Cli MCP Server
@phren/cli
npm
v0.1.39
Source verified
Published by alaarab — publish provenance cryptographically ties this package to that repository. That is proof of origin, not an official vendor package.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 21.7 = 78. What the published surface and source actually contain:
| Points | What was found | Category |
|---|---|---|
| −15.4 | Unsafe deserialization ×10 MTC-SRC-007 | permissions |
| −6.3 | Untrusted input concatenated into a command sink MTC-SRC-009 | injection |
2. Client adoption risk — 78 − 10 = 68. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −10 | capability blast radius (critical) — client exposure if the model is manipulated |
| ✓ | publisher verification (provenance) — cryptographic build provenance ties the artifact to its source |
| ✓ | inspection depth (source) — how much of the target the scan could see |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 31
critical Completed toxic-flow trifecta across toolsMTC-FLOW-002
This server (without client built-ins) exposes a complete data-exfiltration chain: get_memory_detail → add_custom_hook → remove_custom_hook. Untrusted input is ingested, private data is read, and it can be sent to an external sink via the agent composing the tools (→). Static analysis proves the primitive exists, not that a specific run will occur.
Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.
Location: flow get_memory_detail → add_custom_hook → remove_custom_hook
high Read-and-egress in one tool: "add_custom_hook"MTC-FLOW-003
Tool "add_custom_hook" can both read sensitive data and send data to an external destination. Even without an explicit untrusted-input leg, this is a single-call data-exfiltration path if the model is ever manipulated.
Fix: Separate reading from sending; require explicit user confirmation before egress of file/secret contents.
Location: flow add_custom_hook
high Tool "add_custom_hook" exposes command/code executionMTC-CAP-001
Tool "add_custom_hook" appears to run shell commands or evaluate code (parameter "command"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool add_custom_hook
high Tool "remove_custom_hook" exposes command/code executionMTC-CAP-001
Tool "remove_custom_hook" appears to run shell commands or evaluate code (parameter "command"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool remove_custom_hook
high Shell/command execution in server code (dist/cli-hooks-git.js)MTC-SRC-002
In the server's implementation (`dist/cli-hooks-git.js:8`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: child_process
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/cli-hooks-git.js
high Shell/command execution in server code (dist/cli/extract.js)MTC-SRC-002
In the server's implementation (`dist/cli/extract.js:13`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: child_process
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/cli/extract.js
high Shell/command execution in server code (dist/cli/govern.js)MTC-SRC-002
In the server's implementation (`dist/cli/govern.js:235`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: child_process
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/cli/govern.js
high Shell/command execution in server code (dist/cli/namespaces-store.js)MTC-SRC-002
In the server's implementation (`dist/cli/namespaces-store.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: child_process
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/cli/namespaces-store.js
high Shell/command execution in server code (dist/cli/namespaces-utils.js)MTC-SRC-002
In the server's implementation (`dist/cli/namespaces-utils.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: child_process
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/cli/namespaces-utils.js
high Shell/command execution in server code (dist/cli/ops.js)MTC-SRC-002
In the server's implementation (`dist/cli/ops.js:3`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: child_process
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/cli/ops.js
high Shell/command execution in server code (dist/cli/session-git.js)MTC-SRC-002
In the server's implementation (`dist/cli/session-git.js:5`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: child_process
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/cli/session-git.js
high Shell/command execution in server code (dist/cli/team.js)MTC-SRC-002
In the server's implementation (`dist/cli/team.js:7`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: child_process
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/cli/team.js
high Shell/command execution in server code (dist/content/validate.js)MTC-SRC-002
In the server's implementation (`dist/content/validate.js:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: child_process
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/content/validate.js
high Shell/command execution in server code (dist/hooks.js)MTC-SRC-002
In the server's implementation (`dist/hooks.js:5`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: child_process
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/hooks.js
medium Hardcoded egress to an external endpoint (dist/embedding.js)MTC-SRC-003
In the server's implementation (`dist/embedding.js:178`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: fetch("https://api.openai.com/v1/embeddings"
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/embedding.js
medium Untrusted input concatenated into a command sink (dist/shared/search-fallback.js)MTC-SRC-009
In the server's implementation (`dist/shared/search-fallback.js:88`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: exec(`SELECT rowid, project, filename, type, content, path FROM docs WHERE ${
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/shared/search-fallback.js
medium Unconstrained command parameter "command" on "add_custom_hook"MTC-CAP-006
Tool "add_custom_hook" takes a command-shaped parameter "command" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.
Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.
Location: tool add_custom_hook · inputSchema.properties.command
medium Unconstrained command parameter "command" on "remove_custom_hook"MTC-CAP-006
Tool "remove_custom_hook" takes a command-shaped parameter "command" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.
Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.
