TerraDev MCP Server
terradev-mcp
npm
v2.0.8
Published by theoddden — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
GPU infrastructure server with 192 tools covering the training lifecycle, inference deployment with cost guardrails, Ray cluster management, and vLLM lifecycle.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 7 = 93. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 22
high Tool "train" exposes command/code executionMTC-CAP-001
Tool "train" appears to run shell commands or evaluate code (parameter "script"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool train
high Tool "ray_submit_job" exposes command/code executionMTC-CAP-001
Tool "ray_submit_job" appears to run shell commands or evaluate code (parameter "script"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool ray_submit_job
high Tool "ray_wide_ep_deploy" exposes command/code executionMTC-CAP-001
Tool "ray_wide_ep_deploy" appears to run shell commands or evaluate code (parameter "script"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool ray_wide_ep_deploy
high Tool "ray_disagg_pd_deploy" exposes command/code executionMTC-CAP-001
Tool "ray_disagg_pd_deploy" appears to run shell commands or evaluate code (parameter "script"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool ray_disagg_pd_deploy
high Tool "training_config_generate" exposes command/code executionMTC-CAP-001
Tool "training_config_generate" appears to run shell commands or evaluate code (parameter "script"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool training_config_generate
high Tool "training_launch_distributed" exposes command/code executionMTC-CAP-001
Tool "training_launch_distributed" appears to run shell commands or evaluate code (parameter "script"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool training_launch_distributed
high Shell/command execution in server code (terradev_mcp.py)MTC-SRC-002
In the server's implementation (`terradev_mcp.py:78`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: try: result = subprocess.run( ["terradev", "--version"], capture_output=True,
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server terradev_mcp.py
medium Untrusted input can drive an external actionMTC-FLOW-005
Untrusted-input tools ([hf_list_models, hf_list_datasets]) co-exist with external-action tools ([train, ray_submit_job, ray_wide_ep_deploy, ray_disagg_pd_deploy, training_config_generate, training_launch_distributed]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.
Evidence: untrusted [hf_list_models, hf_list_datasets] → sinks [train, ray_submit_job, ray_wide_ep_deploy, ray_disagg_pd_deploy, training_config_generate, training_launch
Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.
Location: flow hf_list_models → train
medium Unconstrained command parameter "script" on "train"MTC-CAP-006
Tool "train" takes a command-shaped parameter "script" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.
Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.
Location: tool train · inputSchema.properties.script
medium Unconstrained command parameter "script_args" on "train"MTC-CAP-006
Tool "train" takes a command-shaped parameter "script_args" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.
Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.
Location: tool train · inputSchema.properties.script_args
medium Unconstrained command parameter "script" on "ray_submit_job"MTC-CAP-006
Tool "ray_submit_job" takes a command-shaped parameter "script" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.
Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.
Location: tool ray_submit_job · inputSchema.properties.script
medium Unconstrained command parameter "generate_script" on "ray_wide_ep_deploy"MTC-CAP-006
Tool "ray_wide_ep_deploy" takes a command-shaped parameter "generate_script" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.
Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.
Location: tool ray_wide_ep_deploy · inputSchema.properties.generate_script
medium Unconstrained command parameter "generate_script" on "ray_disagg_pd_deploy"MTC-CAP-006
Tool "ray_disagg_pd_deploy" takes a command-shaped parameter "generate_script" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.
Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.
Location: tool ray_disagg_pd_deploy · inputSchema.properties.generate_script
medium Unconstrained command parameter "script" on "training_config_generate"MTC-CAP-006
Tool "training_config_generate" takes a command-shaped parameter "script" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.
Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.
Location: tool training_config_generate · inputSchema.properties.script
medium Unconstrained command parameter "script_args" on "training_config_generate"MTC-CAP-006
Tool "training_config_generate" takes a command-shaped parameter "script_args" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.
Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.
Location: tool training_config_generate · inputSchema.properties.script_args
medium Unconstrained command parameter "script" on "training_launch_distributed"MTC-CAP-006
Tool "training_launch_distributed" takes a command-shaped parameter "script" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.
Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.
