MCP server · Org-owned · Audited from source
ruby-sdk MCP server
by modelcontextprotocol/ruby-sdkNOASSERTION licenceAudited 23 Oct 2026 · source c0523ec51a1d
stdiostreamable-http★ 938
Is it safe? Yes — SAFE, grade B (89/100). It exposes 61 tools: 60 read, 1 write and 0 destructive. The audit recorded 17 findings (0 critical, 0 high, 0 medium, 16 low). Maintainer's description: The official Ruby SDK for the Model Context Protocol servers and clients.
Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
Cite
Cite this page
ModelsAtlas. “ruby-sdk MCP server (modelcontextprotocol/ruby-sdk)”. Retrieved 23 Oct 2026. https://modelsatlas.com/mcp/modelcontextprotocol/ruby-sdk
Trust audit
Audit 0.4.1 · full source read 23 Oct 2026
Trust score89/100✓SAFE B
0 critical0 high0 medium16 low1 info
17 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.
What the source does
- FilesystemDeclared5 observations
- NetworkNone observedNothing seen in the source
- ShellNone observedNothing seen in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.
Five audit layers
| Layer | What we check | Result |
|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS 1 finding |
L1 Static source | Secrets, path traversal, supply chain | PASS 15 findings |
L2 Instructions | Prompt injection and authority framing in docs and tool descriptions | PASS 1 finding |
L3 Inventory | Declared tools match the source | PASS |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED |
Provenance & runtime
Who published it, and what the audit could and could not run
Provenance
- Repository owner
modelcontextprotocolOrganizationAccount type recorded when we read the repository. - PackageNo packageRuns from a repository checkout or a hosted URL.
- LicenceNOASSERTIONFrom the repository, as read at the audited commit.
- Last pushTodayActivity of the repository when we read it.
- Source commit readc0523ec51a1dThe audit covers exactly this commit, read on 23 Oct 2026.
Runtime
- Sandbox runNot run yetThis audit read the source only; it did not execute the server.
- Tool inventory61 declaredRead from the source and classed read, write or destructive.
Every value here is read from the record's own repository and audit.Suggest a correction
Findings (17)
Sorted by severity
LOWFilesystem / pathfs.traversal · lib/mcp/client/http.rb:4
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
require_relative "../../json_rpc_handler"
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · lib/mcp/client/stdio.rb:7
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
require_relative "../../json_rpc_handler"
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · lib/mcp/server/transports/stdio_transport.rb:4
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
require_relative "../../transport"
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · lib/mcp/server/transports/streamable_http_transport.rb:5
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
require_relative "../../result_type"
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · lib/mcp/server/transports/streamable_http_transport.rb:6
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
require_relative "../../transport"
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.metadata_ip · test/mcp/client/oauth/discovery_test.rb:537
F-04 Network egressCWE-200 · CWE-319Layer L1
refute(Discovery.same_origin?("https://169.254.169.254/latest/", "https://srv.example.com/mcp"))- Why
- cloud metadata endpoint: the classic SSRF credential grab
- Fix
- —
LOWNetwork egressnet.metadata_ip · test/mcp/client/oauth/discovery_test.rb:559
F-04 Network egressCWE-200 · CWE-319Layer L1
assert(Discovery.private_network_host?("169.254.169.254"))- Why
- cloud metadata endpoint: the classic SSRF credential grab
- Fix
- —
LOWNetwork egressnet.metadata_ip · test/mcp/client/oauth/discovery_test.rb:577
F-04 Network egressCWE-200 · CWE-319Layer L1
assert(Discovery.private_network_host?("::ffff:169.254.169.254"))- Why
- cloud metadata endpoint: the classic SSRF credential grab
- Fix
- —
LOWNetwork egressnet.metadata_ip · test/mcp/client/oauth/flow_test.rb:3287
F-04 Network egressCWE-200 · CWE-319Layer L1
metadata_url = "https://169.254.169.254/latest/meta-data/iam/"
- Why
- cloud metadata endpoint: the classic SSRF credential grab
- Fix
- —
LOWNetwork egressnet.metadata_ip · test/mcp/client/oauth/flow_test.rb:3320
F-04 Network egressCWE-200 · CWE-319Layer L1
metadata_url = "https://169.254.169.254/latest/meta-data/iam/"
- Why
- cloud metadata endpoint: the classic SSRF credential grab
- Fix
- —
LOWNetwork egressnet.raw_ip · test/mcp/client/http_test.rb:1965
F-04 Network egressCWE-200 · CWE-319Layer L1
held_client = HTTP.new(url: "http://127.0.0.1:#{server.addr[1]}/")- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · test/mcp/client/http_test.rb:2026
F-04 Network egressCWE-200 · CWE-319Layer L1
oauth_client = HTTP.new(url: "http://127.0.0.1:#{server.addr[1]}/", oauth: Struct.new(:access_token).new)- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · test/mcp/client/oauth/bounded_body_test.rb:127
F-04 Network egressCWE-200 · CWE-319Layer L1
yield("http://127.0.0.1:#{server.addr[1]}/")- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · test/mcp/client/oauth/discovery_test.rb:205
F-04 Network egressCWE-200 · CWE-319Layer L1
uris = ["http://localhost:0/callback", "http://127.0.0.1:8080/cb", "http://[::1]/cb"]
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · test/mcp/client/oauth/discovery_test.rb:481
F-04 Network egressCWE-200 · CWE-319Layer L1
assert(Discovery.secure_url?("http://127.0.0.1/x"))- Why
- No further detail recorded for this rule.
