ``shell=True``) so there is no shell-injection surface. - No exception, log line, or audit field
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server graqle/config/secrets.py
medium Hardcoded egress to an external endpoint (graqle/cli/commands/selfupdate.py)MTC-SRC-003
In the server's implementation (`graqle/cli/commands/selfupdate.py:57`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: urrent with urllib.request.urlopen("https://pypi.org/pypi/graqle/json", timeout=5) as resp:
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server graqle/cli/commands/selfupdate.py
medium Dynamic module load from a non-literal (graqle/cli/commands/doctor.py)MTC-SRC-005
In the server's implementation (`graqle/cli/commands/doctor.py:917`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: f"{len(hits)} stale import(s) found — run: graq doctor --fix", )) for hit in hits[:5]:
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server graqle/cli/commands/doctor.py
medium Unsafe deserialization (graqle/calibration/methods.py)MTC-SRC-007
In the server's implementation (`graqle/calibration/methods.py:322`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ) inst._model = pickle.loads(Path(path).read_bytes()) # noqa: S301 inst._fitted = True return i
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server graqle/calibration/methods.py
medium Unsafe deserialization (graqle/calibration/wrapper.py)MTC-SRC-007
In the server's implementation (`graqle/calibration/wrapper.py:136`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: state: dict[str, Any] = pickle.load(fh) # noqa: S301 self._calibrator = state["calibrator"] self._fitte
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server graqle/calibration/wrapper.py
medium Unsafe deserialization (graqle/cli/commands/calibrate.py)MTC-SRC-007
In the server's implementation (`graqle/cli/commands/calibrate.py:267`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: state: dict[str, Any] = pickle.load(fh) # noqa: S301 except Exception as exc: typer.echo(f"Error reading ca
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server graqle/cli/commands/calibrate.py
What this scan could not see
- No tools were enumerated, so prompt-injection, capability and toxic-flow analysis had no tool surface to inspect. To grade a package’s real runtime tools, scan the running server: --command "npx -y <package>".
Versions 4
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.83.0 latest |
B 82/100 | 16 | 1.13.0 | 2026-08-25 |
v0.82.0 |
B 82/100 | 16 | 1.12.1 | 2026-07-31 |
v0.81.0 |
B 82/100 | 16 | 1.12.1 | 2026-07-27 |
v0.80.0 |
B 82/100 | 16 | 1.9.0 | 2026-07-23 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan graqle --online --registry pypiMore in Analytics & Monitoring
Public-safe MCP admin discovery contract descriptors and response builders.
Pokemon Champions battle advisor MCP server
Airflow MCP server — DAG list, runs, task instances, log tails, trigger and clear over the Airflow REST API
MCP analytics wrapper SDK that instruments MCP tool declarations with telemetry.
AI-ready GIS, geofencing, DataSynch, CRM, inventory, routing, APIs, telemetry and workflows.
AI-native social listening. Monitor buying signals and run GTM workflows via natural language.