Live survey286 models · 13 providers · 19,992 auditsAudited verification-before-completion · SAFE →What changedHow we verifyllms.txt

MCP server · Org-owned · Audited from source

Serena MCP server

by oraios/serenaNOASSERTION licenceAudited 20 Sep 2026 · source b86c316461b7

npm vue-calculator-test-fixture 1.0.0stdiostreamable-http★ 29,624
✕BLOCKGrade F · 51/100 · 20 Sep 2026 · b86c316
Safer alternativesView source on GitHub ↗

Is it safe? No — BLOCK, grade F (51/100). No tools were found in its source. The audit recorded 30 findings (0 critical, 5 high, 6 medium, 19 low). Maintainer's description: A powerful MCP toolkit for coding, providing semantic retrieval and editing capabilities - the IDE for your agent

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “Serena MCP server (oraios/serena)”. Retrieved 20 Sep 2026. https://modelsatlas.com/mcp/oraios/serena

Why this is BLOCK. The audit found 0 critical and 5 high findings; the most severe is Code injection at src/serena/hooks.py:213. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 20 Sep 2026

Trust score51/100✕BLOCK F
0 critical5 high6 medium19 low0 info

30 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemDeclared9 observations
  • NetworkDeclared6 observations
  • ShellDeclared14 observations
  • DependenciesNot pinnedSome ranges float
  • SecretsNone foundNo keys in source

Findings (30)

Sorted by severity · the 25 most severe of 30 are listed

HIGHCode injectioncode.deserialize · src/serena/hooks.py:213
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
return pickle.load(f)
Why
deserialises untrusted bytes into live objects
Fix
use json or yaml.safe_load
HIGHCode injectioncode.deserialize · src/serena/project_server.py:277
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
return pickle.loads(response.content)
Why
deserialises untrusted bytes into live objects
Fix
use json or yaml.safe_load
HIGHCode injectioncode.deserialize · src/serena/util/yaml.py:76
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
commented_map: CommentedMap | None = yaml.load(f)
Why
deserialises untrusted bytes into live objects
Fix
use json or yaml.safe_load
HIGHCode injectioncode.eval_exec · src/serena/repl/repl.py:354
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(compile(ast.Module(body=statements, type_ignores=[]), self.SOURCE_NAME, "exec"), namespace)
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · src/serena/repl/repl.py:356
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
return eval(compile(ast.Expression(body=trailing_expression), self.SOURCE_NAME, "eval"), namespace)
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
MEDIUMInventory / provenanceinv.binary · resources/jetbrains-marketplace-button.cdr
F-13 Inventory / provenanceCWE-1104Layer L0
jetbrains-marketplace-button.cdr
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
MEDIUMInventory / provenanceinv.binary · resources/serena-block-diagram.afdesign
F-13 Inventory / provenanceCWE-1104Layer L0
serena-block-diagram.afdesign
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
MEDIUMInventory / provenanceinv.binary · resources/serena-icons.cdr
F-13 Inventory / provenanceCWE-1104Layer L0
serena-icons.cdr
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
MEDIUMInventory / provenanceinv.binary · resources/serena-logo.cdr
F-13 Inventory / provenanceCWE-1104Layer L0
serena-logo.cdr
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
MEDIUMInventory / provenanceinv.binary · resources/serena-mac-dock-icon.cdr
F-13 Inventory / provenanceCWE-1104Layer L0
serena-mac-dock-icon.cdr
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
MEDIUMNetwork egressnet.raw_ip · src/serena/dashboard.py:1187
F-04 Network egressCWE-200 · CWE-319Layer L1
url = f"http://127.0.0.1:{port}/heartbeat"
Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.hidden_file · src/interprompt/.syncCommitId.remote
F-13 Inventory / provenanceCWE-1104Layer L0
.syncCommitId.remote
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · src/interprompt/.syncCommitId.this
F-13 Inventory / provenanceCWE-1104Layer L0
.syncCommitId.this
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · test/resources/repos/bsl/test_repo/.bsl-language-server.json
F-13 Inventory / provenanceCWE-1104Layer L0
.bsl-language-server.json
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · test/resources/repos/luau/test_repo/.luaurc
F-13 Inventory / provenanceCWE-1104Layer L0
.luaurc
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · test/resources/repos/r/test_repo/.Rbuildignore
F-13 Inventory / provenanceCWE-1104Layer L0
.Rbuildignore
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWCode injectioncode.deserialize · test/serena/test_hooks.py:972
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
return pickle.load(f)
Why
deserialises untrusted bytes into live objects
Fix
use json or yaml.safe_load
LOWCode injectioncode.deserialize · test/serena/test_hooks.py:1199
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
assert pickle.load(f).n_recent_grep_uses == 0
Why
deserialises untrusted bytes into live objects
Fix
use json or yaml.safe_load
LOWInsecure cryptocrypto.weak_hash · src/serena/util/text_utils.py:540
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
return hashlib.sha1(matched_text.encode("utf-8")).hexdigest()[: cls._DIGEST_LEN]
Why
No further detail recorded for this rule.
Fix
—
LOWInsecure cryptocrypto.weak_hash · src/solidlsp/language_servers/clangd_language_server.py:101
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
return hashlib.md5(f.read()).hexdigest()
Why
No further detail recorded for this rule.
Fix
—
LOWInsecure cryptocrypto.weak_hash · src/solidlsp/language_servers/eclipse_jdtls.py:725
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
return hashlib.md5(ws_hash_input).hexdigest()
Why
No further detail recorded for this rule.
Fix
—
LOWInsecure cryptocrypto.weak_hash · src/solidlsp/ls.py:218
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
self._content_hash = hashlib.md5(self.contents.encode(self.encoding)).hexdigest()
Why
No further detail recorded for this rule.
Fix
—
LOWInsecure cryptocrypto.weak_hash · test/solidlsp/java/test_jdtls_path_resolution.py:552
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
expected = hashlib.md5(self.REPO.encode()).hexdigest()
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · test/serena/test_memories_manager.py:416
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
fs_manager.get_memory_file_path("../../etc/passwd")
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · test/solidlsp/pascal/test_pascal_auto_update.py:171
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
member = tarfile.TarInfo(name="subdir/../../etc/passwd")
Why
No further detail recorded for this rule.
Fix
—

