Live survey286 models · 13 providers · 19,992 auditsAudited verification-before-completion · SAFE →What changedHow we verifyllms.txt

MCP server · Org-owned · Audited from source

cli MCP server

by modelstudioai/cliApache-2.0 licenceAudited 3 Oct 2026 · source ca58ac0dbb16

npm bailian-cli-runtime 2.1.0streamable-http★ 539
✕BLOCKGrade F · 42/100 · 3 Oct 2026 · ca58ac0
Safer alternativesView source on GitHub ↗

Is it safe? No — BLOCK, grade F (42/100). It exposes 5 tools: 5 read, 0 write and 0 destructive. The audit recorded 39 findings (1 critical, 4 high, 4 medium, 30 low). Maintainer's description: Official Model Studio CLI(阿里云百炼 CLI)built for AI Agent frameworks, exposing models, search, multimodal, and workflow capabilities as structured tool calls.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “cli MCP server (modelstudioai/cli)”. Retrieved 3 Oct 2026. https://modelsatlas.com/mcp/modelstudioai/cli

Why this is BLOCK. The audit found 1 critical and 4 high findings; the most severe is Prompt injection at skills/bailian-protocol/SKILL.md:148. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

4 MCP servers are called Cli. You are viewing modelstudioai/cli. Compare all 4 →

Trust audit

Audit 0.4.1 · full source read 3 Oct 2026

Trust score42/100✕BLOCK F
1 critical4 high4 medium30 low0 info

39 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemDeclared3 observations
  • NetworkDeclared8 observations
  • ShellDeclared7 observations
  • DependenciesNot pinnedSome ranges float
  • SecretsFoundSee the findings

Findings (39)

Sorted by severity · the 25 most severe of 39 are listed

CRITICALPrompt injectionprompt.transfer_instruction · skills/bailian-protocol/SKILL.md:148
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
2. If INCLUDE matches, ask the user (Chinese prompt in that doc). If they agree, collect environment info, redact secrets, fill the issue template, and submit to https://github.com/modelstudioai/cli/i
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
HIGHCode injectioncode.eval_exec · packages/runtime/src/pipeline/expressions.ts:209
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
const fn = new Function("args", `return (${code})`);
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · packages/runtime/src/pipeline/steps/script-js.ts:24
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
const fn = new Function("args", code);
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHPrompt injectionprompt.credential_read · skills/bailian-managed-agent/SKILL.md:69
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- Build moves literal Vault `secret_value` / `access_token` values from Agent-local or shared `vault.json` into project-root `.env`, replacing them with generated environment references. Existing refe
Why
asks the agent to read credentials
Fix
—
HIGHPrompt injectionprompt.credential_read · skills/bailian-sandbox/SKILL.md:50
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- Obtain fresh JSON with `bl sandbox get --sandbox-id <id> --show-credentials --output json`. Use `envdAccessToken` as `X-Access-Token`; the control-plane Bailian API Key is a different credential.
Why
asks the agent to read credentials
Fix
—
MEDIUMNetwork egressnet.raw_ip · packages/bailian-kb-dsh/src/console-login.ts:236
F-04 Network egressCWE-200 · CWE-319Layer L1
const url = new URL(req.url ?? "/", "http://127.0.0.1");
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · packages/commands/src/commands/auth/login-console.ts:304
F-04 Network egressCWE-200 · CWE-319Layer L1
const u = new URL(req.url ?? "/", "http://127.0.0.1");
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · packages/commands/src/commands/auth/login-console.ts:386
F-04 Network egressCWE-200 · CWE-319Layer L1
const u = new URL(req.url ?? "/", "http://127.0.0.1");
Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · packages/commands/tests/e2e/managed-agent-auth-chain.e2e.test.ts:127
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.hidden_file · packages/commands/tests/e2e/fixtures/.dataset-cpt-valid.jsonl
F-13 Inventory / provenanceCWE-1104Layer L0
.dataset-cpt-valid.jsonl
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · packages/commands/tests/e2e/fixtures/.dataset-dpo-invalid.jsonl
F-13 Inventory / provenanceCWE-1104Layer L0
.dataset-dpo-invalid.jsonl
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · packages/commands/tests/e2e/fixtures/.dataset-dpo-valid.jsonl
F-13 Inventory / provenanceCWE-1104Layer L0
.dataset-dpo-valid.jsonl
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · packages/commands/tests/e2e/fixtures/.dataset-invalid.jsonl
F-13 Inventory / provenanceCWE-1104Layer L0
.dataset-invalid.jsonl
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · packages/commands/tests/e2e/fixtures/.dataset-valid.jsonl
F-13 Inventory / provenanceCWE-1104Layer L0
.dataset-valid.jsonl
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInsecure cryptocrypto.weak_hash · packages/commands/src/commands/knowledge/doc-upload.ts:210
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
const contentMd5 = createHash("md5").update(fileBuffer).digest("base64");
Why
No further detail recorded for this rule.
Fix
—
LOWInsecure cryptocrypto.weak_hash · packages/core/lib/remote-telemetry/tracker.cjs:1105
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
device_id: N.a.createHash("md5").update(E()).digest("hex"),
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · packages/cli/tests/e2e/registry.smoke.e2e.test.ts:7
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { commands } from "../../src/commands.ts";
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · packages/cli/tests/skill-risk-confirmation.test.ts:6
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
const repositoryRoot = join(dirname(fileURLToPath(import.meta.url)), "../../..");
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · packages/cli/tests/skill-sandbox-reference.test.ts:9
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
const repositoryRoot = join(dirname(fileURLToPath(import.meta.url)), "../../..");
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · packages/commands/src/commands/managed-agent/_engine/playground-launcher.ts:202
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
readPlaygroundVersion(resolve(dirname(monorepoBinary), "../../package.json")) ===
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · packages/commands/src/commands/managed-agent/deployment/runs/get.ts:4
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { displayValue } from "../../_engine/api-helpers.ts";
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · CHANGELOG.md:633
F-04 Network egressCWE-200 · CWE-319Layer L1
- `bl` now honors `HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY` environment variables (#35). Node's built-in `fetch` (undici) ignores proxy env vars by default, causing `ECONNRESET` for users behind a VPN
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · CHANGELOG.zh.md:633
F-04 Network egressCWE-200 · CWE-319Layer L1
- `bl` 现在会读取 `HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY` 环境变量(#35)。Node 内置的 `fetch`(undici)默认忽略代理环境变量,导致 VPN 或公司代理下出现 `ECONNRESET`。现已在启动时根据这些变量安装全局代理 dispatcher,并在 `ECONNRESET` 报错提示中给出 `export HTTPS_PRO
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.base64_blob · packages/commands/tests/e2e/managed-agent.e2e.test.ts:25
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
"UEsDBAoAAAAIAGBoIV3X45MGOwAAAEoAAAAIAAAAU0tJTEwubWTT1dXlykvMTbVSyMlPTszRLUotyC8q4UpJLU4uyiwoyczPs1LwAckoQGQUirMzc3K4dIHalKESQRAtAFBLAwQKAAAAAABgaCFdAAAAAAAAAAAAAAAACAAAAHNjcmlwdHMvUEsDBAoAAAAIAGBoIV3
Why
No further detail recorded for this rule.
Fix
—

