MCP server · Audited from source

Ouroboros MCP server

by q00/ouroborosMIT licenceAudited 21 Sep 2026 · source 53cce73ca28d

npm habit-tracker-cli 1.0.0ssestdiostreamable-http★ 6,050

✕BLOCKGrade F · 33/100 · 21 Sep 2026 · 53cce73

Safer alternatives View source on GitHub ↗

Is it safe? No — BLOCK, grade F (33/100). It exposes 3 tools: 3 read, 0 write and 0 destructive. The audit recorded 70 findings (0 critical, 11 high, 16 medium, 40 low). Maintainer's description: Agent OS: the agent gets smarter on its own. We just hold the line: Interview-gated, staged evaluation, budgeted evolution loop. MCP server, 14 runtimes: Claude Code, Codex CLI, Gemini CLI, OpenCode, Copilot, Kiro and more.

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Ouroboros MCP server (q00/ouroboros)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/q00/ouroboros

Why this is BLOCK. The audit found 0 critical and 11 high findings; the most severe is Code injection at src/ouroboros/cli/runtime_activation.py:343. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 21 Sep 2026

Trust score33/100✕BLOCK F

0 critical11 high16 medium40 low3 info

70 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared9 observations
NetworkDeclared11 observations
ShellDeclared9 observations
DependenciesNot pinnedSome ranges float
SecretsFoundSee the findings

Findings (70)

Sorted by severity · the 25 most severe of 70 are listed

HIGHCode injectioncode.deserialize · src/ouroboros/cli/runtime_activation.py:343

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

loaded = yaml.load(snapshot.contents.decode("utf-8"), Loader=_UniqueKeyLoader)

Why: deserialises untrusted bytes into live objects
Fix: use json or yaml.safe_load

HIGHCode injectioncode.eval_exec · src/ouroboros/auto/seed_preflight.py:427

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

r"(?:command(?:\s+(?:--|-p|-v|-V))*\s+)?eval(?:\s|$)",

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

HIGHCode injectioncode.eval_exec · src/ouroboros/mcp/server/security.py:524

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

"eval(",

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

HIGHCode injectioncode.eval_exec · src/ouroboros/mcp/server/security.py:525

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

"exec(",

Why: evaluates text as code
Fix: remove; use a parser or a dispatch table

HIGHFilesystem / pathfs.credential_store · src/ouroboros/evaluation/artifact_collector.py:107

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

".netrc",

Why: touches a credential store
Fix: —

HIGHFilesystem / pathfs.credential_store · src/ouroboros/evaluation/artifact_collector.py:110

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

"id_rsa",

Why: touches a credential store
Fix: —

HIGHFilesystem / pathfs.credential_store · src/ouroboros/evaluation/artifact_collector.py:111

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

"id_ed25519",

Why: touches a credential store
Fix: —

HIGHFilesystem / pathfs.credential_store · src/ouroboros/evaluation/artifact_collector.py:112

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

"id_ecdsa",

Why: touches a credential store
Fix: —

HIGHPrompt injectionprompt.hide_from_user · skills/auto/SKILL.md:226

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

status), keep waiting. Do not tell the user to call job tools themselves.

Why: asks the agent to act without the user's knowledge
Fix: —

HIGHPrompt injectionprompt.tool_poisoning · docs/runtime-guides/omp.md:94

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

[--append-system-prompt <SYSTEM>] [--tools <TOOLS>] [--no-tools] <PROMPT>

Why: a tool description carrying instructions to the agent
Fix: tool descriptions describe the tool; nothing else

HIGHPrompt injectionprompt.tool_poisoning · docs/runtime-guides/pi.md:87

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

[--append-system-prompt <SYSTEM>] [--tools <TOOLS>] [--no-tools] <PROMPT>

Why: a tool description carrying instructions to the agent
Fix: tool descriptions describe the tool; nothing else

MEDIUMCode injectioncode.dynamic_import · src/ouroboros/auto/__init__.py:95

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

value = getattr(importlib.import_module(module_name), name)

Why: No further detail recorded for this rule.
Fix: —

MEDIUMCode injectioncode.dynamic_import · src/ouroboros/orchestrator/capabilities/__init__.py:116