- Fix
- —
INFOPrompt injectionprompt.credential_read · docs/_client/transports.md:194
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
letting a server leverage the client's model access without its own API keys.
- Why
- asks the agent to read credentials
- Fix
- —
Tools it exposes
61 declared in source · 0 destructive
60 read1 write0 destructive
| Tool | Risk | What it does |
|---|---|---|
deploy | write | Deploys an app; asks which environment via a multi round-trip elicitation (SEP-2322) |
a | read | A |
arg1 | read | First test argument |
arg2 | read | Second test argument |
around_test_tool | read | Test |
b | read | B |
concurrent_tool | read | Raises per-thread |
dashboard | read | Weather UI |
defined_prompt | read | Defined prompt |
defined_tool | read | Defined tool |
dynamic_tool | read | A dynamically added tool |
echo | read | A simple example tool that echoes back its arguments |
failing_tool | read | Always fails |
frozen_tool | read | Raises frozen |
full_tool | read | A tool with all parameters |
greet | read | Greets a name; a plain single round-trip tool |
message | read | The message to echo back |
mock_prompt | read | a mock prompt for testing |
mock_tool | read | a mock tool for testing |
needs_auth | read | Needs OAuth |
no_args_prompt | read | a prompt without arguments |
no_arguments_prompt | read | No arguments prompt |
prompt_a | read | A |
prompt_b | read | B |
prompt_with_hash_icons | read | a prompt with icons given as Hashes |
prompt_with_invalid_icons | read | a prompt with an invalid icon |
prompt_without_icons | read | a prompt without icons |
readme | read | Describes this Rails example MCP server |
ref_tool | read | Tool with $ref |
resourceUri | read | URI of the resource to embed |
resource_template_with_icons | read | a resource template with icons |
resource_template_without_icons | read | a resource template without icons |
resource_with_icons | read | a resource with icons |
resource_without_icons | read | a resource without icons |
shared_failing_tool | read | Always fails |
static-binary | read | A static binary (PNG) resource for testing |
static-text | read | A static text resource for testing |
template-resource | read | A parameterized resource template for testing |
test-resource | read | Test resource that echoes back the uri as its content |
test_argument | read | Test argument |
test_prompt | read | Test prompt description |
test_resource | read | a test resource |
test_server | read | A test server |
test_tool | read | A test tool |
test_tool_with_annotations | read | A test tool with annotations |
test_tool_with_output | read | A test tool with output schema |
tool1 | read | tool1 |
tool_a | read | Tool A |
tool_b | read | Tool B |
tool_c | read | Tool C |
tool_that_raises | read | A tool that raises |
tool_with_faulty_schema | read | A tool with a faulty schema |
tool_with_frozen_icons | read | a tool whose icons are frozen |
tool_with_hash_icons | read | a tool with icons given as Hashes |
tool_with_invalid_icons | read | a tool with an invalid icon |
tool_with_no_args | read | This tool performs specific functionality... |
tool_with_output | read | tool with output schema |
tool_without_icons | read | a tool without icons |
user_guide_resource | read | the user guide |
user_profile_template | read | profile for a user |
watched-resource | read | A resource for subscription testing |
Install
audited commit c0523ec
No connect command is recorded for this server yet. Follow the repository's own instructions, and read the findings above first.
Audit history
- ✓SAFE B 89 / 100
First audit ·
c0523ec51a1d
README badge
For maintainers · updates on every re-audit
[](https://modelsatlas.com/mcp/modelcontextprotocol/ruby-sdk/)
The badge always shows the latest audit; a maintainer cannot pin an old verdict.
Other ratings
Cited, never blended into our score
No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.
Questions about ruby-sdk MCP server
What is the ruby-sdk MCP server?
The official Ruby SDK for the Model Context Protocol servers and clients.
What tools does ruby-sdk expose?
61 in total: 60 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is ruby-sdk safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does ruby-sdk need?
No credential environment variables were found in its source, so it appears to need none.
How does ruby-sdk run?
It speaks stdio and streamable-http, so it runs as a local process your client starts.
How current is this page?
The grade is for one exact copy of the source (c0523ec51a1d), read on 2026-10-23. The repository is watched and re-audited when it changes.
Sources
- modelcontextprotocol/ruby-sdk on GitHub — the source we read, its licence, stars and activityObserved · 23 Oct 2026
- ModelsAtlas trust audit — SAFE verdict for commit c0523ec51a1dObserved · 23 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What is the ruby-sdk MCP server?
- What tools does ruby-sdk expose?
- Is ruby-sdk safe to connect to an agent?