ModelsAtlas
Explore
Atlas / MCP servers / kychee-com / run402-mcp

run402-mcpBLOCK

mcp/kychee-com/run402
MCP server by kychee-com · agent infrastructure · ai agent · ai agents · Audited 2026-10-12
⚑ Report / re-scanSource ↗

Full-stack backend infrastructure for AI agents: Postgres, auth, storage, serverless functions and atomic deploys. TypeScript SDK, CLI and MCP server. Paid with x402/MPP. Open source.

Verdict
BLOCK
Grade
F
Trust score
25 /100
Exposed tools
10 8r · 2w · 0d
Transport
stdio
License
MIT
Stars
24
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

run402: full-stack backend infrastructure for AI agents

Postgres, auth, storage, serverless functions and staged deploys — provisioned, operated and paid for by an agent through the CLI, with a typed SDK for scripting and MCP for tool-native hosts. No cloud console, no signup. Open source.

[](https://github.com/kychee-com/run402/actions/workflows/test.yml) [](https://github.com/kychee-com/run402/actions/workflows/codeql.yml) [](https://www.npmjs.com/package/@run402/sdk) [](https://www.npmjs.com/package/run402) [](https://www.npmjs.com/package/run402-mcp) [](https://www.npmjs.com/package/@run402/functions) [](./LICENSE)

Run402 is open-source backend infrastructure for AI agents and coding agents — a backend-as-a-service addressed to a machine rather than to a person. An autonomous agent provisions a Postgres database, user auth, file storage, serverless functions and site hosting, ships them through one staged deploy workflow, and pays for the usage itself. Comparable in surface to Supabase, Firebase or Vercel; different in that there is no dashboard you have to sign into to get started (the console exists for people; the agent never needs it) and no human-issued API key to copy.

This is the backend Kychee's open products run on. We needed a layer an agent can drive e

Read from source at commit b92e9c997669OBSERVED · 2026-10-12
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add sdk --env ACTIONS_ID_TOKEN_REQUEST_TOKEN=${ACTIONS_ID_TOKEN_REQUEST_TOKEN} --env ACTIONS_ID_TOKEN_REQUEST_URL=${ACTIONS_ID_TOKEN_REQUEST_URL} --env ANON_KEY=${ANON_KEY} --env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} -- npx -y @run402/[email protected]
claude-desktop
{
  "mcpServers": {
    "sdk": {
      "command": "npx",
      "args": [
        "-y",
        "@run402/[email protected]"
      ],
      "env": {
        "ACTIONS_ID_TOKEN_REQUEST_TOKEN": "${ACTIONS_ID_TOKEN_REQUEST_TOKEN}",
        "ACTIONS_ID_TOKEN_REQUEST_URL": "${ACTIONS_ID_TOKEN_REQUEST_URL}",
        "ANON_KEY": "${ANON_KEY}",
        "AWS_ACCESS_KEY_ID": "${AWS_ACCESS_KEY_ID}"
      }
    }
  }
}
03

Exposed tools (10)

8 read · 2 write · 0 destructive.

ToolRiskDescription
demo-appreadA demo
deploywrite
docsread
doctorread
expand_resultread
nameread
runwrite
statusread
upread
whoamiread
04

