Truenas (spranab) MCP Server
truenas-mcp
npm
v1.0.0
Published by spranab — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
Comprehensive MCP server for TrueNAS SCALE — manage storage, shares, VMs, apps, network, and more via the Model Context Protocol
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 11 = 89. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −10 | capability blast radius (critical) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 3
critical Completed toxic-flow trifecta across toolsMTC-FLOW-002
This server (without client built-ins) exposes a complete data-exfiltration chain: reporting_graphs → cloudsync_list_directory → user_shell_choices. Untrusted input is ingested, private data is read, and it can be sent to an external sink via the agent composing the tools (→). Static analysis proves the primitive exists, not that a specific run will occur.
Fix: Remove one leg of the trifecta: isolate untrusted-input tools from secret-reading tools and from egress tools, or require human approval between them.
Location: flow reporting_graphs → cloudsync_list_directory → user_shell_choices
high Tool "user_shell_choices" exposes command/code executionMTC-CAP-001
Tool "user_shell_choices" appears to run shell commands or evaluate code (keyword "shell" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool user_shell_choices
low Mutating tool "user_shell_choices" declares no destructiveHintMTC-CAP-005
Tool "user_shell_choices" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool user_shell_choices
Tools 200
Each tool and what it can reach — statically extracted from the published source.
cloudsync_list_directoryreads sensitive datareporting_graphsingests untrusted inputupdate_downloadingests untrusted inputuser_shell_choicesruns code / shellacme_dns_authenticator_createno sensitive capabilityacme_dns_authenticator_deleteno sensitive capabilityacme_dns_authenticator_listno sensitive capabilityalert_categoriesno sensitive capabilityalert_dismissno sensitive capabilityalert_listno sensitive capability
Show 190 more tools ↓
alert_policiesno sensitive capabilityalert_restoreno sensitive capabilityalertservice_createno sensitive capabilityalertservice_deleteno sensitive capabilityalertservice_listno sensitive capabilityalertservice_testno sensitive capabilityalertservice_updateno sensitive capabilityaudit_configno sensitive capabilityaudit_config_updateno sensitive capabilityaudit_queryno sensitive capabilityboot_attach_diskno sensitive capabilityboot_detach_diskno sensitive capabilityboot_scrubno sensitive capabilityboot_stateno sensitive capabilitybootenv_activateno sensitive capabilitybootenv_createno sensitive capabilitybootenv_deleteno sensitive capabilitybootenv_keepno sensitive capabilitybootenv_listno sensitive capabilitycertificate_acme_serversno sensitive capabilitycertificate_createno sensitive capabilitycertificate_deleteno sensitive capabilitycertificate_getno sensitive capabilitycertificate_listno sensitive capabilitycloud_backup_abortno sensitive capabilitycloud_backup_createno sensitive capabilitycloud_backup_deleteno sensitive capabilitycloud_backup_listno sensitive capabilitycloud_backup_runno sensitive capabilitycloud_backup_snapshotsno sensitive capabilitycloud_backup_updateno sensitive capabilitycloudsync_abortno sensitive capabilitycloudsync_createno sensitive capabilitycloudsync_credentials_createno sensitive capabilitycloudsync_credentials_deleteno sensitive capabilitycloudsync_credentials_listno sensitive capabilitycloudsync_credentials_updateno sensitive capabilitycloudsync_credentials_verifyno sensitive capabilitycloudsync_deleteno sensitive capabilitycloudsync_getno sensitive capabilitycloudsync_listno sensitive capabilitycloudsync_list_bucketsno sensitive capabilitycloudsync_providersno sensitive capabilitycloudsync_restoreno sensitive capabilitycloudsync_runno sensitive capabilitycloudsync_updateno sensitive capabilitycronjob_createno sensitive capabilitycronjob_deleteno sensitive capabilitycronjob_listno sensitive capabilitycronjob_runno sensitive capabilitycronjob_updateno sensitive capabilitydirectory_services_cache_refreshno sensitive capabilitydirectory_services_configno sensitive capabilitydirectory_services_leaveno sensitive capabilitydirectory_services_statusno sensitive capabilitydirectory_services_updateno sensitive capabilitydisk_getno sensitive capabilitydisk_listno sensitive capabilitydisk_smart_test_listno sensitive capabilitydisk_smart_test_runno sensitive capabilitydisk_temperaturesno sensitive capabilitydisk_updateno sensitive capabilitydisk_wipeno sensitive capabilityfilesystem_chownno sensitive capabilityfilesystem_get_aclno sensitive capabilityfilesystem_listdirno sensitive capabilityfilesystem_mkdirno sensitive capabilityfilesystem_set_aclno sensitive capabilityfilesystem_set_permissionsno sensitive capabilityfilesystem_statno sensitive capabilityftp_configno sensitive capabilityftp_config_updateno sensitive capabilitygroup_createno sensitive capabilitygroup_deleteno sensitive capabilitygroup_getno sensitive capabilitygroup_listno sensitive capabilitygroup_updateno sensitive capabilityinitshutdown_createno sensitive capabilityinitshutdown_deleteno sensitive capabilityinitshutdown_listno sensitive capabilityinitshutdown_updateno sensitive capabilityiscsi_extent_createno sensitive capabilityiscsi_extent_deleteno sensitive capabilityiscsi_extent_listno sensitive capabilityiscsi_extent_updateno sensitive capabilityiscsi_global_configno