Location: tool training_launch_distributed · inputSchema.properties.script
low Mutating tool "train" declares no destructiveHintMTC-CAP-005
Tool "train" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool train
low Mutating tool "ray_submit_job" declares no destructiveHintMTC-CAP-005
Tool "ray_submit_job" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool ray_submit_job
low Mutating tool "ray_wide_ep_deploy" declares no destructiveHintMTC-CAP-005
Tool "ray_wide_ep_deploy" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool ray_wide_ep_deploy
low Mutating tool "ray_disagg_pd_deploy" declares no destructiveHintMTC-CAP-005
Tool "ray_disagg_pd_deploy" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool ray_disagg_pd_deploy
low Mutating tool "training_config_generate" declares no destructiveHintMTC-CAP-005
Tool "training_config_generate" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool training_config_generate
low Mutating tool "training_launch_distributed" declares no destructiveHintMTC-CAP-005
Tool "training_launch_distributed" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool training_launch_distributed
Tools 192
Each tool and what it can reach — statically extracted from the published source.
hf_list_datasetsingests untrusted inputhf_list_modelsingests untrusted inputray_disagg_pd_deployruns code / shellray_submit_jobruns code / shellray_wide_ep_deployruns code / shelltrainruns code / shelltraining_config_generateruns code / shelltraining_launch_distributedruns code / shellactive_contextno sensitive capabilityanalyticsno sensitive capability
Show 182 more tools ↓
checkpoint_deleteno sensitive capabilitycheckpoint_listno sensitive capabilitycheckpoint_promoteno sensitive capabilitycheckpoint_restoreno sensitive capabilitycheckpoint_saveno sensitive capabilityconfigure_providerno sensitive capabilitycost_analyzeno sensitive capabilitycost_budget_optimizeno sensitive capabilitycost_optimize_recommendno sensitive capabilitycost_scaler_startno sensitive capabilitycost_scaler_statusno sensitive capabilitycost_simulateno sensitive capabilitydatadog_create_dashboardno sensitive capabilitydatadog_create_monitorsno sensitive capabilitydatadog_list_dashboardsno sensitive capabilitydatadog_list_monitorsno sensitive capabilitydatadog_metric_catalogno sensitive capabilitydatadog_push_metricsno sensitive capabilitydatadog_queryno sensitive capabilitydatadog_send_eventno sensitive capabilitydatadog_statusno sensitive capabilitydatadog_terraform_exportno sensitive capabilitydvc_diffno sensitive capabilitydvc_pushno sensitive capabilitydvc_stage_checkpointno sensitive capabilitydvc_statusno sensitive capabilityegress_cheapest_routeno sensitive capabilityegress_optimize_stagingno sensitive capabilitygitops_bootstrapno sensitive capabilitygitops_initno sensitive capabilitygitops_syncno sensitive capabilitygitops_validateno sensitive capabilitygovernance_compliance_reportno sensitive capabilitygovernance_evaluate_opano sensitive capabilitygovernance_move_datano sensitive capabilitygovernance_movement_historyno sensitive capabilitygovernance_record_consentno sensitive capabilitygovernance_request_consentno sensitive capabilitygpu_topologyno sensitive capabilityguardrails_chatno sensitive capabilityguardrails_generate_configno sensitive capabilityguardrails_k8sno sensitive capabilityguardrails_testno sensitive capabilityhelm_generateno sensitive capabilityhf_create_endpointno sensitive capabilityhf_delete_endpointno sensitive capabilityhf_endpoint_inferno sensitive capabilityhf_endpoint_infono sensitive capabilityhf_hardware_compareno sensitive capabilityhf_hardware_recommendno sensitive capabilityhf_list_endpointsno sensitive capabilityhf_model_infono sensitive capabilityhf_smart_templateno sensitive capabilityhf_space_deployno sensitive capabilityhf_space_statusno sensitive capabilityinfer_deployno sensitive capabilityinfer_failoverno sensitive capabilityinfer_routeno sensitive capabilityinfer_route_disaggno sensitive capabilityinfer_statusno sensitive capabilityinferx_configureno sensitive capabilityinferx_deleteno sensitive capabilityinferx_deployno sensitive capabilityinferx_listno sensitive capabilityinferx_optimizeno sensitive capabilityinferx_quoteno sensitive capabilityinferx_statusno sensitive capabilityinferx_usageno sensitive capabilityk8s_createno sensitive capabilityk8s_destroyno sensitive capabilityk8s_device_pluginno sensitive capabilityk8s_gpu_operator_installno sensitive capabilityk8s_infono sensitive capabilityk8s_listno sensitive capabilityk8s_mig_configureno sensitive capabilityk8s_monitoring_stackno sensitive capabilityk8s_time_slicingno sensitive capabilitykserve_generate_yamlno