Location: tool remove_custom_hook · inputSchema.properties.command
medium Unsafe deserialization (dist/data/access.js)MTC-SRC-007
In the server's implementation (`dist/data/access.js:114`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: yaml.load(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/data/access.js
medium Unsafe deserialization (dist/init/setup.js)MTC-SRC-007
In the server's implementation (`dist/init/setup.js:45`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: yaml.load(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/init/setup.js
medium Unsafe deserialization (dist/link/context.js)MTC-SRC-007
In the server's implementation (`dist/link/context.js:28`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: yaml.load(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/link/context.js
medium Unsafe deserialization (dist/link/link.js)MTC-SRC-007
In the server's implementation (`dist/link/link.js:50`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: yaml.load(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/link/link.js
medium Unsafe deserialization (dist/link/skills.js)MTC-SRC-007
In the server's implementation (`dist/link/skills.js:19`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: yaml.load(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/link/skills.js
medium Unsafe deserialization (dist/phren-paths.js)MTC-SRC-007
In the server's implementation (`dist/phren-paths.js:95`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: yaml.load(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/phren-paths.js
medium Unsafe deserialization (dist/profile-store.js)MTC-SRC-007
In the server's implementation (`dist/profile-store.js:57`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: yaml.load(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/profile-store.js
medium Unsafe deserialization (dist/project-config.js)MTC-SRC-007
In the server's implementation (`dist/project-config.js:65`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: yaml.load(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/project-config.js
medium Unsafe deserialization (dist/shared/index.js)MTC-SRC-007
In the server's implementation (`dist/shared/index.js:45`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: yaml.load(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/shared/index.js
medium Unsafe deserialization (dist/store-registry.js)MTC-SRC-007
In the server's implementation (`dist/store-registry.js:43`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: yaml.load(
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/store-registry.js
low Mutating tool "add_custom_hook" declares no destructiveHintMTC-CAP-005
Tool "add_custom_hook" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool add_custom_hook
low Mutating tool "remove_custom_hook" declares no destructiveHintMTC-CAP-005
Tool "remove_custom_hook" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool remove_custom_hook
low Unconstrained path parameter "path" on "add_project"MTC-CAP-008
Tool "add_project" takes a path parameter "path" with no constraint. Without a canonicalize-and-contain check (not visible statically), this permits ../ traversal outside the intended root.
Fix: Resolve and verify the path stays within an allowed root; reject traversal sequences.
Location: tool add_project · inputSchema.properties.path
Tools 59
Each tool and what it can reach — statically extracted from the published source.
add_custom_hooknetwork egressruns code / shellreads sensitive dataadd_projectreads sensitive dataget_memory_detailingests untrusted inputremove_custom_hookruns code / shelladd_findingno sensitive capabilityadd_noteno sensitive capabilityadd_taskno sensitive capabilityauto_extract_findingsno sensitive capabilitycomplete_taskno sensitive capabilitycross_project_fragmentsno sensitive capabilitydoctor_fixno sensitive capabilityedit_findingno sensitive capabilityedit_noteno sensitive capabilityexport_projectno sensitive capabilityget_configno sensitive capabilityget_contradictionsno sensitive capabilityget_findingsno sensitive capabilityget_notesno sensitive capabilityget_project_summaryno sensitive capabilityget_related_docsno sensitive capabilityget_review_queueno sensitive capabilityget_tasksno sensitive capabilityget_truthsno sensitive capabilityhealth_checkno sensitive capabilityimport_projectno sensitive capabilitylink_findingsno sensitive capabilitylist_hook_errorsno sensitive capabilitylist_hooksno sensitive capabilitylist_projectsno sensitive capabilitylist_skillsno sensitive capabilitymanage_projectno sensitive capabilitymanage_review_itemno sensitive capabilitymemory_feedbackno sensitive capabilitypin_memoryno sensitive capabilitypin_taskno sensitive capabilitypromote_noteno sensitive capabilitypush_changesno sensitive capabilityread_graphno sensitive capabilityread_skillno sensitive capabilityremove_findingno sensitive capabilityremove_noteno sensitive capabilityremove_skillno sensitive capabilityremove_taskno sensitive capabilityresolve_contradictionno sensitive capabilityretract_findingno sensitive capabilitysearch_fragmentsno sensitive capabilitysearch_knowledgeno sensitive capabilitysession_contextno sensitive capabilitysession_endno sensitive capabilitysession_historyno sensitive capabilitysession_startno sensitive capabilityset_configno sensitive capabilitystore_listno sensitive capabilitysupersede_findingno sensitive capabilitytidy_done_tasksno sensitive capabilitytoggle_hooksno sensitive capabilitytoggle_skillno sensitive capabilityupdate_taskno sensitive capabilitywrite_skillno sensitive capability
Toxic flows 2
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (59 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.1.39 latest |
D 68/100 | 31 | 1.8.0 | 2026-07-23 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan @phren/cli --onlineMore in Developer Tools
Security scan results for the 1stay MCP server.
Security scan results for the Adguard Home MCP server.
Security scan results for the Ado Browser MCP server.
Security scan results for the Adobe Experience Dev MCP server.
Security scan results for the Aemet MCP server.
Security scan results for the Agent MCP server.