Live survey304 models · 14 providers · 22,792 auditsAudited grill-with-docs · SAFE →What changedHow we verifyllms.txt

MCP server · Audited from source

keeper.sh MCP server

by ridafkih/keeper.shAGPL-3.0 licenceAudited 30 Oct 2026 · source 94d29b28ebe4

npm @keeper.sh/workerstreamable-http★ 1,429
✕BLOCKGrade F · 41/100 · 30 Oct 2026 · 94d29b2
Safer alternativesView source on GitHub ↗

Is it safe? No — BLOCK, grade F (41/100). It exposes 2 tools: 2 read, 0 write and 0 destructive. The audit recorded 56 findings (0 critical, 2 high, 14 medium, 39 low). Maintainer's description: Calendar sync tool & universal calendar MCP server. Aggregate, sync and control calendars on Google, Outlook, Office 365, iCloud, CalDAV or ICS.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “keeper.sh MCP server (ridafkih/keeper.sh)”. Retrieved 30 Oct 2026. https://modelsatlas.com/mcp/ridafkih/keeper-sh

Why this is BLOCK. The audit found 0 critical and 2 high findings; the most severe is Inventory / provenance at services/api/src/handlers/websocket-payload.ts. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 30 Oct 2026

Trust score41/100✕BLOCK F
0 critical2 high14 medium39 low1 info

56 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemDeclared9 observations
  • NetworkDeclared12 observations
  • ShellDeclared1 observation
  • DependenciesNot pinnedSome ranges float
  • SecretsFoundSee the findings

Findings (56)

Sorted by severity · the 25 most severe of 56 are listed

HIGHInventory / provenanceinv.suspicious_name · services/api/src/handlers/websocket-payload.ts
F-13 Inventory / provenanceCWE-1104Layer L0
websocket-payload.ts
Why
member named after an attack tool
Fix
remove or justify
HIGHCode injectioncode.eval_exec · packages/calendar/src/core/utils/redis-rate-limiter.ts:38
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
eval(script: string, numberOfKeys: number, ...arguments_: string[]): Promise<unknown>;
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
MEDIUMNetwork egressnet.raw_ip · docker/services/Dockerfile:72
F-04 Network egressCWE-200 · CWE-319Layer L1
ENV VITE_API_URL=http://127.0.0.1:3001
Why
No further detail recorded for this rule.
Fix
—
MEDIUMNetwork egressnet.raw_ip · docker/standalone/Dockerfile:94
F-04 Network egressCWE-200 · CWE-319Layer L1
ENV VITE_API_URL=http://127.0.0.1:3001
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.zero_width · packages/calendar/src/ics/utils/apply-patches.ts:48
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
const BYTE_ORDER_MARK = "";
Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.db_uri · .github/workflows/checks.yml:201
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.db_uri · .github/workflows/checks.yml:268
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.db_uri · README.md:91
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.db_uri · README.md:411
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.db_uri · README.md:540
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · packages/auth/tests/a-microsoft-sign-in-links-only-an-asserted-email.test.ts:14
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · packages/auth/tests/abandoned-unverified-registration-reclaim.test.ts:11
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · packages/auth/tests/an-outlook-sign-in-records-the-email-as-verified.test.ts:8
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · packages/auth/tests/mcp-token-version-flow.test.ts:181
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · packages/auth/tests/mcp-token-version-flow.test.ts:201
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMAuth / authzmcp.remote_no_auth
F-10 Auth / authzCWE-287 · CWE-862Layer L3
streamable-http
Why
a network transport with no auth environment variable found
Fix
require a token
LOWInventory / provenanceinv.hidden_file · .gitmodules
F-13 Inventory / provenanceCWE-1104Layer L0
.gitmodules
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · .oxlintrc.json
F-13 Inventory / provenanceCWE-1104Layer L0
.oxlintrc.json
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · applications/web/.eslintrc.cjs
F-13 Inventory / provenanceCWE-1104Layer L0
.eslintrc.cjs
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · packages/database/.env.template
F-13 Inventory / provenanceCWE-1104Layer L0
.env.template
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.hidden_file · services/api/.env.template
F-13 Inventory / provenanceCWE-1104Layer L0
.env.template
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.suspicious_name · services/api/tests/handlers/websocket-payload.test.ts
F-13 Inventory / provenanceCWE-1104Layer L0
websocket-payload.test.ts
Why
member named after an attack tool
Fix
remove or justify
LOWCode injectioncode.eval_exec · packages/calendar/tests/core/utils/rate-limiter-abandoned-waiter.test.ts:17
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
eval(script: string, numberOfKeys: number, ...arguments_: string[]): Promise<unknown>;
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWCode injectioncode.eval_exec · packages/calendar/tests/core/utils/rate-limiter-arrival-order.test.ts:11
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
eval(script: string, numberOfKeys: number, ...arguments_: string[]): Promise<unknown>;
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWCode injectioncode.eval_exec · packages/calendar/tests/core/utils/rate-limiter-lost-join-reply.test.ts:12
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
eval(script: string, numberOfKeys: number, ...arguments_: string[]): Promise<unknown>;
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table

Tools it exposes

2 declared in source · 0 destructive

2 read0 write0 destructive
ToolWhat it doesRisk
FreeEnough for two calendar accounts and three connections.read
ProAs many calendars as you want, with Google and Outlook changes landing within seconds.read

Safer alternatives

All calendar & office servers →
gws-mcp-server✓SAFE

conorbronsdon/gws-mcp-server

Curated MCP server for Google Workspace: Gmail, Calendar, Drive, Sheets, Docs, and Tasks via the official gws CLI. 67 focused tools instead of 400, side effects declared on every one. The permissions leg of trust infrastructure for agents.

13 destructiveGrade B
Calendar✓SAFE

deciduus/calendar-mcp

Google Calendar MCP server: 23 tools for LLM agents. Install with uvx calendar-mcp-server.

Grade B
Evernote✓SAFE

verygoodplugins/mcp-evernote

MCP server for Evernote integration with note management and synchronization

2 destructiveGrade B

Audit history

  1. ✕BLOCK F 41 / 100

    First audit · 94d29b28ebe4

README badge

Badges show the current verdict, BLOCK included

ModelsAtlas: BLOCK FMODELSATLASBLOCK · F

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about keeper.sh MCP server

What is the keeper.sh MCP server?
Calendar sync tool & universal calendar MCP server. Aggregate, sync and control calendars on Google, Outlook, Office 365, iCloud, CalDAV or ICS.
What tools does keeper.sh expose?
2 in total: 2 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is keeper.sh safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (41/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does keeper.sh need?
No credential environment variables were found in its source, so it appears to need none.
How does keeper.sh run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @keeper.sh/worker.
How current is this page?
The grade is for one exact copy of the source (94d29b28ebe4), read on 2026-10-30. The repository is watched and re-audited when it changes.
I already installed keeper.sh. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

  • ridafkih/keeper.sh on GitHub — the source we read, its licence, stars and activityObserved · 30 Oct 2026
  • ModelsAtlas trust audit — BLOCK verdict for commit 94d29b28ebe4Observed · 30 Oct 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.