Atlas / MCP servers / floriansmeyers / Claude Runner

Claude RunnerCAUTION

mcp/floriansmeyers/claude-runner
Verdict
CAUTION
Grade
B
Trust score
84 /100
Exposed tools
41 17r · 18w · 6d
Transport
—
License
MIT
Stars
24
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A single-file MCP server that schedules and executes Claude Code CLI tasks via cron expressions. Features a web dashboard, webhook support, dynamic MCP server creation, and token/cost tracking.

Prerequisites

  • Python 3.11+ (required for asyncio.timeout())
  • Claude Agent SDK (pip install claude-agent-sdk)
  • SQLite3 (usually pre-installed on macOS/Linux)
  • Anthropic API key - Jobs are executed via the Claude Agent SDK, which requires an ANTHROPIC_API_KEY. Do not rely on a personal Max/Pro subscription — the SDK needs an API key from console.anthropic.com. Set it in your environment or .env file:
export ANTHROPIC_API_KEY=sk-ant-...

Quick Start

# Clone the repository
git clone https://github.com/floriansmeyers/SFLOW-AIRunner-MCP-PRD.git
cd SFLOW-AIRunner-MCP-PRD

# Create and activate virtual environment
python3 -m venv .venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate

# Install dependencies
pip install -r requirements.txt

# Run the server (stdio transport for Claude Desktop)
python server.py

On first run, the server will:

  1. Create jobs.db SQLite database with all tables
  2. Auto-generate OAuth credentials (printed to stderr - save these!)
  3. Start the scheduler loop (checks every 60 seconds)

Running

Local (stdio transport - for Claude Desktop)

python server.py

Add to Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):

{
"mcpServers": {
"claude-runner": {
"command": "/path/to/SFLOW-AIagents-MCP-Spinner/.venv/bin/python",
"args": ["/path/to/SFLOW-AIagents-MCP-Spinner/server.py"]
}
}
}

Important: Use the full path to the Python interpreter inside your .venv to ensure dependencies are available.

Remote (SSE transport - for web dashboard)

M
Read from source at commit 9234551fd7c0OBSERVED · 2026-10-09
Advertisement
02

Exposed tools (41)

17 read · 18 write · 6 destructive. Blast radius: 6 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
cleanup_old_uploadsread
create_jobwrite
create_mcp_serverwrite
create_webhookwrite
delete_imagedestructive
delete_jobdestructiveDelete a job and all its runs
delete_mcp_serverdestructive
delete_server_credentialdestructive
delete_webhookdestructiveDelete a webhook endpoint
disable_fixed_serverwrite
disable_mcp_serverwrite
enable_fixed_serverwrite
enable_mcp_serverwrite
get_article_inforead
get_cat_factreadFetch a random cat fact from the Cat Fact API.
get_dynamic_mcp_serverread
get_email_statusread
get_jobreadGet a specific job by ID
get_runwriteGet details of a specific run including full output
get_server_credentialsread
get_unconfigured_serversread
get_webhookreadGet a specific webhook by ID
invoke_internal_mcp_toolwrite
kill_rundestructiveForce-kill a running job/run by its ID. Only works for runs in
list_dynamic_mcp_serversread
list_fixed_mcp_serversread
list_jobsreadList all scheduled jobs
list_required_credentialsread
list_runsreadList recent runs, optionally filtered by job_id or webhook_id
list_uploadsread
list_webhooksreadList all webhook endpoints
my_functionreadreturn f
send_emailwrite
set_server_credentialwrite
trigger_jobwriteManually trigger a job to run immediately
update_jobwriteUpdate an existing job.
update_mcp_serverwrite
update_webhookwriteUpdate an existing webhook
upload_from_articlewrite
upload_image_byteswrite
upload_image_from_urlwrite
03

Trust audit

CAUTIONgrade B · trust 84/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (2 observation(s))
Network
declared (7 observation(s))
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (14)

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
server.py:3089
print(f"[webhook] Error triggering webhook (token={token[:8]}...): {e}", file=sys.stderr)
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
deploy/nginx.conf:6
proxy_pass http://127.0.0.1:8080;
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
deploy/nginx.conf:23
proxy_pass http://127.0.0.1:8080/sse;
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
delete_image, delete_job, delete_mcp_server, delete_server_credential, delete_webhook, kill_run
Why it matters. 6 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
dynamic_servers/r2-images/server.py:210
hash_prefix = hashlib.md5(image_bytes).hexdigest()[:12]
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
dynamic_servers/r2-images/server.py:287
hash_prefix = hashlib.md5(image_bytes).hexdigest()[:12]
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
deploy/README-HETZNER.md:334
proxy_pass http://127.0.0.1:8080;
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
deploy/README-HETZNER.md:348
proxy_pass http://127.0.0.1:8080/sse;
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
dynamic_servers/r2-images/server.py:385
image_bytes = base64.b64decode(image_base64)
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
server.py:1104
decoded = base64.b64decode(encoded).decode("utf-8")
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
requirements.txt
fastmcp, croniter, uvicorn, sendgrid, requests, boto3, botocore, beautifulsoup4
Why it matters. 13 requirement(s) not pinned with ==
Fix. pin exact versions
INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427
deploy/README-HETZNER.md:52
cat ~/.ssh/id_ed25519.pub
Why it matters. asks the agent to read credentials
INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427
deploy/README-HETZNER.md:118
cat > /opt/mcpserver/app/.env << 'EOF'
Why it matters. asks the agent to read credentials
INFOSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357
deploy/README-HETZNER.md:29
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -

Gates applied: no_behavioural_pass.

Audited 2026-10-09 · audit v0.4.1 · source sha 9234551fd7c0full audit observations/trust-audit/mcp-server/floriansmeyers__claude-runner.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-099234551fd7c0CAUTIONB84first audit
05

Questions

What tools does Claude Runner expose?

41 in total: 17 read-only, 18 that write, and 6 that can delete or overwrite (delete_image, delete_job, delete_mcp_server, delete_server_credential, delete_webhook). Every one is listed on this page with its risk.

Is Claude Runner safe to connect to an agent?

With care. The audit graded it B (84/100) and found 14 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 6 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Claude Runner need?

It reads DASHBOARD_PASSWORD, MAILGUN_API_KEY, NGROK_AUTHTOKEN, OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET, OAUTH_SECRET_KEY, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY and SENDGRID_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How current is this page?

The grade is for one exact copy of the source (9234551fd7c0), read on 2026-10-09. The repository is watched and re-audited when it changes.

Advertisement