MCP server · Org-owned · Audited from source
MCP Agent
by lastmile-ai/mcp-agentApache-2.0 licenceAudited 20 Sep 2026 · source 86e936c23c81
npm coinflip 0.1.0ssestdiostreamable-http★ 8,549
Is it safe? No — BLOCK, grade F (52/100). It exposes 51 tools: 45 read, 6 write and 0 destructive. The audit recorded 55 findings (0 critical, 2 high, 15 medium, 33 low). Maintainer's description: Build effective agents using Model Context Protocol and simple workflow patterns
Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
Cite
Cite this page
ModelsAtlas. “MCP Agent (lastmile-ai/mcp-agent)”. Retrieved 20 Sep 2026. https://modelsatlas.com/mcp/lastmile-ai/mcp-agent
Why this is BLOCK. The audit found 0 critical and 2 high findings; the most severe is Code injection at src/mcp_agent/cli/secrets/yaml_tags.py:107. Each finding is listed below with its file and line.
Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.
Trust audit
Audit 0.4.1 · full source read 20 Sep 2026
Trust score52/100✕BLOCK F
0 critical2 high15 medium33 low5 info
55 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.
What the source does
- FilesystemDeclared3 observations
- NetworkNone observedNothing seen in the source
- ShellDeclared7 observations
- DependenciesNot pinnedSome ranges float
- SecretsFoundSee the findings
Findings (55)
Sorted by severity · the 25 most severe of 55 are listed
HIGHCode injectioncode.deserialize · src/mcp_agent/cli/secrets/yaml_tags.py:107
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
return yaml.load(yaml_str, Loader=SecretYamlLoader)
- Why
- deserialises untrusted bytes into live objects
- Fix
- use json or yaml.safe_load
HIGHCode injectioncode.eval_exec · src/mcp_agent/utils/pydantic_type_serializer.py:758
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(func_code, namespace)
- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
MEDIUMCode injectioncode.dynamic_import · src/mcp_agent/cli/cloud/commands/deploy/materialize.py:317
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
module = importlib.import_module(module_name)
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMCode injectioncode.dynamic_import · src/mcp_agent/cli/commands/build.py:133
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
module = __import__(package)
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMCode injectioncode.dynamic_import · src/mcp_agent/executor/temporal/__init__.py:558
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
importlib.import_module(module_name)
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMCode injectioncode.dynamic_import · src/mcp_agent/utils/pydantic_type_serializer.py:514
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
module = importlib.import_module(serialized["module"])
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMCode injectioncode.dynamic_import · src/mcp_agent/utils/pydantic_type_serializer.py:528
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
module = importlib.import_module(serialized["module"])
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.anthropic · examples/usecases/mcp_instagram_gift_advisor/mcp_agent.secrets.yaml.example:10
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · docs/concepts/augmented-llms.mdx:56
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · docs/mcp-agent-sdk/core-components/augmented-llm.mdx:57
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · examples/basic/mcp_basic_agent/main.py:37
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · examples/basic/mcp_basic_agent/main.py:41
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · examples/basic/mcp_basic_agent/mcp_agent.secrets.yaml.example:10
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.slack · examples/usecases/mcp_basic_slack_agent/README.md:88
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.slack · examples/usecases/mcp_basic_slack_agent/mcp_agent.config.yaml:10
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.slack · examples/usecases/mcp_basic_slack_agent/mcp_agent.secrets.yaml.example:13
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.slack · examples/usecases/mcp_github_to_slack_agent/mcp_agent.secrets.yaml.example:10
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWCode injectioncode.deserialize · tests/cli/secrets/test_yaml_tags.py:127
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
loaded = yaml.load(processed_yaml, Loader=SecretYamlLoader)
- Why
- deserialises untrusted bytes into live objects
- Fix
- use json or yaml.safe_load
LOWInsecure cryptocrypto.weak_hash · src/mcp_agent/cli/utils/url_parser.py:55
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
url_hash = hashlib.md5(url.encode()).hexdigest()[:8]
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWInformation disclosuredisclose.log_secret · tests/cli/fixtures/api_test_utils.py:148
F-12 Information disclosureCWE-209 · CWE-532Layer L1
print(f"Generated test API key: {api_key[:15]}...{api_key[-5:]}")- Why
- No further detail recorded for this rule.
- Fix
- —
LOWInformation disclosuredisclose.log_secret · tests/cli/fixtures/api_test_utils.py:274
F-12 Information disclosureCWE-209 · CWE-532Layer L1
print(f"API Key: {'*' * 6 + api_key[-4:] if api_key else 'Not set'}")- Why
- No further detail recorded for this rule.