Tools it exposes

5 declared in source · 0 destructive

5 read0 write0 destructive
ToolWhat it doesRisk
demodemo skillread
demo-skilla demo skillread
get_weatherget weatherread
kb_chatAsk the knowledge base directly and get a complete, domain-tuned answer from a specialized RAG pipelineread
kb_searchSemantic search over a Bailian knowledge base. Returns raw knowledge chunks with scores and sourceread

Safer alternatives

Graphlit✓SAFE

graphlit/graphlit-mcp-server

Model Context Protocol (MCP) Server for Graphlit Platform

4 destructiveGrade B
LangChain.js MCP Adapters✓SAFE

langchain-ai/langchainjs-mcp-adapters

** THIS REPO HAS MOVED TO https://github.com/langchain-ai/langchainjs/tree/main/libs/langchain-mcp-adapters ** Adapters for integrating Model Context Protocol (MCP) tools with LangChain.js applications, supporting both stdio and SSE transports.

1 writeGrade B
Oxylabs✓SAFE

oxylabs/oxylabs-mcp

Official Oxylabs MCP integration

Grade B

Audit history

  1. ✕BLOCK F 42 / 100

    Score 40 -> 42 · ca58ac0dbb16

  2. ✕BLOCK F 40 / 100

    First audit · e01cfc029808

README badge

Badges show the current verdict, BLOCK included

ModelsAtlas: BLOCK FMODELSATLASBLOCK · F

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about cli MCP server

What is the cli MCP server?
Official Model Studio CLI(阿里云百炼 CLI)built for AI Agent frameworks, exposing models, search, multimodal, and workflow capabilities as structured tool calls.
What tools does cli expose?
5 in total: 5 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is cli safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (42/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does cli need?
It reads ACTIONS_ID_TOKEN_REQUEST_TOKEN, ACTIONS_ID_TOKEN_REQUEST_URL, ALIBABA_CLOUD_ACCESS_KEY_ID, ALIBABA_CLOUD_ACCESS_KEY_SECRET, ANTHROPIC_API_KEY, ARK_API_KEY, BAILIAN_E2E_OSS_KEY, DASHSCOPE_API_KEY and QODER_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does cli run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as bailian-cli-runtime at 2.1.0.
How current is this page?
The grade is for one exact copy of the source (ca58ac0dbb16), read on 2026-10-03. The repository is watched and re-audited when it changes.
Which Cli MCP server is the right one?
mcpgod/cli. 4 servers share the name; see the side-by-side comparison.
I already installed cli. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

  • modelstudioai/cli on GitHub — the source we read, its licence, stars and activityObserved · 3 Oct 2026
  • ModelsAtlas trust audit — BLOCK verdict for commit ca58ac0dbb16Observed · 3 Oct 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.