Atlas / MCP servers / huyouare / Manus

ManusBLOCK

mcp/huyouare/manus-2

MCP server that provides Manus-like capabilities

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
6 6r · 0w · 0d
Transport
stdio
License
—
Stars
39
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A Model Context Protocol (MCP) server implementation that can browse the web, perform search queries, and execute code.

Current Features

  • "google_search" tool that performs Google searches and returns relevant links
  • "browse_web" tool that allows browsing websites, clicking elements, and extracting content
  • "code_interpreter" tool that allows reading, writing, and executing code in a sandbox environment
  • "bash_tool" tool that allows running shell commands in the sandbox directory

Using with Claude for Desktop

To use Manus MCP with Claude for Desktop:

  1. Create or edit the Claude for Desktop configuration file:
  2. macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
  1. Add the following configuration:
{
"mcpServers": {
"manus-mcp": {
"command": "uv",
"args": [
"--directory",
"/ABSOLUTE/PATH/TO/manus-mcp",
"run",
"mcp_server.py"
]
}
}
}
  1. Restart Claude for Desktop
  1. You should now see the Manus MCP tools available in Claude for Desktop

Available Tools

hello_world

A simple greeting tool that returns a welcome message.

google_search

Performs Google searches and returns a list of relevant links.

browse_web

Interacts with a web browser to navigate websites and extract information. Supported actions:

  • navigate: Go to a specific URL
  • click: Click an element by index
  • input_text: Input text into an element
  • get_content: Get the page content
  • execute_js: Execute JavaScript code
  • scroll: Scroll the page
  • refresh: Refresh the current page

code_interpreter

Allows reading, writing, and executing code files in a sandboxed environment. Supported actions:

  • read: Read the contents of a file
  • write: Write content to a file
  • execute: Execute a file or code snippet
  • list: List fi
Read from source at commit 25d9b0a8b92aOBSERVED · 2026-10-08
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add manus-mcp -- uvx manus-mcp
claude-desktop
{
  "mcpServers": {
    "manus-mcp": {
      "command": "uvx",
      "args": [
        "manus-mcp"
      ]
    }
  }
}
03

Exposed tools (6)

6 read · 0 write · 0 destructive.

ToolRiskDescription
bash_toolread
browse_webread
code_interpreterread
google_searchread
hello_worldread
manus_identityread
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)WARN
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (1 observation(s))
Network
declared (1 observation(s))
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (3)

HIGHPrivilege escalation / persistence · priv.escalate · CWE-269, CWE-250
app/code_execution.py:271
"sudo", "su ", "rm -rf /", "> /dev", "< /dev",
Why it matters. asks for elevated privileges
MEDIUMPrompt injection · scope.undeclared_system · CWE-94, CWE-1427
<declared scope>
system use found in code, not declared in the description
Why it matters. the description does not admit a capability the code has
Fix. declare system use in the description, or remove it
LOWInventory / provenance · inv.no_license · CWE-1104
Why it matters. no LICENSE file and no repo licence
Fix. add a licence

Gates applied: no_behavioural_pass, no_license.

Audited 2026-10-08 · audit v0.4.1 · source sha 25d9b0a8b92afull audit observations/trust-audit/mcp-server/huyouare__manus-2.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-0825d9b0a8b92aBLOCKD69first audit
06

Questions

What is the Manus MCP server?

MCP server that provides Manus-like capabilities

What tools does Manus expose?

6 in total: 6 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Manus safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does Manus need?

No credential environment variables were found in its source, so it appears to need none.

How does Manus run?

It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as manus-mcp.

How current is this page?

The grade is for one exact copy of the source (25d9b0a8b92a), read on 2026-10-08. The repository is watched and re-audited when it changes.

Advertisement