- Fix
- —
LOWInformation disclosuredisclose.log_secret · tests/cli/utils/jwt_generator.py:195
F-12 Information disclosureCWE-209 · CWE-532Layer L1
print(token)
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · examples/basic/agent_factory/mcp_agent.config.yaml:1
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
$schema: ../../../schema/mcp-agent.config.schema.json
- Why
- No further detail recorded for this rule.
- Fix
- —
Tools it exposes
51 declared in source · 0 destructive
45 read6 write0 destructive
| Tool | What it does | Risk |
|---|---|---|
notify | Send an upstream log/notification at the requested level. | write |
notify_progress | Trigger a progress notification. | write |
notify_resources | Trigger a non-logging resource list changed notification. | write |
run | bound_ctx, token = _enter_request_context(ctx) | write |
transfer_to_agent | Transfer control to the agent | write |
workflows-run | No description in the source | write |
agent_function | Agent function | read |
alpha | return f | read |
beta | return f | read |
book_table | Book a table with confirmation | read |
confirm_action | Ask the user to confirm an action via elicitation. | read |
custom_icon_tool | return text | read |
echo | return text + | read |
elicitation_demo | No description in the source | read |
emit_log | Log a message at the requested level and emit a notification. | read |
example_usage | No description in the source | read |
finder_agent | No description in the source | read |
finder_tool | No description in the source | read |
get-magic-number | Returns the magic number | read |
get_comparable_properties | No description in the source | read |
get_haiku | Use MCP sampling to generate a haiku about the given topic. | read |
get_market_statistics | No description in the source | read |
get_property_details | No description in the source | read |
get_rental_trends | No description in the source | read |
get_script_word_count | Return the number of whitespace-separated tokens in *script*. | read |
github_org_search | Search GitHub organizations using the remote MCP server. | read |
hello_world | A simple tool that returns | read |
my_tool | Description for my_tool | read |
no_icon_tool | return text | read |
parent_tool | A parent tool | read |
sample_haiku | Generate a short poem using configured LLM settings. | read |
search_properties | No description in the source | read |
show_roots | return await ctx.session.list_roots() | read |
test_tool | A test tool | read |
tool | Description for tool | read |
tool1 | Description for tool1 | read |
tool2 | Description for tool2 | read |
tool3 | Description for tool3 | read |
tool4 | Description for tool4 | read |
toolA | desc | read |
toolB | desc | read |
tool_exact | Description for tool_exact | read |
tool_extra | Description for tool_extra | read |
tool_filtered | Description for tool_filtered | read |
tool_similar | Description for tool_similar | read |
workflows-cancel | No description in the source | read |
workflows-get_status | No description in the source | read |
workflows-list | No description in the source | read |
workflows-resume | No description in the source | read |
workflows-runs-list | No description in the source | read |
workflows-store-credentials | No description in the source | read |
Safer alternatives
Graphiti✓SAFE
getzep/graphiti
Build Real-Time Knowledge Graphs for AI Agents
3 destructiveGrade B
Mcpdoc✓SAFE
langchain-ai/mcpdoc
Expose llms-txt to IDEs for development
3 readGrade B
Toolbox Langchain SDK✓SAFE
googleapis/mcp-toolbox-sdk-python
Python SDK for interacting with the MCP Toolbox for Databases.
1 readGrade B
Audit history
- ✕BLOCK F 52 / 100
Source changed, verdict held ·
86e936c23c81
README badge
Badges show the current verdict, BLOCK included
A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.
Questions about MCP Agent
What is the MCP Agent MCP server?
Build effective agents using Model Context Protocol and simple workflow patterns
What tools does MCP Agent expose?
51 in total: 45 read-only, 6 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is MCP Agent safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (52/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does MCP Agent need?
It reads ANTHROPIC_API_KEY, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AZURE_API_KEY, GITHUB_ACCESS_TOKEN, GITHUB_CLIENT_SECRET, GOOGLE_API_KEY, LOG_SECRETS, MCP_GATEWAY_TOKEN, MY_SECRET, NEXTAUTH_SECRET and OAUTH_REDIS_URL from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does MCP Agent run?
It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as coinflip at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (86e936c23c81), read on 2026-09-20. The repository is watched and re-audited when it changes.
I already installed MCP Agent. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.
Sources
- lastmile-ai/mcp-agent on GitHub — the source we read, its licence, stars and activityObserved · 20 Sep 2026
- ModelsAtlas trust audit — BLOCK verdict for commit 86e936c23c81Observed · 20 Sep 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What is the MCP Agent MCP server?
- What tools does MCP Agent expose?
- Is MCP Agent safe to connect to an agent?