Voog MCP Server
voog-mcp
PyPI
v1.5.0
Published by runnel — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
CLI and MCP server for Voog CMS — Liquid templates, pages, products, ecommerce
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 1.2 = 99. What the published surface and source actually contain:
| Points | What was found | Category |
|---|---|---|
| −1.2 | Hardcoded AWS access key id in test/example/packaging MTC-SRC-008 | exfiltration |
2. Client adoption risk — 99 − 4 = 95. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 5
medium Unconstrained URL/host parameter "url" on "webhook_create"MTC-CAP-007
Tool "webhook_create" takes a URL/host parameter "url" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).
Fix: Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.
Location: tool webhook_create · inputSchema.properties.url
medium Unconstrained URL/host parameter "url" on "webhook_update"MTC-CAP-007
Tool "webhook_update" takes a URL/host parameter "url" with no allowlist/pattern. An outbound-request tool with an unbounded destination enables SSRF and cloud-metadata access (e.g. 169.254.169.254).
Fix: Allowlist destinations or constrain the parameter; block private/link-local addresses server-side.
Location: tool webhook_update · inputSchema.properties.url
low Hardcoded AWS access key id in test/example/packaging (tests/test_upload_validation.py)MTC-SRC-008
A hardcoded AWS access key id (a live-looking credential hardcoded in shipped code) appears in `tests/test_upload_validation.py:113`. Verify whether this is a real credential; if so, remove and rotate it.
Evidence: AWS access key id: AKIA…(redacted)
Fix: Remove the secret, rotate it, and load credentials from the environment or a secret store.
Location: server tests/test_upload_validation.py
low Shell/command execution in packaging/dev tooling (tests/test_cli_main.py)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_cli_main.py:251`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: and. return subprocess.run( [sys.executable, "-m", "voog", "--config", str(cfg), *argv],
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server tests/test_cli_main.py
low Shell/command execution in packaging/dev tooling (tests/test_mcp_integration.py)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_mcp_integration.py:59`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: } proc = subprocess.Popen( [str(VOOG_MCP_BIN)], stdin=subprocess.PIPE,
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server tests/test_mcp_integration.py
Tools 111
Each tool and what it can reach — statically extracted from the published source.
webhook_createnetwork egresswebhook_deletenetwork egresswebhook_updatenetwork egressarticle_add_contentno sensitive capabilityarticle_createno sensitive capabilityarticle_deleteno sensitive capabilityarticle_delete_datano sensitive capabilityarticle_getno sensitive capabilityarticle_publishno sensitive capabilityarticle_set_datano sensitive capability
Show 101 more tools ↓
article_updateno sensitive capabilityarticles_listno sensitive capabilityasset_replaceno sensitive capabilityasset_uploadno sensitive capabilitycart_rule_createno sensitive capabilitycart_rule_deleteno sensitive capabilitycart_rule_getno sensitive capabilitycart_rule_updateno sensitive capabilitycart_rules_listno sensitive capabilitycategories_listno sensitive capabilitycategory_createno sensitive capabilitycategory_deleteno sensitive capabilitycategory_getno sensitive capabilitycategory_updateno sensitive capabilitycomment_deleteno sensitive capabilitycomment_toggle_spamno sensitive capabilitycomments_listno sensitive capabilitycontent_partial_updateno sensitive capabilitydiscount_createno sensitive capabilitydiscount_deleteno sensitive capabilitydiscount_getno sensitive capabilitydiscount_updateno sensitive capabilitydiscounts_listno sensitive capabilityecommerce_settings_getno sensitive capabilityecommerce_settings_updateno sensitive capabilityelement_createno sensitive capabilityelement_definitions_listno sensitive capabilityelement_deleteno sensitive capabilityelement_getno sensitive capabilityelement_moveno sensitive capabilityelement_updateno sensitive capabilityelements_listno sensitive capabilitygateways_listno sensitive capabilitylanguage_createno sensitive capabilitylanguage_deleteno sensitive capabilitylanguages_listno sensitive capabilitylayout_asset_createno sensitive capabilitylayout_asset_deleteno sensitive capabilitylayout_asset_updateno sensitive capabilitylayout_asset_uploadno sensitive capabilitylayout_createno sensitive capabilitylayout_deleteno sensitive capabilitylayout_renameno sensitive capabilitylayout_updateno sensitive capabilitylayouts_pullno sensitive capabilitylayouts_pushno sensitive capabilitymedia_set_getno sensitive capabilitymedia_set_set_assetsno sensitive capabilitymedia_set_update_asset_titlesno sensitive capabilitynode_getno sensitive capabilitynode_moveno sensitive capabilitynode_relocateno sensitive capabilitynode_updateno sensitive capabilitynodes_listno sensitive capabilityorder_getno sensitive capabilityorders_listno sensitive capabilitypage_add_contentno sensitive capabilitypage_createno sensitive capabilitypage_deleteno sensitive capabilitypage_delete_datano sensitive capabilitypage_duplicateno sensitive capabilitypage_getno sensitive capabilitypage_set_datano sensitive capabilitypage_set_hiddenno sensitive capabilitypage_set_layoutno sensitive capabilitypage_updateno sensitive capabilitypages_listno sensitive capabilitypages_snapshotno sensitive capabilityproduct_createno sensitive capabilityproduct_deleteno sensitive capabilityproduct_duplicateno sensitive capabilityproduct_getno sensitive capabilityproduct_set_imagesno sensitive capabilityproduct_updateno sensitive capabilityproducts_bulk_actionno sensitive capabilityproducts_listno sensitive capabilityredirect_addno sensitive capabilityredirect_deleteno sensitive capabilityredirect_updateno sensitive capabilityredirects_listno sensitive capabilityshipping_methods_listno sensitive capabilitysite_cloneno sensitive capabilitysite_delete_datano sensitive capabilitysite_getno sensitive capabilitysite_set_datano sensitive capabilitysite_snapshotno sensitive capabilitysite_updateno sensitive capabilitytag_deleteno sensitive capabilitytag_getno sensitive capabilitytags_listno sensitive capabilitytext_getno sensitive capabilitytext_updateno sensitive capabilityvoog_admin_api_callno sensitive capabilityvoog_admin_api_readno sensitive capabilityvoog_ecommerce_api_callno sensitive capabilityvoog_ecommerce_api_readno sensitive capabilityvoog_list_my_sitesno sensitive capabilityvoog_list_sitesno sensitive capabilityvoog_reload_configno sensitive capabilityvoog_searchno sensitive capabilitywebhooks_listno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (111 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 2
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.5.0 latest |
A 95/100 | 5 | 1.13.0 | 2026-08-25 |
v1.4.1 |
A 96/100 | 3 | 1.12.1 | 2026-07-27 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan voog-mcp --online --registry pypiMore in Developer Tools
Hotel booking MCP server — 300K+ properties, real confirmation numbers, loyalty programs. Builders monetize every booking via Stripe Connect. The first MCP server that completes real hotel reservations inside AI conversations.
Manage AdGuard Home through AI assistants
Read-only Azure DevOps for MCP clients using only your existing browser session — no PAT, no Azure CLI. Browse work items, pull requests, comments, attachments and Artifacts feeds across every project, repo and feed you can access.
MCP server for Adobe Experience Manager Assets integration development
Servidor MCP para el tiempo oficial de España (API pública OpenData de AEMET). Predicción, observación y avisos como herramientas MCP tipadas.
A standalone MCP stdio bridge for Affinity by Canva's local MCP SSE server.