sensitive capabilityiscsi_global_config_updateno sensitive capabilityiscsi_initiator_createno sensitive capabilityiscsi_initiator_deleteno sensitive capabilityiscsi_initiator_listno sensitive capabilityiscsi_portal_createno sensitive capabilityiscsi_portal_deleteno sensitive capabilityiscsi_portal_listno sensitive capabilityiscsi_portal_updateno sensitive capabilityiscsi_sessionsno sensitive capabilityiscsi_target_createno sensitive capabilityiscsi_target_deleteno sensitive capabilityiscsi_target_listno sensitive capabilityiscsi_target_updateno sensitive capabilityiscsi_targetextent_createno sensitive capabilityiscsi_targetextent_deleteno sensitive capabilityiscsi_targetextent_listno sensitive capabilitykerberos_configno sensitive capabilitykerberos_keytab_listno sensitive capabilitykerberos_realm_listno sensitive capabilitykeychaincredential_createno sensitive capabilitykeychaincredential_deleteno sensitive capabilitykeychaincredential_generate_ssh_keyno sensitive capabilitykeychaincredential_listno sensitive capabilitykeychaincredential_remote_ssh_scanno sensitive capabilitynetwork_checkinno sensitive capabilitynetwork_commit_changesno sensitive capabilitynetwork_configno sensitive capabilitynetwork_config_updateno sensitive capabilitynetwork_interface_createno sensitive capabilitynetwork_interface_deleteno sensitive capabilitynetwork_interface_getno sensitive capabilitynetwork_interface_listno sensitive capabilitynetwork_interface_updateno sensitive capabilitynetwork_ipmi_infono sensitive capabilitynetwork_rollback_changesno sensitive capabilitynetwork_static_route_createno sensitive capabilitynetwork_static_route_deleteno sensitive capabilitynetwork_static_route_listno sensitive capabilitynetwork_summaryno sensitive capabilitynfs_client_countno sensitive capabilitynfs_configno sensitive capabilitynfs_config_updateno sensitive capabilitynfs_share_createno sensitive capabilitynfs_share_deleteno sensitive capabilitynfs_share_getno sensitive capabilitynfs_share_listno sensitive capabilitynfs_share_updateno sensitive capabilitypool_attachmentsno sensitive capabilitypool_createno sensitive capabilitypool_exportno sensitive capabilitypool_getno sensitive capabilitypool_get_disksno sensitive capabilitypool_listno sensitive capabilitypool_replace_diskno sensitive capabilitypool_scrubno sensitive capabilitypool_statusno sensitive capabilitypool_updateno sensitive capabilityprivilege_createno sensitive capabilityprivilege_deleteno sensitive capabilityprivilege_listno sensitive capabilityprivilege_updateno sensitive capabilityreplication_createno sensitive capabilityreplication_deleteno sensitive capabilityreplication_getno sensitive capabilityreplication_listno sensitive capabilityreplication_restoreno sensitive capabilityreplication_runno sensitive capabilityreplication_updateno sensitive capabilityreporting_configno sensitive capabilityreporting_get_datano sensitive capabilityrsync_task_createno sensitive capabilityrsync_task_deleteno sensitive capabilityrsync_task_listno sensitive capabilityrsync_task_runno sensitive capabilityrsync_task_updateno sensitive capabilitysmb_configno sensitive capabilitysmb_config_updateno sensitive capabilitysmb_share_createno sensitive capabilitysmb_share_deleteno sensitive capabilitysmb_share_getno sensitive capabilitysmb_share_listno sensitive capabilitysmb_share_updateno sensitive capabilitysnmp_configno sensitive capabilitysnmp_config_updateno sensitive capabilityssh_configno sensitive capabilityssh_config_updateno sensitive capabilitytruenasno sensitive capabilitytruenas_api_callno sensitive capabilitytunable_createno sensitive capabilitytunable_deleteno sensitive capabilitytunable_listno sensitive capabilitytunable_updateno sensitive capabilityupdate_applyno sensitive capabilityupdate_checkno sensitive capabilityupdate_configno sensitive capabilityupdate_config_setno sensitive capabilityups_configno sensitive capabilityups_config_updateno sensitive capabilityuser_createno sensitive capabilityuser_deleteno sensitive capabilityuser_getno sensitive capabilityuser_listno sensitive capabilityuser_set_passwordno sensitive capabilityuser_updateno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (200 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.0.0 latest |
B 89/100 | 3 | 1.13.0 | 2026-09-07 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan truenas-mcp --onlineOther implementations of Truenas 2
Independent packages implementing the same tool, scanned with the same engine. Compare all 3 side by side →
Read-only MCP server for TrueNAS SCALE 25.10+ — JSON-RPC 2.0 WebSocket
Production-ready MCP server for TrueNAS Core - Control your NAS through natural language
More in Developer Tools
Hotel booking MCP server — 300K+ properties, real confirmation numbers, loyalty programs. Builders monetize every booking via Stripe Connect. The first MCP server that completes real hotel reservations inside AI conversations.
Manage AdGuard Home through AI assistants
Read-only Azure DevOps for MCP clients using only your existing browser session — no PAT, no Azure CLI. Browse work items, pull requests, comments, attachments and Artifacts feeds across every project, repo and feed you can access.
MCP server for Adobe Experience Manager Assets integration development
Servidor MCP para el tiempo oficial de España (API pública OpenData de AEMET). Predicción, observación y avisos como herramientas MCP tipadas.
A standalone MCP stdio bridge for Affinity by Canva's local MCP SSE server.