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

_lateral_personas = importlib.import_module(f"{__name__}.lateral_personas")

Why: No further detail recorded for this rule.
Fix: —

MEDIUMCode injectioncode.dynamic_import · src/ouroboros/orchestrator/capabilities/__init__.py:121

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

_pm_schemas = importlib.import_module(f"{__name__}.pm_schemas")

Why: No further detail recorded for this rule.
Fix: —

MEDIUMCode injectioncode.dynamic_import · src/ouroboros/orchestrator/capabilities/__init__.py:249

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

_tool_specs = importlib.import_module(f"{__name__}.tool_specs")

Why: No further detail recorded for this rule.
Fix: —

MEDIUMCode injectioncode.dynamic_import · src/ouroboros/orchestrator/capabilities/__init__.py:290

F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1

_interview_schemas = importlib.import_module(f"{__name__}.interview_schemas")

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · scripts/live-dsh-interview.cjs:19

F-04 Network egressCWE-200 · CWE-319Layer L1

const baseUrl = process.env.DSH_URL || 'http://127.0.0.1:3081';

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.anthropic · tests/unit/core/test_security.py:82

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · tests/unit/evolution/test_provider_usage.py:740

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · tests/unit/evolution/test_provider_usage.py:743

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · tests/unit/evolution/test_provider_usage.py:1919

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.github · tests/unit/plugin/test_firewall.py:1660

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.github · tests/unit/plugin/test_firewall_tool_call_dispatch.py:134

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.github · tests/unit/plugin/test_firewall_tool_call_dispatch.py:475

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.slack · tests/unit/auto/test_state_provenance.py:35

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

Tools it exposes

3 declared in source · 0 destructive

3 read0 write0 destructive

Tool	What it does	Risk
`identity`	Return any JSON value unchanged.	read
`identity-null`	Return JSON null unchanged.	read
`inspect_payload`	return payload	read

Safer alternatives

Ref Tools✓SAFE

ref-tools/ref-tools-mcp

Helping coding agents never make mistakes working with public or private libraries without wasting the context window.

3 readGrade B

MegaMemory✓SAFE

0xk3vin/megamemory

Persistent project knowledge graph for coding agents. MCP server with semantic search, in-process embeddings, and web explorer.

1 destructiveGrade B

Alive Analysis✓SAFE

with-geun/alive-analysis

Data analysis workflow kit for AI coding agents. Structure your analysis with the ALIVE loop — Ask, Look, Investigate, Voice, Evolve.

4 readGrade B

Audit history

2026-09-21
✕BLOCK F 33 / 100
Source changed, verdict held · 53cce73ca28d
2026-09-16
✕BLOCK F 33 / 100
First audit · 6bd55d5c8f0c

README badge

Badges show the current verdict, BLOCK included

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about Ouroboros MCP server

What is the Ouroboros MCP server?

Agent OS: the agent gets smarter on its own. We just hold the line: Interview-gated, staged evaluation, budgeted evolution loop. MCP server, 14 runtimes: Claude Code, Codex CLI, Gemini CLI, OpenCode, Copilot, Kiro and more.

What tools does Ouroboros expose?

3 in total: 3 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Ouroboros safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (33/100) and found 11 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does Ouroboros need?

It reads ANTHROPIC_API_KEY, CACHED_TEST_API_KEY, COPILOT_TOKEN, GH_TOKEN, GITHUB_TOKEN, GOOGLE_API_KEY, OPENAI_API_KEY, OPENROUTER_API_KEY, OUROBOROS_POSTHOG_API_KEY and SOME_VENDOR_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Ouroboros run?

It speaks sse, stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as habit-tracker-cli at 1.0.0.

How current is this page?

The grade is for one exact copy of the source (53cce73ca28d), read on 2026-09-21. The repository is watched and re-audited when it changes.

I already installed Ouroboros. What should I do?

Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.

Can the verdict change?

Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

q00/ouroboros on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
ModelsAtlas trust audit — BLOCK verdict for commit 53cce73ca28dObserved · 21 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Ouroboros MCP server?
GChatGPT CClaude PPerplexity
What tools does Ouroboros expose?
GChatGPT CClaude PPerplexity
Is Ouroboros safe to connect to an agent?
GChatGPT CClaude PPerplexity