MCP server · Org-owned · Audited from source
AnkiMCP Server MCP server
by ankimcp/anki-mcp-server-addonNOASSERTION licenceAudited 19 Sep 2026 · source ea910062980d
streamable-http★ 76
Is it safe? With care — CAUTION, grade C (71/100). It exposes 4 tools: 2 read, 2 write and 0 destructive. The audit recorded 24 findings (0 critical, 0 high, 5 medium, 19 low). Maintainer's description: An Anki addon that implements an MCP server, enabling AI assistants to interact with Anki, the spaced repetition flashcard application.
Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
Cite
Cite this page
ModelsAtlas. “AnkiMCP Server MCP server (ankimcp/anki-mcp-server-addon)”. Retrieved 19 Sep 2026. https://modelsatlas.com/mcp/ankimcp/anki-mcp-server-addon
Trust audit
Audit 0.4.1 · full source read 19 Sep 2026
Trust score71/100!CAUTION C
0 critical0 high5 medium19 low0 info
24 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.
What the source does
- FilesystemDeclared5 observations
- NetworkDeclared2 observations
- ShellDeclared4 observations
- DependenciesNot pinnedSome ranges float
- SecretsNone foundNo keys in source
“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.
Five audit layers
| Layer | What we check | Result |
|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS |
L1 Static source | Secrets, path traversal, supply chain | WARN 22 findings |
L2 Instructions | Prompt injection and authority framing in docs and tool descriptions | PASS 1 finding |
L3 Inventory | Declared tools match the source | WARN 1 finding |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED |
Provenance & runtime
Who published it, and what the audit could and could not run
Provenance
- Repository owner
ankimcpOrganizationAccount type recorded when we read the repository. - PackageNo packageRuns from a repository checkout or a hosted URL.
- LicenceNOASSERTIONFrom the repository, as read at the audited commit.
- Last pushTodayActivity of the repository when we read it.
- Source commit readea910062980dThe audit covers exactly this commit, read on 19 Sep 2026.
Runtime
- Sandbox runNot run yetThis audit read the source only; it did not execute the server.
- Tool inventory4 declaredRead from the source and classed read, write or destructive.
Every value here is read from the record's own repository and audit.Suggest a correction
Findings (24)
Sorted by severity
MEDIUMCode injectioncode.dynamic_import · anki_mcp_server/__init__.py:119
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
importlib.import_module(pkg)
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMCode injectioncode.dynamic_import · anki_mcp_server/primitives/essential/resources/__init__.py:6
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
importlib.import_module(modname)
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMCode injectioncode.dynamic_import · anki_mcp_server/primitives/essential/tools/__init__.py:6
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
importlib.import_module(modname)
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMCode injectioncode.dynamic_import · anki_mcp_server/primitives/gui/tools/__init__.py:6
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
importlib.import_module(modname)
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMAuth / authzmcp.remote_no_auth
F-10 Auth / authzCWE-287 · CWE-862Layer L3
streamable-http
- Why
- a network transport with no auth environment variable found
- Fix
- require a token
LOWFilesystem / pathfs.credential_store · tests/e2e/test_media_security.py:27
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
("/home/user/.ssh/id_rsa", "no extension"),- Why
- touches a credential store
- Fix
- —
LOWFilesystem / pathfs.credential_store · tests/unit/test_media_validators.py:102
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
"id_rsa", # no extension (ssh key)
- Why
- touches a credential store
- Fix
- —
LOWFilesystem / pathfs.credential_store · tests/unit/test_media_validators.py:133
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
validate_media_file_path("/photos/image\0.ssh/id_rsa.jpg")- Why
- touches a credential store
- Fix
- —
LOWFilesystem / pathfs.system_paths · tests/e2e/test_media_security.py:26
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
("/etc/passwd", "no media extension"),- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.system_paths · tests/unit/test_media_validators.py:129
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
validate_media_file_path("/etc/passwd\0.jpg")- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · tests/e2e/test_media_security.py:99
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
"filename": "../../evil.png",
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · tests/unit/test_media_validators.py:446
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
assert sanitize_media_filename("../../evil.jpg") == "evil.jpg"- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · tests/unit/test_media_validators.py:465
