Claude RunnerCAUTION
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A single-file MCP server that schedules and executes Claude Code CLI tasks via cron expressions. Features a web dashboard, webhook support, dynamic MCP server creation, and token/cost tracking.
Prerequisites
- Python 3.11+ (required for
asyncio.timeout()) - Claude Agent SDK (
pip install claude-agent-sdk) - SQLite3 (usually pre-installed on macOS/Linux)
- Anthropic API key - Jobs are executed via the Claude Agent SDK, which requires an
ANTHROPIC_API_KEY. Do not rely on a personal Max/Pro subscription — the SDK needs an API key from console.anthropic.com. Set it in your environment or.envfile:
export ANTHROPIC_API_KEY=sk-ant-...
Quick Start
# Clone the repository git clone https://github.com/floriansmeyers/SFLOW-AIRunner-MCP-PRD.git cd SFLOW-AIRunner-MCP-PRD # Create and activate virtual environment python3 -m venv .venv source .venv/bin/activate # On Windows: .venv\Scripts\activate # Install dependencies pip install -r requirements.txt # Run the server (stdio transport for Claude Desktop) python server.py
On first run, the server will:
- Create
jobs.dbSQLite database with all tables - Auto-generate OAuth credentials (printed to stderr - save these!)
- Start the scheduler loop (checks every 60 seconds)
Running
Local (stdio transport - for Claude Desktop)
python server.py
Add to Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):
{
"mcpServers": {
"claude-runner": {
"command": "/path/to/SFLOW-AIagents-MCP-Spinner/.venv/bin/python",
"args": ["/path/to/SFLOW-AIagents-MCP-Spinner/server.py"]
}
}
}Important: Use the full path to the Python interpreter inside your .venv to ensure dependencies are available.
Remote (SSE transport - for web dashboard)
M
9234551fd7c0OBSERVED · 2026-10-09Exposed tools (41)
17 read · 18 write · 6 destructive. Blast radius: 6 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
cleanup_old_uploads | read | |
create_job | write | |
create_mcp_server | write | |
create_webhook | write | |
delete_image | destructive | |
delete_job | destructive | Delete a job and all its runs |
delete_mcp_server | destructive | |
delete_server_credential | destructive | |
delete_webhook | destructive | Delete a webhook endpoint |
disable_fixed_server | write | |
disable_mcp_server | write | |
enable_fixed_server | write | |
enable_mcp_server | write | |
get_article_info | read | |
get_cat_fact | read | Fetch a random cat fact from the Cat Fact API. |
get_dynamic_mcp_server | read | |
get_email_status | read | |
get_job | read | Get a specific job by ID |
get_run | write | Get details of a specific run including full output |
get_server_credentials | read | |
get_unconfigured_servers | read | |
get_webhook | read | Get a specific webhook by ID |
invoke_internal_mcp_tool | write | |
kill_run | destructive | Force-kill a running job/run by its ID. Only works for runs in |
list_dynamic_mcp_servers | read | |
list_fixed_mcp_servers | read | |
list_jobs | read | List all scheduled jobs |
list_required_credentials | read | |
list_runs | read | List recent runs, optionally filtered by job_id or webhook_id |
list_uploads | read | |
list_webhooks | read | List all webhook endpoints |
my_function | read | return f |
send_email | write | |
set_server_credential | write | |
trigger_job | write | Manually trigger a job to run immediately |
update_job | write | Update an existing job. |
update_mcp_server | write | |
update_webhook | write | Update an existing webhook |
upload_from_article | write | |
upload_image_bytes | write | |
upload_image_from_url | write |
Trust audit
CAUTIONgrade B · trust 84/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (7 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (14)
print(f"[webhook] Error triggering webhook (token={token[:8]}...): {e}", file=sys.stderr)proxy_pass http://127.0.0.1:8080;
proxy_pass http://127.0.0.1:8080/sse;
delete_image, delete_job, delete_mcp_server, delete_server_credential, delete_webhook, kill_run
hash_prefix = hashlib.md5(image_bytes).hexdigest()[:12]
hash_prefix = hashlib.md5(image_bytes).hexdigest()[:12]
proxy_pass http://127.0.0.1:8080;
proxy_pass http://127.0.0.1:8080/sse;
image_bytes = base64.b64decode(image_base64)
decoded = base64.b64decode(encoded).decode("utf-8")fastmcp, croniter, uvicorn, sendgrid, requests, boto3, botocore, beautifulsoup4
cat ~/.ssh/id_ed25519.pub
cat > /opt/mcpserver/app/.env << 'EOF'
curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
Gates applied: no_behavioural_pass.
9234551fd7c0full audit observations/trust-audit/mcp-server/floriansmeyers__claude-runner.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-09 | 9234551fd7c0 | CAUTION | B | 84 | first audit |
Questions
What tools does Claude Runner expose?
41 in total: 17 read-only, 18 that write, and 6 that can delete or overwrite (delete_image, delete_job, delete_mcp_server, delete_server_credential, delete_webhook). Every one is listed on this page with its risk.
Is Claude Runner safe to connect to an agent?
With care. The audit graded it B (84/100) and found 14 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 6 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Claude Runner need?
It reads DASHBOARD_PASSWORD, MAILGUN_API_KEY, NGROK_AUTHTOKEN, OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET, OAUTH_SECRET_KEY, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY and SENDGRID_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (9234551fd7c0), read on 2026-10-09. The repository is watched and re-audited when it changes.