MCP server · Audited from source

Fast Agent MCP server

Q: What tools does Fast Agent expose?

85 in total: 75 read-only, 10 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Q: Is Fast Agent safe to connect to an agent?

With care. The audit graded it F (49/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.

Q: What credentials does Fast Agent need?

It reads ANTHROPIC_API_KEY, CODEX_API_KEY, CODEX_AUTH_JSON_PATH, COPILOT_GITHUB_TOKEN, DEEPSEEK_API_KEY, DEMO_TOKEN, FAST_AGENT_HF_TOKEN_SOURCE, FAST_AGENT_OAUTH_CLIENT_METADATA_URL, FAST_AGENT_OAUTH_RESOURCE_URL, FAST_AGENT_OAUTH_SCOPES, FAST_AGENT_PRIVACY_FILTER_MAX_WINDOW_TOKENS and FAST_AGENT_PRIVACY_FILTER_WINDOW_OVERLAP_TOKENS from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

Q: How does Fast Agent run?

It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as fast-agent-mcp.

Q: How current is this page?

The grade is for one exact copy of the source (6658690c05bc), read on 2026-09-21. The repository is watched and re-audited when it changes.

by evalstate/fast-agentApache-2.0 licenceAudited 21 Sep 2026 · source 6658690c05bc

PyPI fast-agent-mcpssestdiostreamable-http★ 3,921

!CAUTIONGrade F · 49/100 · 21 Sep 2026 · 6658690

3,921GitHub stars

Install View source on GitHub ↗

Is it safe? With care — CAUTION, grade F (49/100). It exposes 85 tools: 75 read, 10 write and 0 destructive. The audit recorded 49 findings (0 critical, 0 high, 12 medium, 33 low). Maintainer's description: Code, Build and Evaluate agents - excellent Model and Skills/MCP/ACP/A2A Support

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Fast Agent MCP server (evalstate/fast-agent)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/evalstate/fast-agent

Trust audit

Audit 0.4.1 · full source read 21 Sep 2026

Trust score49/100!CAUTION F

0 critical0 high12 medium33 low4 info

49 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared5 observations
NetworkDeclared5 observations
ShellDeclared3 observations
DependenciesPinnedNothing floats
SecretsFoundSee the findings

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

Layer	What we check	Result
`L0` Provenance	Repo owner, licence, archive status, activity	PASS 4 findings
`L1` Static source	Secrets, path traversal, supply chain	WARN 21 findings
`L2` Instructions	Prompt injection and authority framing in docs and tool descriptions	PASS
`L3` Inventory	Declared tools match the source	PASS
`L4` Sandbox	Run in isolation and watch behaviour	SKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

Repository owner evalstateUser accountAccount type recorded when we read the repository.
PackagePublished on PyPIfast-agent-mcp, no version recorded
LicenceApache-2.0From the repository, as read at the audited commit.
Last pushTodayActivity of the repository when we read it.
Source commit read6658690c05bcThe audit covers exactly this commit, read on 21 Sep 2026.

Runtime

Sandbox runNot run yetThis audit read the source only; it did not execute the server.
Tool inventory85 declaredRead from the source and classed read, write or destructive.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (49)

Sorted by severity · the 25 most severe of 49 are listed

MEDIUMCode injectioncode.dynamic_import · src/fast_agent/cli/main.py:109

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

module = importlib.import_module(module_path)

Why: No further detail recorded for this rule.
Fix: —

MEDIUMCode injectioncode.dynamic_import · src/fast_agent/tools/environment_factory.py:195

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

module = importlib.import_module(module_name.strip())

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.beacon_words · src/fast_agent/mcp/oauth_client.py:1097

F-04 Network egressCWE-200 · CWE-319Layer L1

def _extract_oauth_callback_params(callback_url: str) -> AuthorizationCodeResult:

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.beacon_words · src/fast_agent/mcp/oauth_client.py:1098

F-04 Network egressCWE-200 · CWE-319Layer L1

params = parse_qs(urlparse(callback_url).query)

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.beacon_words · src/fast_agent/mcp/oauth_client.py:1123

F-04 Network egressCWE-200 · CWE-319Layer L1

callback_url = (

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.beacon_words · src/fast_agent/mcp/oauth_client.py:1141

F-04 Network egressCWE-200 · CWE-319Layer L1

result = _extract_oauth_callback_params(callback_url)

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.base64_blob · auth-expired0608.json:5

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

"id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImFlNjc5NWRjLTRiYWUtNDE4YS04NjVkLTA4YTY0MzllZWRhNiIsInR5cCI6IkpXVCJ9.eyJhbXIiOlsib3RwIiwidXJuOm9wZW5haTphbXI6b3RwX2VtYWlsIl0sImF1ZCI6WyJhcHBfRU1vYW1FRVo3M2YwQ2

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · docs/docs/agents/defining/python_api.md:151

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · docs/docs/agents/defining/python_api.md:173

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · docs/docs/agents/workflows.md:266

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · docs/docs/agents/workflows.md:282

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · docs/docs/agents/workflows.md:294