sensitive capabilitykserve_listno sensitive capabilitykserve_statusno sensitive capabilitylangchain_create_sglang_pipelineno sensitive capabilitylangchain_create_workflowno sensitive capabilitylanggraph_create_workflowno sensitive capabilitylanggraph_evaluation_workflowno sensitive capabilitylanggraph_orchestrator_workerno sensitive capabilitylanggraph_workflow_statusno sensitive capabilitylangsmith_create_projectno sensitive capabilitylangsmith_create_traceno sensitive capabilitylangsmith_get_workspacesno sensitive capabilitylangsmith_gpu_correlateno sensitive capabilitylangsmith_list_projectsno sensitive capabilitylangsmith_list_runsno sensitive capabilitylocal_scanno sensitive capabilitylora_addno sensitive capabilitylora_listno sensitive capabilitylora_removeno sensitive capabilitymanage_instanceno sensitive capabilitymanifestsno sensitive capabilitymlflow_list_experimentsno sensitive capabilitymlflow_log_runno sensitive capabilitymlflow_register_modelno sensitive capabilitymoe_deployno sensitive capabilityollama_chatno sensitive capabilityollama_generateno sensitive capabilityollama_listno sensitive capabilityollama_model_infono sensitive capabilityollama_pullno sensitive capabilityoptimizeno sensitive capabilityorchestrator_evictno sensitive capabilityorchestrator_inferno sensitive capabilityorchestrator_loadno sensitive capabilityorchestrator_registerno sensitive capabilityorchestrator_startno sensitive capabilityorchestrator_statusno sensitive capabilityphoenix_k8sno sensitive capabilityphoenix_otel_envno sensitive capabilityphoenix_projectsno sensitive capabilityphoenix_snippetno sensitive capabilityphoenix_spansno sensitive capabilityphoenix_testno sensitive capabilityphoenix_traceno sensitive capabilitypreflightno sensitive capabilitypreflight_gpu_checkno sensitive capabilitypreflight_network_checkno sensitive capabilitypreflight_reportno sensitive capabilityprice_budget_optimizeno sensitive capabilityprice_discoveryno sensitive capabilityprice_intelno sensitive capabilityprice_spot_riskno sensitive capabilityprice_trendsno sensitive capabilityprovision_gpuno sensitive capabilityqdrant_collectionsno sensitive capabilityqdrant_countno sensitive capabilityqdrant_create_collectionno sensitive capabilityqdrant_infono sensitive capabilityqdrant_k8sno sensitive capabilityqdrant_testno sensitive capabilityquote_gpuno sensitive capabilityray_list_jobsno sensitive capabilityray_parallelism_strategyno sensitive capabilityray_startno sensitive capabilityray_statusno sensitive capabilityray_stopno sensitive capabilityrollbackno sensitive capabilityrun_workflowno sensitive capabilitysetup_providerno sensitive capabilitysglang_inferenceno sensitive capabilitysglang_metricsno sensitive capabilitysglang_startno sensitive capabilitysglang_stopno sensitive capabilitysmart_deployno sensitive capabilitystageno sensitive capabilitystatusno sensitive capabilityterraform_applyno sensitive capabilityterraform_destroyno sensitive capabilityterraform_planno sensitive capabilityterraform_statusno sensitive capabilitytrain_detect_stragglersno sensitive capabilitytrain_monitorno sensitive capabilitytrain_resumeno sensitive capabilitytrain_snapshotno sensitive capabilitytrain_statusno sensitive capabilitytrain_stopno sensitive capabilityupno sensitive capabilityvllm_inferenceno sensitive capabilityvllm_infono sensitive capabilityvllm_sleepno sensitive capabilityvllm_startno sensitive capabilityvllm_stopno sensitive capabilityvllm_wakeno sensitive capabilitywandb_create_dashboardno sensitive capabilitywandb_create_reportno sensitive capabilitywandb_create_terradev_alertsno sensitive capabilitywandb_create_terradev_dashboardno sensitive capabilitywandb_create_terradev_reportno sensitive capabilitywandb_dashboard_statusno sensitive capabilitywandb_list_projectsno sensitive capabilitywandb_list_runsno sensitive capabilitywandb_run_detailsno sensitive capabilitywandb_setup_alertsno sensitive capabilitywarm_pool_startno sensitive capabilitywarm_pool_statusno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (192 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v2.0.8 latest |
A 93/100 | 22 | 1.13.0 | 2026-08-25 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan terradev-mcp --onlineMore in Cloud & DevOps
Operator control CLI for AdGuard Home with an MCP adapter
interacting with Aliyun (Alibaba Cloud) services through This MCP server provides tools.
MCP server for the Aspro.Cloud REST API
MCP server for Atlassian Confluence and Jira Cloud APIs
AuroraCloud-first MCP server that exposes AuroraDocs workspace data to Claude Desktop and other AI agents
The official AWS Knowledge Base retrieval server using Bedrock Agent Runtime.