Tools it exposes

None declared in source

No tools were found in the source, so we cannot say what this server exposes.

Safer alternatives

Mcpdoc✓SAFE

langchain-ai/mcpdoc

Expose llms-txt to IDEs for development

3 readGrade B
Oh My Codex✓SAFE

staticpayload/oh-my-codex

oh-my-codex (omx) — Orchestration layer for OpenAI Codex CLI. Async Claude Code delegation (no timeouts), structured workflows (autopilot, TDD, code review, planning), persistent state & memory. Like oh-my-zsh but for Codex.

1 destructiveGrade B
Overture✓SAFE

sixhq/overture

Overture is an open-source, locally running web interface delivered as an MCP (Model Context Protocol) server that visually maps out the execution plan of any AI coding agent as an interactive flowchart/graph before the agent begins writing code.

7 writeGrade B

Audit history

  1. ✕BLOCK F 51 / 100

    Source changed, verdict held · b86c316461b7

  2. ✕BLOCK F 51 / 100

    First audit · e27094f193bc

README badge

Badges show the current verdict, BLOCK included

ModelsAtlas: BLOCK FMODELSATLASBLOCK · F

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about Serena MCP server

What is the Serena MCP server?
A powerful MCP toolkit for coding, providing semantic retrieval and editing capabilities - the IDE for your agent
Is Serena safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (51/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does Serena need?
It reads GITHUB_TOKEN and INTELEPHENSE_LICENSE_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Serena run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as vue-calculator-test-fixture at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (b86c316461b7), read on 2026-09-20. The repository is watched and re-audited when it changes.
I already installed Serena. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

  • oraios/serena on GitHub — the source we read, its licence, stars and activityObserved · 20 Sep 2026
  • ModelsAtlas trust audit — BLOCK verdict for commit b86c316461b7Observed · 20 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.