rustmistmcpBLOCK
Async Rust MCP server for the HPE Juniper Mist cloud — bearer-token auth, org/site-scoped tools, bounded responses, guarded WAN-edge change control
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
rustmistmcp
Async Rust Model Context Protocol server for the HPE Juniper Mist cloud a mechub project — sovereign network-security automation
Unofficial / community project. This is an independent community project and does not claim affiliation with or endorsement by Hewlett Packard Enterprise or Juniper Networks. Product names and trademarks are used only to identify the systems with which the software interoperates.
rustmistmcp exposes the Juniper Mist cloud — orgs, sites, APs, switches, gateways, WLANs, clients, SLE, and Marvis — to MCP clients as a bounded, auditable tool surface.
Where `rustjunosmcp` talks NETCONF to individual SRX devices and `rustpanosmcp` talks XML-API to individual PAN-OS firewalls, this server talks to a multi-tenant cloud control plane. One org-scoped call can reach every site and every access point in an estate, so scoping, bounded responses, and change control are not garnish here; they are the design.
The functional target is the Mist half of `nowireless4u/hpe-networking-mcp` — site health and SLE, device inventory and stats, WLAN/SSID management, client connectivity, events and alarms, audit logs, RRM and rogue detection, firmware, NAC/policy, guest access, webhooks, floor plans, and Marvis — reimplemented in Rust on the mecmcp foundation rather than as a Python spec-driven registry. That project registers on the order of a thousand generated tools; this one deliberately will not. A curated, scoped, individually-documented surface is the whole point of doing it again.
R
be83b4e2ed8fOBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add rustmistmcp:0.3.2 -- docker run -i --rm ghcr.io/mechubsec/rustmistmcp:0.3.2:None stdio /var/lib/rustmistmcp/changeset-state.json
Trust audit
BLOCKgrade D · trust 61/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- UNDECLARED (6 observation(s))
- Network
- declared (7 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (25)
'.env' ... curl
--network host \
require_contains docs/OPERATIONS.md 'sudo install -D -o root -g rustmistmcp -m 0640'
require_contains docs/OPERATIONS.md 'sudo install -o rustmistmcp -g rustmistmcp -m 0600 /dev/null'
rm -rf /var/lib/apt/lists/*
require_contains "$installer" 'rm -rf /var/lib/apt/lists/*'
require_absent "$installer" 'systemctl enable'
"/usr/local/bin/rustmistmcp", \
"--device-mapping", "/etc/rustmistmcp/mist.json", \
assert_eq!(legacy, PathBuf::from("/etc/rustmistmcp/tokens.json"));args.shared.otel_endpoint = Some("http://127.0.0.1:4318".to_owned());"https://127.0.0.1/",
.gitleaks-vendor.toml
.gitleaks.toml
.gitleaksignore
"/etc/rustmistmcp/tokens.json",
"/etc/rustmistmcp/tokens.json",
include_str!("../../../docs/mist-api/catalog.json")const CATALOG_JSON: &str = include_str!("../../../docs/mist-api/catalog.json");include_str!("../../../docs/mist-api/frozen-reference-inventory.json");const PARITY_JSON: &str = include_str!("../../../docs/mist-api/parity.json");const WORKSPACE_MANIFEST: &str = include_str!("../../../Cargo.toml");"https://127.0.0.1",
let mock_base_url_http = format!("http://127.0.0.1:{}", addr.port());curl -s -o /dev/null -w '%{http_code}\n' -X POST http://127.0.0.1:30044/mcp \Gates applied: no_behavioural_pass.
be83b4e2ed8ffull audit observations/trust-audit/mcp-server/mechubsec__rustmistmcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | be83b4e2ed8f | BLOCK | D | 61 | first audit |
Questions
What is the rustmistmcp MCP server?
Async Rust MCP server for the HPE Juniper Mist cloud — bearer-token auth, org/site-scoped tools, bounded responses, guarded WAN-edge change control
Is rustmistmcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (61/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does rustmistmcp need?
No credential environment variables were found in its source, so it appears to need none.
How does rustmistmcp run?
It speaks stdio and streamable-http, so it runs as a local process your client starts.
How current is this page?
The grade is for one exact copy of the source (be83b4e2ed8f), read on 2026-10-11. The repository is watched and re-audited when it changes.