Marm MCP Server
marm-mcp-server
PyPI
v2.47.0
Published by lyellr88 — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
Local-first 3-in-1 AI memory layer & MCP server for Claude Code, Codex, Grok, Gemini, VS Code and Cursor. Fuses session history, codebase indices & concept graphs in SQLite. Enables zero-cloud, privacy-first context & instant recall also works with multi-agent swarms.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 7 = 93. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 10
high Shell/command execution in server code (marm_graph/core/cbm_client.py)MTC-SRC-002
In the server's implementation (`marm_graph/core/cbm_client.py:116`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: try: proc = subprocess.Popen(self._command, **popen_kwargs) except (OSError, ValueError) as e:
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server marm_graph/core/cbm_client.py
high Shell/command execution in server code (marm_mcp_server/console/cli.py)MTC-SRC-002
In the server's implementation (`marm_mcp_server/console/cli.py:102`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: : process = subprocess.Popen( [sys.executable, "-m", "marm_mcp_server.console.cli", "--serve
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server marm_mcp_server/console/cli.py
high Shell/command execution in server code (marm_mcp_server/console/terminal/pty_session.py)MTC-SRC-002
In the server's implementation (`marm_mcp_server/console/terminal/pty_session.py:293`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: @classmethod def spawn( cls, *, emit: Callable[[dict], None], shell: str | None =
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server marm_mcp_server/console/terminal/pty_session.py
high Shell/command execution in server code (marm_mcp_server/console/terminal/router.py)MTC-SRC-002
In the server's implementation (`marm_mcp_server/console/terminal/router.py:180`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: try: result = subprocess.run( _check_command_args(shell, req.command), capture_output=
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server marm_mcp_server/console/terminal/router.py
high Shell/command execution in server code (marm_mcp_server/core/graph_index_worker.py)MTC-SRC-002
In the server's implementation (`marm_mcp_server/core/graph_index_worker.py:65`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: try: proc = subprocess.run( ["git", "-c", "core.fsmonitor=false", "-C", root, *args],
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server marm_mcp_server/core/graph_index_worker.py
high Shell/command execution in server code (marm_mcp_server/core/runtime_manager.py)MTC-SRC-002
In the server's implementation (`marm_mcp_server/core/runtime_manager.py:317`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: file: process = subprocess.Popen( command, stdin=subprocess.DEVNULL, stdout=
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server marm_mcp_server/core/runtime_manager.py
high Shell/command execution in server code (marm_mcp_server/services/docker_commands.py)MTC-SRC-002
In the server's implementation (`marm_mcp_server/services/docker_commands.py:193`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: try: result = subprocess.run(arguments, capture_output=True, text=True, check=False) except OSError as exc
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server marm_mcp_server/services/docker_commands.py
high Shell/command execution in server code (marm_mcp_server/services/package_management.py)MTC-SRC-002
In the server's implementation (`marm_mcp_server/services/package_management.py:121`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: =={version}" return subprocess.call( [sys.executable, "-m", "pip", "install", "--upgrade", target] ) d
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server marm_mcp_server/services/package_management.py
low Shell/command execution in packaging/dev tooling (tests/test_cli_entrypoint.py)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_cli_entrypoint.py:33`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: Y", None) result = subprocess.run( [sys.executable, "-m", "marm_mcp_server", *arguments], cwd=os.ge
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server tests/test_cli_entrypoint.py
low Shell/command execution in packaging/dev tooling (tests/test_command_smoke.py)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_command_smoke.py:137`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: rocess[str]: return subprocess.run( [ str(python_executable or sys.executable), "-c"
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server tests/test_command_smoke.py
Tools 5
Each tool and what it can reach — statically extracted from the published source.
marm_code_lookupno sensitive capabilitymarm_graph_architectureno sensitive capabilitymarm_graph_impactno sensitive capabilitymarm_graph_indexno sensitive capabilitymarm_graph_traceno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (5 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 10
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v2.47.0 latest |
A 93/100 | 10 | 1.13.0 | 2026-09-04 |
v2.45.0 |
A 93/100 | 10 | 1.13.0 | 2026-08-30 |
v2.44.5 |
A 93/100 | 10 | 1.13.0 | 2026-08-29 |
v2.44.3 |
A 93/100 | 10 | 1.13.0 | 2026-08-28 |
v2.44.0 |
A 93/100 | 10 | 1.13.0 | 2026-08-25 |
Show 5 more versions ↓
v2.42.0 |
A 93/100 | 10 | 1.12.1 | 2026-08-24 |
v2.41.1 |
A 93/100 | 10 | 1.12.1 | 2026-08-23 |
v2.40.0 |
A 93/100 | 10 | 1.12.1 | 2026-08-20 |
v2.39.0 |
A 93/100 | 10 | 1.12.1 | 2026-08-18 |
v2.37.0 |
A 93/100 | 10 | 1.12.1 | 2026-08-05 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan marm-mcp-server --online --registry pypiMore in API Development
Adapters for the FrontMCP framework
Transcend MCP Server — Admin tools.
Transcend MCP Server — Assessments tools.
MCP Server for Bling
MCP Server for Blogger API
Official MCP server for Brilliant Directories — manage members, posts, leads, reviews, and more.