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

LOWInventory / provenanceinv.hidden_file · .gitmodules

F-13 Inventory / provenanceCWE-1104Layer L0

.gitmodules

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · .pre-commit-config.yaml

F-13 Inventory / provenanceCWE-1104Layer L0

.pre-commit-config.yaml

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · docs/.prettierignore

F-13 Inventory / provenanceCWE-1104Layer L0

.prettierignore

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · examples/tensorzero/.env.sample

F-13 Inventory / provenanceCWE-1104Layer L0

.env.sample

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInsecure cryptocrypto.weak_hash · src/fast_agent/cli/commands/url_parser.py:119

F-09 Insecure cryptoCWE-327 · CWE-338Layer L1

url_hash = hashlib.md5(url.encode()).hexdigest()[:8]

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · docs/social_cards/benchmark/storyboard.js:269

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

"../../docs/assets/brand/fast-agent-lockup-light.svg"

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · docs/social_cards/benchmark/storyboard.js:417

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

"../../docs/assets/brand/fast-agent-lockup-light.svg"

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · docs/social_cards/benchmark/storyboard.js:475

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

"../../docs/assets/brand/fast-agent-lockup-light.svg"

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · scripts/a2a_docs_pipeline.py:241

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

'data-fa-asciinema-cast="../../assets/a2a/a2a-client-input-required.cast"',

Why: No further detail recorded for this rule.
Fix: —

LOWFilesystem / pathfs.traversal · scripts/a2a_docs_pipeline.py:245

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

'data-fa-asciinema-cast="../../assets/a2a/a2a-server-card.cast"',

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.beacon_words · tests/unit/fast_agent/mcp/test_cimd.py:364

F-04 Network egressCWE-200 · CWE-319Layer L1

callback_url = (

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.env_exfil · tests/unit/llm/test_copilot_client_isolation.py:63

F-04 Network egressCWE-200 · CWE-319Layer L1

dict(os.environ) ... websocket

Why: reads secrets in the same file that sends data out
Fix: —

LOWNetwork egressnet.raw_ip · README.md:697

F-04 Network egressCWE-200 · CWE-319Layer L1

# Run the dev server (http://127.0.0.1:8000)

Why: No further detail recorded for this rule.
Fix: —

Tools it exposes

85 declared in source · 0 destructive

75 read10 write0 destructive

Tool	Risk	What it does
`a3_trigger_tool_update`	write	global _EXTRA_TOOL_ADDED
`add_dynamic_app`	write	if
`add_dynamic_tool`	write	if
`create_profile`	write	return f
`execute`	write	Run shell command
`math_add`	write	return f
`random_number`	write	import random
`start_t4_small_sandbox`	write	Simulate starting a t4-small sandbox without infrastructure or charges.
`update_dynamic_app`	write	global resource_version
`write_text_file`	write	Write a text file
`a3_structured_report`	read	items = [f
`a3_unstructured_echo`	read	return f
`agent__child`	read	base
`alpha`	read	first alphabetically
`base_tool`	read	base
`calculate_divide`	read	if b == 0:
`calculate_product`	read	return f
`calculate_sum`	read	return f
`capitalize_string`	read	return text.upper()
`check_weather`	read	Check the weather in a given city.
`client_capabilities`	read	Expose the capabilities the modern client supplied for this call.
`coding_camel_case`	read	return text.title().replace(
`coding_kebab_case`	read	return text.lower().replace(
`coding_snake_case`	read	return text.lower().replace(
`const_mode`	read	Demonstrates a tool schema that includes a const constraint.
`echo`	read	Echo back the input
`echo_value`	read	Echo a value.
`feedback`	read	Request rating and feedback fields.
`fetch_magic_string`	read	Returns the daily passphrase when the assistant must call a tool.
`fetch_secret`	read	Ask the client model to call ``get_secret`` and return its final answer.
`get_image`	read	try:
`get_pdf`	read	try:
`get_secret`	read	Returns a secret code. You must call this tool to get the secret.
`get_status`	read	return
`get_video_link`	read	Return a ResourceLink to a video.
`getlink`	read	return ResourceLink(
`guess`	read	if guess < secret_number:
`implementation`	read	assert ctx.session.client_params is not None,
`initial_app`	read	return
`list_tools_call_count`	read	return server.list_tools_calls
`lookup`	read	Lookup data.
`lookup_probe_payload`	read	Return the probe payload for validation.
`lowercase_string`	read	return text.lower()
`math_multiply`	read	return f
`math_subtract`	read	return f
`my-tool`	read	demo
`open_workspace`	read	return
`ping`	read	return
`preferences`	read	Request enum-based preferences.
`progress_task`	read	No description in the source
`progress_task_no_message`	read	No description in the source
`progress_task_with_helper`	read	No description in the source
`random_case_string`	read	return
`random_string`	read	return
`read_resource_call_count`	read	return server.read_resource_calls
`read_text_file`	read	Read a text file
`render_invalid_widget`	read	return
`render_missing_widget`	read	return
`render_valid_widget`	read	return
`request_console_access`	read	Request navigation consent without claiming external authorization completed.
`reverse_string`	read	return text[::-1]
`sample`	read	Tool that echoes back the input parameter
`sample_many`	read	Tool that echoes back the input parameter
`sample_parallel`	read	Tool that makes multiple concurrent sampling requests to test parallel processing
`sample_with_image`	read	result = await ctx.session.create_message( # ty: ignore[deprecated]
`search`	read	Search things
`shirt-colour`	read	return
`shirt_colour`	read	return
`show_roots`	read	return roots.model_dump_json()
`simple_rating`	read	Request a simple boolean rating.
`string_lower`	read	return text.lower()
`string_upper`	read	return text.upper()
`test_sampling_with_tools`	read	Sample with a tool declaration through the modern resolver API.
`test_sampling_without_tools`	read	Sample without tools through the modern resolver API.
`test_tool_result_handling`	read	Complete a second sampling turn when the model requests a tool.
`text_count`	read	return f
`text_reverse`	read	return text[::-1]
`text_uppercase`	read	return text.upper()
`url_required_malformed_tool`	read	Return URL elicitation required error with malformed data payload.
`url_required_valid_tool`	read	Return URL elicitation required error with well-formed data.
`user_profile`	read	Request a complex user profile form.
`utility_ping`	read	return
`utility_status`	read	return
`weather`	read	call this to check the weather in a city
`zeta`	read	last alphabetically

