Lightbulb MCP Server
lightbulb-mcp
PyPI
v0.23.0
Published by rpasquale — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
MCP server for the Lightbulb Partners Agents platform — Claude Code, Codex, and Cursor integration
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 11 = 89. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −10 | capability blast radius (critical) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 8
critical Completed toxic-flow trifecta across toolsMTC-FLOW-002
This server (without client built-ins) exposes a complete data-exfiltration chain: backbone_execute → get_agent_marketplace_action_publication → create_account_shell_customization_draft. Untrusted input is ingested, private data is read, and it can be sent to an external sink via the agent composing the tools (→). Static analysis proves the primitive exists, not that a specific run will occur.
Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.
Location: flow backbone_execute → get_agent_marketplace_action_publication → create_account_shell_customization_draft
high Tool "get_account_shell_customization" exposes command/code executionMTC-CAP-001
Tool "get_account_shell_customization" appears to run shell commands or evaluate code (keyword "shell" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool get_account_shell_customization
high Tool "create_account_shell_customization_draft" exposes command/code executionMTC-CAP-001
Tool "create_account_shell_customization_draft" appears to run shell commands or evaluate code (keyword "shell" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool create_account_shell_customization_draft
high Tool "preview_account_shell_customization" exposes command/code executionMTC-CAP-001
Tool "preview_account_shell_customization" appears to run shell commands or evaluate code (keyword "shell" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool preview_account_shell_customization
high Shell/command execution in server code (lightbulb/context_hook.py)MTC-SRC-002
In the server's implementation (`lightbulb/context_hook.py:564`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ry: completed = subprocess.run( ["git", "-C", cwd, *args], capture_output=True,
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server lightbulb/context_hook.py
low Mutating tool "get_account_shell_customization" declares no destructiveHintMTC-CAP-005
Tool "get_account_shell_customization" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool get_account_shell_customization
low Mutating tool "create_account_shell_customization_draft" declares no destructiveHintMTC-CAP-005
Tool "create_account_shell_customization_draft" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool create_account_shell_customization_draft
low Mutating tool "preview_account_shell_customization" declares no destructiveHintMTC-CAP-005
Tool "preview_account_shell_customization" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool preview_account_shell_customization
Tools 200
Each tool and what it can reach — statically extracted from the published source.
backbone_executeingests untrusted inputcreate_account_shell_customization_draftruns code / shellget_account_shell_customizationruns code / shellget_agent_marketplace_action_publicationreads sensitive dataget_project_game_snapshotingests untrusted inputlist_folderingests untrusted inputpreflight_agent_training_pairnetwork egresspreview_account_shell_customizationruns code / shellactivate_agent_marketplace_actionno sensitive capabilityadmit_project_learning_runno sensitive capability
Show 190 more tools ↓
advance_service_case_resolutionno sensitive capabilityarchive_agent_marketplace_actionno sensitive capabilityask_document_agentno sensitive capabilityattach_contract_to_cash_cash_collectedno sensitive capabilityattach_contract_to_cash_invoice_issuedno sensitive capabilityauthor_agentic_workflowno sensitive capabilityauthor_workflow_triggerno sensitive capabilitybind_project_mission_actionno sensitive capabilitybusiness_classify_replyno sensitive capabilitybusiness_create_invoiceno sensitive capabilitybusiness_draft_contractno sensitive capabilitybusiness_review_contractno sensitive capabilitybusiness_schedule_meetingno sensitive capabilitybusiness_write_emailno sensitive capabilitycancel_codex_account_linkno sensitive capabilitycancel_contract_to_cash_before_invoiceno sensitive capabilitycancel_governed_communication_runno sensitive capabilitycancel_operating_loopno sensitive capabilitycancel_recursive_agent_executionno sensitive capabilitycancel_service_case_resolutionno sensitive capabilitycancel_workflow_runno sensitive capabilitycode_workspace_chatno sensitive capabilitycode_workspace_get_active_runno sensitive