Live survey286 models · 13 providers · 19,992 auditsAudited verification-before-completion · SAFE →What changedHow we verifyllms.txt

MCP server · Audited from source

javis-os MCP server

by blogminhquy/javis-osMIT licenceAudited 6 Oct 2026 · source 143ea0d464ea

PyPI javis-clistdiostreamable-http★ 222
✕BLOCKGrade F · 24/100 · 6 Oct 2026 · 143ea0d
Safer alternativesView source on GitHub ↗

Is it safe? No — BLOCK, grade F (24/100). It exposes 1 tool: 1 read, 0 write and 0 destructive. The audit recorded 79 findings (0 critical, 7 high, 18 medium, 39 low).

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “javis-os MCP server (blogminhquy/javis-os)”. Retrieved 6 Oct 2026. https://modelsatlas.com/mcp/blogminhquy/javis-os

Why this is BLOCK. The audit found 0 critical and 7 high findings; the most severe is Code injection at server/fastyaml.py:35. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 6 Oct 2026

Trust score24/100✕BLOCK F
0 critical7 high18 medium39 low15 info

79 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemDeclared12 observations
  • NetworkDeclared14 observations
  • ShellDeclared9 observations
  • DependenciesNot pinnedSome ranges float
  • SecretsNone foundNo keys in source

Findings (79)

Sorted by severity · the 25 most severe of 79 are listed

HIGHCode injectioncode.deserialize · server/fastyaml.py:35
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
return yaml.load(stream, Loader=_PyLoader)
Why
deserialises untrusted bytes into live objects
Fix
use json or yaml.safe_load
HIGHCode injectioncode.deserialize · server/fastyaml.py:37
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
return yaml.load(stream, Loader=_CLoader)
Why
deserialises untrusted bytes into live objects
Fix
use json or yaml.safe_load
HIGHCode injectioncode.deserialize · server/fastyaml.py:39
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
return yaml.load(stream, Loader=_PyLoader)
Why
deserialises untrusted bytes into live objects
Fix
use json or yaml.safe_load
HIGHCode injectioncode.eval_exec · dashboard/editor-cmds.js:174
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
if (c.mode() === "wys") exec(c, "createLink", u); else wrapTa(c, "[", "](" + u + ")", dich("ecmd.ph_text"));
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHFilesystem / pathfs.credential_store · server/pack_install.py:77
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
_TEN_CAM = (".env", ".git", "id_rsa", "id_dsa", "id_ecdsa", "id_ed25519")
Why
touches a credential store
Fix
—
HIGHFilesystem / pathfs.credential_store · server/pack_install.py:157
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
if thap in _TEN_CAM or thap.startswith("id_rsa"):
Why
touches a credential store
Fix
—
HIGHObfuscation / stealthobf.rtl_override · server/chatbot_reply_policy.py:127
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"[ᅟᅠ----ᅠ︀-︍"
Why
No further detail recorded for this rule.
Fix
—
MEDIUMInventory / provenanceinv.binary · server/data_phien_am/cmudict.txt.gz
F-13 Inventory / provenanceCWE-1104Layer L0
cmudict.txt.gz
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
MEDIUMCode injectioncode.dynamic_import · server/channels/__init__.py:113
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
m = importlib.import_module(ten)
Why
No further detail recorded for this rule.
Fix
—
MEDIUMCode injectioncode.dynamic_import · server/lexicon/__init__.py:83
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
mod = importlib.import_module(f"lexicon.{ma}")
Why
No further detail recorded for this rule.
Fix
—
MEDIUMCode injectioncode.dynamic_import · server/mcp_client.py:428
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
self.mod = importlib.import_module(_INTERNAL[name])
Why
No further detail recorded for this rule.
Fix
—
MEDIUMInsecure cryptocrypto.weak_random · dashboard/agent-avatar.js:70
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
const pick = o => Object.keys(o)[Math.floor(Math.random() * Object.keys(o).length)];
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.beacon_words · server/learn.py:284
F-04 Network egressCWE-200 · CWE-319Layer L1
r"|exfiltrat|gửi\s+.{0,20}(ra\s+ngoài|tới\s+http)"
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · Dockerfile:142
F-04 Network egressCWE-200 · CWE-319Layer L1
CMD python -c "import urllib.request,os,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:'+os.getenv('JAVIS_PORT','7777')+'/health',timeout=4).status==200 else 1)" || exit 1
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · JAVIS OS.bat:14
F-04 Network egressCWE-200 · CWE-319Layer L1
set "URL=http://127.0.0.1:%JAVIS_PORT%"
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · Start JAVIS OS.command:6
F-04 Network egressCWE-200 · CWE-319Layer L1
echo "JAVIS OS is running at http://127.0.0.1:7777"
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.zero_width · server/chatbot_reply_policy.py:127
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"[ᅟᅠ----ᅠ︀-︍"
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.zero_width · server/chatbot_reply_policy.py:128
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"ᅠ-\U000e0000-\U000e007f\U000e0100-\U000e01ef]|[︎️]{2,}")
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.zero_width · server/learn.py:297
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
return s[0] + "" + s[1:]   # chèn zero-width space → vỡ pattern lệnh
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.zero_width · server/system_sync.py:83
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
t = (text or "").replace("\r\n", "\n").replace("", "")
Why
No further detail recorded for this rule.
Fix
—
MEDIUMPrompt injectionprompt.hidden_style · docs/superpowers/plans/2026-07-18-update-triet-de.md:803
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
<div id="ovVerChangelog" style="display:none;margin:8px 0;padding:8px 10px;border-left:3px solid var(--accent,#6aa);background:rgba(120,140,160,.08);border-radius:6px;font-size:13px;line-height:1.6"><
Why
No further detail recorded for this rule.
Fix
—
MEDIUMPrompt injectionprompt.hidden_style · docs/superpowers/plans/2026-07-18-update-triet-de.md:806
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
<button class="gcard-btn" id="ovVerUpdate" style="display:none">⬆ Cập nhật ngay</button>
Why
No further detail recorded for this rule.
Fix
—
MEDIUMPrompt injectionprompt.hidden_style · docs/superpowers/plans/2026-07-18-update-triet-de.md:808
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
<div id="ovVerProgress" style="display:none;margin-top:10px"></div>
Why
No further detail recorded for this rule.
Fix
—
MEDIUMPrompt injectionprompt.hidden_style · docs/superpowers/plans/2026-07-18-update-triet-de.md:810
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
<div id="ovVerRollback" style="display:none;margin-top:10px;padding:10px;border:1px solid #c55;border-radius:8px;background:rgba(200,80,80,.08);font-size:13px;line-height:1.6"></div>
Why
No further detail recorded for this rule.
Fix
—
MEDIUMPrompt injectionprompt.hidden_style · docs/superpowers/plans/2026-09-15-cong-su-workspace.md:1959
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- Nút Huỷ: `box.querySelector("#cancelEd").onclick = () => { if (opts.host) return; moDong(false); };` và khi có host thì ẩn nút Huỷ: thêm `style="display:none"` nếu `opts.host`.
Why
No further detail recorded for this rule.
Fix
—

