Atlas / MCP servers / kuuvahki-labs / sandrone

sandroneBLOCK

Name: sandrone
Author: kuuvahki-labs

mcp/kuuvahki-labs/sandrone

MCP server by kuuvahki-labs · clash meta · docker · golang · Audited 2026-10-11

Self-hosted proxy configuration workbench for aggregating subscriptions, probing nodes, and generating Mihomo, sing-box, and Shadowrocket configs.

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

18 17r · 1w · 0d

Transport

streamable-http

License

AGPL-3.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Sandrone 把零散订阅变成可维护、可验证、可分享的客户端配置。 A self-hosted proxy configuration workbench — from subscription sources to client-ready configs.

Sandrone 是一个可自托管的订阅与客户端配置工作台。在网页中组合和整理订阅, 选择配置模板,编辑代理组、规则集与分流规则,再生成、检查和分享 Mihomo、sing-box 或 Shadowrocket 配置。

也支持命令行、HTTP API 和 MCP,可通过 Go API 嵌入其他程序。

[](docs/screenshots/config-editor.png)

选择配置模板,编辑代理组的类型、成员与引用关系。

为什么是 Sandrone

把多个来源的订阅汇总、整理,再生成适合不同客户端的配置,日常维护集中在一处。

聚合多个来源:远程订阅、本地节点和已有订阅可以自由组合,

按用途组织成不同的订阅,供手机、电脑等设备使用。

节点整理省去手工操作:按需筛选、去重、统一名称和排序,也可以根据

探测结果保留或排列节点;保存整理规则后,每次生成都会沿用。

开箱即用的完整配置:内置客户端模板和常用预设,提供分组、分流规则与

DNS 设置,帮助你从订阅生成客户端配置,减少从零编写的工作。

通过界面维护客户端配置:选择内置模板,编辑代理组的类型与成员,管理

规则集来源,调整分流规则的匹配条件、目标策略和顺序。

默认好用,也能灵活定制:通过基础配置编辑调整 DNS 等设置,按需组合或

移除预设;有更细的需求时,可以编辑原始配置或用脚本扩展节点与文件处理。

结果可检查,配置易交付:预览节点处理前后的变化和最终配置,查看兼容性

提醒、测试节点可用性,再下载或生成分享链接,添加到对应客户端。

日常管理与自动化兼顾:平时通过网页操作,也可设置定时刷新,或通过

命令行、API 和 MCP 接入自己的自动化流程,减少重复维护。

轻量自托管:一个带 Web UI 的程序或容器即可部署,无需额外数据库,

订阅与配置保存在自己管理的存储中,

Read from source at commit 22b891927491OBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add web -- npx -y web

claude-desktop

{
  "mcpServers": {
    "web": {
      "command": "npx",
      "args": [
        "-y",
        "web"
      ]
    }
  }
}

Exposed tools (18)

17 read · 1 write · 0 destructive.

Tool	Risk	Description
`Full`	read	Broad social, media, gaming, cloud, finance, education, news, and shopping coverage.
`Minimal`	read	Core selection, private, China, global, and final routing.
`Standard`	read	Core routing plus frequently used and region-restricted services.
`api.base64.decode`	read	Decode standard base64 into UTF-8 text.
`api.base64.encode`	read	Encode UTF-8 text as standard base64.
`api.file.content`	read	Read the rendered content of an allowed named file through the service.
`api.hash.sha256`	read	Hash UTF-8 text with SHA-256.
`api.ini.override`	write	Apply an ordered, lossless INI section override patch.
`api.ini.parse`	read	Parse INI into an ordered document that preserves duplicate sections and raw body lines.
`api.ini.stringify`	read	Validate and encode an ordered INI document using canonical section headers.
`api.json.parse`	read	Parse JSON into JavaScript data.
`api.json.stringify`	read	Encode JavaScript data as JSON.
`api.log`	read	Append diagnostic values to the script log sink.
`api.probe`	read	Probe a subset of the node-stage input through the service.
`api.subscription.produce`	read	Produce a named subscription through the service.
`api.warn`	read	Append a structured warning to the output envelope.
`api.yaml.parse`	read	Parse YAML into JSON-shaped data.
`api.yaml.stringify`	read	Encode JSON-shaped data as YAML.

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (2 observation(s))
Network: declared (7 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: found

Findings (21)

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

internal/processor/node/quick_settings.go:132

tlsCopy.InsecureSkipVerify = false

Why it matters. certificate verification is disabled

Fix. leave verification on

MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94

web/app/features/files/drivers/sing-box/configuration.ts:460

"μs": 1e-6,

MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94

web/app/features/files/drivers/sing-box/configuration.ts:467

const partPattern = /(\d+(?:\.\d*)?|\.\d+)(ns|us|μs|μs|ms|s|m|h|d)/gy;

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

internal/entry/httpapi/skill_script_test.go:273

const token = "do-not-leak-this-token"

MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862

streamable-http

Why it matters. a network transport with no auth environment variable found

Fix. require a token

LOWInventory / provenance · inv.hidden_file · CWE-1104

.golangci.yml

.golangci.yml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.node-version

.node-version

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

examples/scripts/wrap-sub-store.js:297

return eval(source + "\n;typeof main === 'function' ? main : undefined;");

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

internal/entry/httpapi/resources_test.go:266

script, err := os.ReadFile("../../../web/app/features/files/processors/scripts/sing-box-outbound-adapter.js")

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

internal/entry/httpapi/skill_contract_test.go:12

content, err := os.ReadFile("../../../skills/sandrone/agents/openai.yaml")

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

internal/entry/httpapi/skill_script_test.go:19

path, err := filepath.Abs("../../../skills/sandrone/scripts/sandrone-api.sh")

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

internal/tools/ruleset-catalog-gen/script_integration_test.go:62

repositoryRoot, err := filepath.Abs("../../..")

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

internal/tools/ruleset-catalog-gen/script_integration_test.go:103

repositoryRoot, err := filepath.Abs("../../..")