capabilitycode_workspace_get_runno sensitive capabilitycode_workspace_wait_for_runno sensitive capabilitycompany_bring_upno sensitive capabilitycompany_chaosno sensitive capabilitycompany_closureno sensitive capabilitycompany_demand_budgetno sensitive capabilitycompany_employeesno sensitive capabilitycompany_exception_casesno sensitive capabilitycompany_jobsno sensitive capabilitycompany_launchno sensitive capabilitycompany_obligationsno sensitive capabilitycompany_payablesno sensitive capabilitycompany_people_opsno sensitive capabilitycompany_portfoliono sensitive capabilitycompany_provisioningno sensitive capabilitycompany_renewalsno sensitive capabilitycompany_revenueno sensitive capabilitycompany_wind_downno sensitive capabilitycompose_business_workflowno sensitive capabilityconfigure_backbone_agent_surfaceno sensitive capabilityconfigure_coding_agent_runtimeno sensitive capabilitycreate_documentno sensitive capabilitycreate_project_from_preflightno sensitive capabilitycreate_slide_deckno sensitive capabilitycreate_spreadsheetno sensitive capabilitydecide_project_learning_result_admissionno sensitive capabilitydecide_workflow_improvement_packetno sensitive capabilitydescribe_anatomyno sensitive capabilitydescribe_operating_loopno sensitive capabilitydispatch_domain_agentno sensitive capabilitydynamic_workflow_attachno sensitive capabilitydynamic_workflow_cancelno sensitive capabilitydynamic_workflow_next_assignmentno sensitive capabilitydynamic_workflow_startno sensitive capabilitydynamic_workflow_statusno sensitive capabilitydynamic_workflow_submit_builder_resultno sensitive capabilitydynamic_workflow_submit_evaluator_verdictno sensitive capabilitydynamic_workflow_submit_planno sensitive capabilityevaluate_project_offline_policyno sensitive capabilityexecute_contract_to_cash_invoiceno sensitive capabilityfind_operating_loopsno sensitive capabilityflush_sdk_runtime_outcomesno sensitive capabilityget_agent_marketplace_installationno sensitive capabilityget_agent_marketplace_invocation_receiptno sensitive capabilityget_agent_marketplace_invocation_statusno sensitive capabilityget_agent_marketplace_listingno sensitive capabilityget_agent_runtime_configno sensitive capabilityget_agent_training_pair_statusno sensitive capabilityget_approval_detailsno sensitive capabilityget_artifactno sensitive capabilityget_codex_account_link_statusno sensitive capabilityget_contract_to_cash_cash_collectionno sensitive capabilityget_contract_to_cash_invoice_issuedno sensitive capabilityget_contract_to_cash_runno sensitive capabilityget_engine_inventoryno sensitive capabilityget_executed_commercial_agreementno sensitive capabilityget_golden_loop_economic_closureno sensitive capabilityget_governed_communication_runno sensitive capabilityget_operating_loop_evidenceno sensitive capabilityget_operating_loop_next_actionno sensitive capabilityget_operating_loop_statusno sensitive capabilityget_project_work_packet_runno sensitive capabilityget_recursive_agent_execution_statusno sensitive capabilityget_runtime_domain_actionno sensitive capabilityget_server_workflow_improvement_packetno sensitive capabilityget_server_workflow_improvement_statusno sensitive capabilityget_service_case_resolutionno sensitive capabilityget_workflow_improvement_auditno sensitive capabilityget_workflow_improvement_deliveryno sensitive capabilityget_workflow_improvement_statusno sensitive capabilityget_workflow_runno sensitive capabilityget_workflow_trigger_catalogno sensitive capabilitygrep_documentsno sensitive capabilityinspect_agent_learning_readinessno sensitive capabilityinspect_agent_training_input_custodyno sensitive capabilityinspect_project_creation_world_readyno sensitive capabilityinspect_project_game_campaignno sensitive capabilityinstall_agent_marketplace_actionno sensitive capabilityinvoke_agent_marketplace_actionno sensitive capabilityinvoke_toolno sensitive capabilitylist_agent_marketplace_installationsno sensitive capabilitylist_agent_marketplace_listingsno sensitive capabilitylist_agent_runtime_optionsno sensitive capabilitylist_artifactsno sensitive capabilitylist_code_workspacesno sensitive capabilitylist_connectorsno sensitive capabilitylist_crm_contactsno sensitive capabilitylist_crm_dealsno sensitive capabilitylist_engine_statesno sensitive capabilitylist_governed_communication_sourcesno sensitive capabilitylist_notificationsno sensitive capabilitylist_pending_approvalsno sensitive capabilitylist_project_business_outcomesno sensitive capabilitylist_project_learning_result_evaluationsno sensitive capabilitylist_project_learning_reviewsno sensitive capabilitylist_project_learning_runsno sensitive capabilitylist_project_mission_runsno sensitive