Tools it exposes

1 declared in source · 0 destructive

1 read0 write0 destructive
ToolWhat it doesRisk
Notesxread

Safer alternatives

All agent orchestration servers →
Taskflow✓SAFE

heggria/taskflow

DAG runtime for coding-agent workflows with verification, resume, replay, and effect checks.

1 destructiveGrade B
Agentloop✓SAFE

luckeyfaraday/athena-loops

MIT-licensed, backend-agnostic AI agent orchestration loop in Python: orchestrator→worker→reviewer as a deterministic harness. Drive coding-agent backends through an MCP server + CLI.

5 writeGrade B
Agent Board✓SAFE

quentintou/agent-board

Open-source multi-agent task board for OpenClaw. Kanban + DAG dependencies + MCP server + auto-retry + audit trail. Built for autonomous AI agent teams.

2 destructiveGrade B

Audit history

  1. ✕BLOCK F 24 / 100

    Score 28 -> 24 · 143ea0d464ea

  2. ✕BLOCK F 28 / 100

    First audit · ef70f247c32e

README badge

Badges show the current verdict, BLOCK included

ModelsAtlas: BLOCK FMODELSATLASBLOCK · F

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about javis-os MCP server

What tools does javis-os expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is javis-os safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (24/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does javis-os need?
It reads ELEVENLABS_API_KEY, JAVIS_ADMIN_PASSWORD, JAVIS_AGY_MCP_KEY, JAVIS_TEST_SECRET, JAVIS_TOKEN, WATCHTOWER_TOKEN and XAI_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does javis-os run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as javis-cli.
How current is this page?
The grade is for one exact copy of the source (143ea0d464ea), read on 2026-10-06. The repository is watched and re-audited when it changes.
I already installed javis-os. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

  • blogminhquy/javis-os on GitHub — the source we read, its licence, stars and activityObserved · 6 Oct 2026
  • ModelsAtlas trust audit — BLOCK verdict for commit 143ea0d464eaObserved · 6 Oct 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.