App Builder SDKBLOCK
mcp/baidubce/app-builder-sdk
appbuilder-sdk, 千帆AppBuilder-SDK帮助开发者灵活、快速的搭建AI原生应用
Verdict
BLOCK
Grade
F
Trust score
52 /100
Exposed tools
13 8r · 5w · 0d
Transport
stdio
License
Apache-2.0
Stars
586
01
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](LICENSE)
简体中文 | English | 日本語
什么是AppBuilder-SDK
百度智能云千帆AppBuilder-SDK是百度智能云千帆AppBuilder面向AI原生应用开发者提供的一站式开发平台的客户端SDK。
AppBuilder-SDK 有哪些功能?
百度智能云千帆AppBuilder-SDK提供了以下AI应用开发者的必备功能:
- 调用
- 调用大模型,可自由调用您在百度智能云千帆大模型平台的模型,开发并调优prompt
- 调用能力组件,提供40+个源于百度生态的优质组件,赋能Agent应用
- 调用AI原生应用,通过AppBuilderClient可访问并管理在百度智能云千帆AppBuilder网页端发布的AI原生应用,并可注册本地函数联动端云组件
- 编排
- 配置知识库,通过KnowledgeBase管理知识库,进行文档及知识切片的增删改查,配合网页端开发产业级的
RAG应用 - 编排工作流,提供了
Message、Component、AgentRuntime多级工作流抽象,实现工作流编排,并可与LangChain、OpenAI等业界生态能力打通 - 监控
- 提供了可视化Tracing、详细DebugLog等监控工具,助力开发者在生产环境应用
- 部署
AgentRuntime支持部署为基于Flask与gunicorn的API服务AgentRuntime支持部署为基于Chainlit的对话框交互前端- 提供了
appbuilder_bce_deploy工具,可快速部署程序到百度云,提供公网API服务,联动AppBuilder工作流
使用 AppBuilder-SDK 可以构建什么应用?
产业级RAG应用
AppBuilder-SDK提供多类型组件,覆盖以下构建产业级RAG应用的完整步骤:
- 文档解析(Parser)
- 文档切片(Chunker)
- 切片向量化(Embedding)
- 索引构建(Indexing)
- 切片召回(Retrieval)
- 答案生成(Answer Generation)
AppBuilder-SDK不仅提供了百度智能云提供的基础能力组件,同时提供经过深度优化的大模型高级能力组件,可以组合下表提供的原子能力组件,构建个性化的RAG应用RAG 原子能力 CookBook:
Read from source at commit
fc1aafdce37fOBSERVED · 2026-09-2902
Exposed tools (13)
8 read · 5 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
AIsearch | read | |
add | write | Add two numbers |
create_conversation | write | |
create_knowledge_base | write | |
describe_knowledge_base | read | |
get_alerts | read | Get weather alerts for a US state. |
get_forecast | read | Get weather forecast for a location. |
list_apps | read | |
list_documents | read | |
list_knowledge_bases | read | |
query_knowledge_base | read | |
run | write | |
upload_document | write |
03
Trust audit
BLOCKgrade F · trust 52/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (10 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
python/mcp_server/sse.py:141
json_data = pickle.loads(message["data"])
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95
python/utils/bce_deploy.py:44
config = yaml.load(f, Loader=yaml.FullLoader)
Why it matters. deserialises untrusted bytes into live objects
Fix. use json or yaml.safe_load
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
docs/BasisModule/Platform/CustomComponents/component_client.md:257
| name | string | 是 | 事件名。一级深度有:component,组件apifunctioncall,自主规划agentchatflow,工作流agent二级深度是组件ID三级深度是组件content_type示例:/component/eaaccc60e222418abc0f4d3d372018af/node/433b4cf184064daf88
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
docs/BasisModule/Platform/CustomComponents/component_client.md:419
| Name | string | 是 | 事件名。一级深度有:component,组件apifunctioncall,自主规划agentchatflow,工作流agent二级深度是组件ID三级深度是组件content_type示例:/component/eaaccc60e222418abc0f4d3d372018af/node/433b4cf184064daf88
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
cookbooks/components/agent_runtime.ipynb:101
"curl --location 'http://0.0.0.0:8091/chat' \\\n",
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
cookbooks/components/agent_runtime.ipynb:545
"curl --location 'http://0.0.0.0:8091/chat' \\\n",
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
cookbooks/components/rag_with_baidusearch.ipynb:196
"curl --location 'http://0.0.0.0:8092/chat' \\\n",
LOWInventory / provenance · inv.binary · CWE-1104
python/tests/data/qa_demo.xlsx
qa_demo.xlsx
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
python/tests/title_splitter.docx
title_splitter.docx
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.hidden_file · CWE-1104
.env_template
.env_template
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
python/tests/component_collector.py:94
component_obj = eval(import_prefix+component)
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
python/tests/parallel_ut_run.py:211
message = eval(line.split("\n")[0])Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
python/tests/test_appbuilder_assistant_trace.py:68
func_res = self.get_cur_whether(**eval(arguments))
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
python/tests/test_assistant_e2e_funccall.py:72
func_res = get_cur_whether(**eval(tool_call.function.arguments))
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
python/tests/test_assistant_e2e_stream_event_handler.py:48
func_res = self.get_cur_whether(**eval(arguments))
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
docs/Tools/JavaAPI/java_api_update.sh:2
cd ../../..
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
docs/Tools/SphinxSh/get_components_md.py:22
def update_mkdocs_yml(results, mkdocs_path='../../../mkdocs.yml'):
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
docs/Tools/SphinxSh/get_components_md.py:56
base_path = '../../BasisModule/Components' # 当前目录
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
docs/Tools/SphinxSh/source/conf.py:12
sys.path.insert(0, os.path.abspath('../../../appbuilder'))LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
docs/Tools/SphinxSh/update_doc.sh:7
cd ../../..
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
go/appbuilder/agent_builder_test.go:114
agentBuilder.sdkConfig.GatewayURLV2 = "http://192.0.2.1"
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
go/appbuilder/agent_builder_test.go:170
agentBuilder.sdkConfig.GatewayURLV2 = "http://192.0.2.1"
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
python/core/components/tts/component.py:236
yield base64.b64decode(chunk)
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
python/mcp_server/server.py:194
image_byte = io.BytesIO(base64.b64decode(base64_data))
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
python/mcp_server/server.py:228
audio_byte = io.BytesIO(base64.b64decode(base64_data))
Gates applied: no_behavioural_pass.
Audited 2026-09-29 · audit v0.4.1 · source sha
fc1aafdce37ffull audit observations/trust-audit/mcp-server/baidubce__app-builder-sdk.json · Report an issue / request a re-scan04
Audit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-09-29 | fc1aafdce37f | BLOCK | F | 52 | first audit |
05
Questions
What is the App Builder SDK MCP server?
appbuilder-sdk, 千帆AppBuilder-SDK帮助开发者灵活、快速的搭建AI原生应用
What tools does App Builder SDK expose?
13 in total: 8 read-only, 5 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is App Builder SDK safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (52/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does App Builder SDK need?
It reads APPBUILDER_TOKEN, APPBUILDER_TOKEN_PPT_GENERATION, APPBUILDER_TOKEN_V2, BAIDU_VDB_API_KEY, CSRFTOKEN, SECRET_KEY and SECRET_KEY_PREFIX from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does App Builder SDK run?
It speaks stdio, so it runs as a local process your client starts.
How current is this page?
The grade is for one exact copy of the source (fc1aafdce37f), read on 2026-09-29. The repository is watched and re-audited when it changes.