capabilitylist_project_policy_assignmentsno sensitive capabilitylist_project_policy_evaluationsno sensitive capabilitylist_project_science_evidenceno sensitive capabilitylist_project_shadow_learner_updatesno sensitive capabilitylist_project_skill_matchesno sensitive capabilitylist_project_training_packsno sensitive capabilitylist_runtime_domain_actionsno sensitive capabilitylist_sdk_runtime_outcomesno sensitive capabilitylist_server_workflow_improvement_packetsno sensitive capabilitylist_workflow_improvement_packetsno sensitive capabilitylist_workflowsno sensitive capabilitymanage_sdk_project_runtimeno sensitive capabilitynew_recursive_execution_idno sensitive capabilitypage_builder_chatno sensitive capabilitypage_builder_createno sensitive capabilitypage_builder_deployno sensitive capabilitypage_builder_list_sessionsno sensitive capabilitypage_builder_previewno sensitive capabilitypin_agent_marketplace_actionno sensitive capabilitypreflight_project_creationno sensitive capabilityprepare_project_learning_runno sensitive capabilityprepare_workflow_learning_handoffno sensitive capabilitypreview_agent_marketplace_action_publicationno sensitive capabilitypropose_contract_to_cash_invoiceno sensitive capabilitypublish_agent_marketplace_actionno sensitive capabilityrag_queryno sensitive capabilityrag_uploadno sensitive capabilityrecord_project_business_outcomeno sensitive capabilityrecord_project_learning_reviewno sensitive capabilityrecord_project_policy_assignmentno sensitive capabilityrecord_project_science_evidenceno sensitive capabilityrecord_workflow_improvement_delivery_eventno sensitive capabilityrecursive_agent_executeno sensitive capabilityrefine_project_creation_preflightno sensitive capabilityregister_contract_to_cash_cash_collectionno sensitive capabilityregister_contract_to_cash_invoice_issuedno sensitive capabilityregister_executed_commercial_agreementno sensitive capabilityregister_external_artifactno sensitive capabilityregister_runtime_domain_actionno sensitive capabilityrequest_agent_training_pair_admissionno sensitive capabilityresolve_executed_commercial_agreementno sensitive capabilityrun_business_primitiveno sensitive capabilityrun_connector_conformanceno sensitive capabilityrun_sdk_business_primitiveno sensitive capabilityrun_sdk_project_workflowno sensitive capabilityrun_workflowno sensitive capabilityrun_workflow_improvement_cycleno sensitive capabilitysearch_agent_marketplaceno sensitive capabilitysearch_documentsno sensitive capabilitysearch_folderno sensitive capabilitysoftware_delivery_contextno sensitive capabilitysoftware_delivery_loopno sensitive capabilitysoftware_spot_weld_fixno sensitive capabilitystart_codex_account_linkno sensitive capabilitystart_consulting_project_workflowno sensitive capabilitystart_contract_to_cash_runno sensitive capabilitystart_governed_communication_runno sensitive capabilitystart_operating_loopno sensitive capabilitystart_project_mission_runno sensitive capabilitystart_project_work_packetno sensitive capabilitystart_service_case_resolutionno sensitive capabilitystart_workflow_improvement_deliveryno sensitive capabilitysubmit_project_creation_preflight_feedbackno sensitive capabilitysync_workflow_improvement_reportno sensitive capabilitytest_agent_runtime_configno sensitive capabilitytrigger_workflowno sensitive capabilityuninstall_agent_marketplace_actionno sensitive capabilityvalidate_sdk_projectno sensitive capabilitywhat_can_you_dono sensitive capabilitywhere_isno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (200 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 4
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.23.0 latest |
B 89/100 | 8 | 1.13.0 | 2026-09-07 |
v0.22.0 |
B 89/100 | 8 | 1.13.0 | 2026-09-05 |
v0.20.0 |
B 89/100 | 8 | 1.13.0 | 2026-09-04 |
v0.8.0 |
A 93/100 | 7 | 1.13.0 | 2026-08-25 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan lightbulb-mcp --online --registry pypiMore in Developer Tools
Hotel booking MCP server — 300K+ properties, real confirmation numbers, loyalty programs. Builders monetize every booking via Stripe Connect. The first MCP server that completes real hotel reservations inside AI conversations.
Manage AdGuard Home through AI assistants
Read-only Azure DevOps for MCP clients using only your existing browser session — no PAT, no Azure CLI. Browse work items, pull requests, comments, attachments and Artifacts feeds across every project, repo and feed you can access.
MCP server for Adobe Experience Manager Assets integration development
Servidor MCP para el tiempo oficial de España (API pública OpenData de AEMET). Predicción, observación y avisos como herramientas MCP tipadas.
A standalone MCP stdio bridge for Affinity by Canva's local MCP SSE server.