Trust audit

BLOCKgrade F · trust 25/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (4 observation(s))
Network
declared (11 observation(s))
Shell
declared (3 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
SKILL.md:1123
`run402 messages wait [--addressed-to me] [--timeout <s>]` is the blocking alternative to polling `messages list` in a loop — it uses the gateway's held read when available and degrades to bounded pol
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
r402s-verify/src/schema.rs:165
fn eval(&self, schema: &S, base: &str, inst: &Value) -> Result<bool, String> {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
cli/lib/repos.mjs:450
s3:// destination (read from ~/.aws/credentials at USE
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
sdk/src/node/files.ts:23
".netrc",
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
sdk/src/node/files.ts:26
"id_ecdsa",
Why it matters. touches a credential store
HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59
sdk/src/node/files.ts:27
"id_ed25519",
Why it matters. touches a credential store
HIGHNetwork egress · net.env_exfil · CWE-200, CWE-319
sdk/src/node/vault-mirror-backend.ts:269
~/.aws ... fetch(
Why it matters. reads secrets in the same file that sends data out
MEDIUMInventory / provenance · inv.binary · CWE-1104
integration-fixtures/image-variants/source.heic
source.heic
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
cli/lib/ci.mjs:377
"Revocation does not undo already-deployed code, stop in-flight deploy operations, rotate exfiltrated keys, or remove deployed functions.",
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
cli/lib/ci.mjs:412
"Revocation does not undo already-deployed code, stop in-flight deploy operations, rotate exfiltrated keys, or remove deployed functions.",
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
cli/lib/jobs.mjs:64
"callback_url": "https://hooks.example.com/jobs"
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
cli/lib/jobs.mjs:67
callback_url (optional) is an HTTPS URL pushed once on terminal state
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
buzz/install-smoke.mjs:61
const requestUrl = new URL(request.url, "http://127.0.0.1");
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
buzz/install-smoke.mjs:69
skill.url = `http://127.0.0.1:${port}${artifactPath}`;
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
buzz/install-smoke.mjs:195
const baseUrl = `http://127.0.0.1:${server.address().port}`;
MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
test-vectors/r402s-v0/vectors.json:877
"signature_preimage_hex": "72343032732f76302f686561640a7b22636170747572655f62696e64696e67223a6e756c6c2c22636865636b706f696e74223a6e756c6c2c22636865636b706f696e745f707572706f7365223a6e756c6c2c226372656
MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
test-vectors/r402s-v0/vectors.json:949
"preimage_hex": "72343032732f76302f7661756c745f67656e657369730a7b22636170747572655f62696e64696e67223a6e756c6c2c22636865636b706f696e74223a6e756c6c2c22636865636b706f696e745f707572706f7365223a6e756c6c2c2
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
sdk/src/grant-key-credentials.test.ts:23
const TOKEN = "grant-key.test.token.value";
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
sdk/src/namespaces/domains.test.ts:136
token: "rt_aaaaaaaaaaaaaaaaaaaaaaaa",
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
sdk/src/node/secret-gate.test.ts:32
const SESSION = { token: "cp_session_token_secret" };
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
sdk/src/node/secret-gate.test.ts:33
const PROOFS = { siwx: "siwx-proof", token: "cp_session_token_secret" };
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
sdk/src/node/secret-gate.test.ts:51
"projects.list": [{ all: true, token: "cp_session_token_secret" }],
MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321
sdk/src/node/vault-handoff.test.ts:468
const note = baseNote({ tried: ["-----BEGIN RSA PRIVATE KEY-----\nMIIB...\n-----END RSA PRIVATE KEY-----"] });
MEDIUMPrompt injection · prompt.conditional_escalation · CWE-94, CWE-1427
buzz/SKILL.md:102
Notification routing is an OPTIONAL delivery state on top of an active community installation — report it beneath community installation, never as an identity or authority relationship, and never infe
LOWInventory / provenance · inv.hidden_file · CWE-1104
.node-version
.node-version
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose

Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.

Audited 2026-10-12 · audit v0.4.1 · source sha b92e9c997669full audit observations/trust-audit/mcp-server/kychee-com__run402.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-12b92e9c997669BLOCKF25first audit
06

Questions

What is the run402-mcp MCP server?

Full-stack backend infrastructure for AI agents: Postgres, auth, storage, serverless functions and atomic deploys. TypeScript SDK, CLI and MCP server. Paid with x402/MPP. Open source.

What tools does run402-mcp expose?

10 in total: 8 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is run402-mcp safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (25/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does run402-mcp need?

It reads ACTIONS_ID_TOKEN_REQUEST_TOKEN, ACTIONS_ID_TOKEN_REQUEST_URL, ANON_KEY, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, BUYER_PRIVATE_KEY, BUZZ_AUTH_TAG, BUZZ_BOT_PRIVATE_KEY, FULLSTACK_TEST_SECRET, GH_TOKEN and GITHUB_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does run402-mcp run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as @run402/sdk at 4.117.0.

How current is this page?

The grade is for one exact copy of the source (b92e9c997669), read on 2026-10-12. The repository is watched and re-audited when it changes.

Advertisement