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
result = sanitize_media_filename("../../../etc/passwd.jpg")- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.metadata_ip · tests/unit/test_media_validators.py:289
F-04 Network egressCWE-200 · CWE-319Layer L1
("169.254.169.254", "link-local / cloud metadata"),- Why
- cloud metadata endpoint: the classic SSRF credential grab
- Fix
- —
LOWNetwork egressnet.raw_ip · README.md:25
F-04 Network egressCWE-200 · CWE-319Layer L1
- **Local HTTP server** - Runs on `http://127.0.0.1:3141/` by default
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · README.md:132
F-04 Network egressCWE-200 · CWE-319Layer L1
"args": ["mcp-remote", "http://127.0.0.1:3141"]
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · README.md:143
F-04 Network egressCWE-200 · CWE-319Layer L1
claude mcp add anki --transport http http://127.0.0.1:3141/
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · README.md:149
F-04 Network egressCWE-200 · CWE-319Layer L1
opencode mcp add anki --url http://127.0.0.1:3141/
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · README.md:162
F-04 Network egressCWE-200 · CWE-319Layer L1
5. Use this URL in your AI client instead of `http://127.0.0.1:3141`
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.decode_call · anki_mcp_server/primitives/essential/tools/store_media_file_tool.py:46
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
return base64.b64decode(data), "base64"
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWPrivilege escalation / persistencepriv.escalate · .github/workflows/anki-compat.yml:154
F-06 Privilege escalation / persistenceCWE-269 · CWE-250Layer L1
sudo apt-get update -y && sudo apt-get install -y xvfb
- Why
- asks for elevated privileges
- Fix
- —
LOWSupply chainsupply.unpinned · requirements-dev.txt
F-08 Supply chainCWE-829 · CWE-1357Layer L1
pytest, pytest-asyncio, packaging
- Why
- 3 requirement(s) not pinned with ==
- Fix
- pin exact versions
LOWSupply chainsupply.unpinned · requirements.txt
F-08 Supply chainCWE-829 · CWE-1357Layer L1
mcp, uvicorn, starlette, websockets, packaging, typing-extensions
- Why
- 6 requirement(s) not pinned with ==
- Fix
- pin exact versions
LOWPrompt injectionprompt.transfer_instruction · CLAUDE.md:75
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
Both HTTP and tunnel transports share the same `Server` object (same handlers, same tools). Each runs its own `Server.run()` with separate streams and session state. Either can be enabled/disabled ind
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
Tools it exposes
4 declared in source · 0 destructive
2 read2 write0 destructive
| Tool | Risk | What it does |
|---|---|---|
add | write | Add two numbers. |
slow | write | A deliberately slow tool used to trigger the response timeout. |
echo_ping | read | Return the message tagged as a ping. |
echo_pong | read | Return the message tagged as a pong. |
Install
audited commit ea91006
Read the findings first. The most severe is Code injection (medium) at anki_mcp_server/__init__.py.
No connect command is recorded for this server yet. Follow the repository's own instructions, and read the findings above first.
Audit history
- !CAUTION C 71 / 100
Source changed, verdict held ·
ea910062980d - !CAUTION C 71 / 100
Source changed, verdict held ·
69375d39375c
README badge
For maintainers · updates on every re-audit
[](https://modelsatlas.com/mcp/ankimcp/anki-mcp-server-addon/)
The badge always shows the latest audit; a maintainer cannot pin an old verdict.
Other ratings
Cited, never blended into our score
No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.
Questions about AnkiMCP Server MCP server
What is the AnkiMCP Server MCP server?
An Anki addon that implements an MCP server, enabling AI assistants to interact with Anki, the spaced repetition flashcard application.
What tools does AnkiMCP Server expose?
4 in total: 2 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is AnkiMCP Server safe to connect to an agent?
With care. The audit graded it C (71/100) and found 24 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does AnkiMCP Server need?
No credential environment variables were found in its source, so it appears to need none.
How does AnkiMCP Server run?
It speaks streamable-http, so it runs as a service you connect to over the network.
How current is this page?
The grade is for one exact copy of the source (ea910062980d), read on 2026-09-19. The repository is watched and re-audited when it changes.
Sources
- ankimcp/anki-mcp-server-addon on GitHub — the source we read, its licence, stars and activityObserved · 19 Sep 2026
- ModelsAtlas trust audit — CAUTION verdict for commit ea910062980dObserved · 19 Sep 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What is the AnkiMCP Server MCP server?
- What tools does AnkiMCP Server expose?
- Is AnkiMCP Server safe to connect to an agent?