Install

audited commit 6658690

Read the findings first. The most severe is Code injection (medium) at src/fast_agent/cli/main.py.

Add to Cursor Add to VS Code

One-click links open your editor with the config below filled in, exactly as the snippets show it. The audit covers commit 6658690 only.

claude mcp add fast-agent-mcp --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env CODEX_API_KEY=${CODEX_API_KEY} --env CODEX_AUTH_JSON_PATH=${CODEX_AUTH_JSON_PATH} --env COPILOT_GITHUB_TOKEN=${COPILOT_GITHUB_TOKEN} -- uvx fast-agent-mcp

{
  "mcpServers": {
    "fast-agent-mcp": {
      "command": "uvx",
      "args": [
        "fast-agent-mcp"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "CODEX_API_KEY": "${CODEX_API_KEY}",
        "CODEX_AUTH_JSON_PATH": "${CODEX_AUTH_JSON_PATH}",
        "COPILOT_GITHUB_TOKEN": "${COPILOT_GITHUB_TOKEN}"
      }
    }
  }
}

The command does not pin a version; the audit covers commit 6658690c05bc. Transport: sse · stdio · streamable-http. Reads these environment variables: ANTHROPIC_API_KEY, CODEX_API_KEY, CODEX_AUTH_JSON_PATH, COPILOT_GITHUB_TOKEN, DEEPSEEK_API_KEY, DEMO_TOKEN, FAST_AGENT_HF_TOKEN_SOURCE, FAST_AGENT_OAUTH_CLIENT_METADATA_URL and 4 more. Give it the narrowest token it needs.

Audit history

2026-09-21
!CAUTION F 49 / 100
Source changed, verdict held · 6658690c05bc
2026-09-14
!CAUTION F 49 / 100
First audit · 5a70690438f9

README badge

For maintainers · updates on every re-audit

[![ModelsAtlas: CAUTION F](https://modelsatlas.com/mcp/evalstate/fast-agent/badge.svg)](https://modelsatlas.com/mcp/evalstate/fast-agent/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about Fast Agent MCP server

What is the Fast Agent MCP server?

Code, Build and Evaluate agents - excellent Model and Skills/MCP/ACP/A2A Support

What tools does Fast Agent expose?

85 in total: 75 read-only, 10 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Fast Agent safe to connect to an agent?

With care. The audit graded it F (49/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does Fast Agent need?

It reads ANTHROPIC_API_KEY, CODEX_API_KEY, CODEX_AUTH_JSON_PATH, COPILOT_GITHUB_TOKEN, DEEPSEEK_API_KEY, DEMO_TOKEN, FAST_AGENT_HF_TOKEN_SOURCE, FAST_AGENT_OAUTH_CLIENT_METADATA_URL, FAST_AGENT_OAUTH_RESOURCE_URL, FAST_AGENT_OAUTH_SCOPES, FAST_AGENT_PRIVACY_FILTER_MAX_WINDOW_TOKENS and FAST_AGENT_PRIVACY_FILTER_WINDOW_OVERLAP_TOKENS from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Fast Agent run?

It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as fast-agent-mcp.

How current is this page?

The grade is for one exact copy of the source (6658690c05bc), read on 2026-09-21. The repository is watched and re-audited when it changes.

Sources

evalstate/fast-agent on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
ModelsAtlas trust audit — CAUTION verdict for commit 6658690c05bcObserved · 21 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Fast Agent MCP server?
GChatGPT CClaude PPerplexity
What tools does Fast Agent expose?
GChatGPT CClaude PPerplexity
Is Fast Agent safe to connect to an agent?
GChatGPT CClaude PPerplexity