MCP server · Audited from source
Code Interpreter API MCP server
by shroominic/codeinterpreter-apiMIT licenceAudited 21 Sep 2026 · source b7708f9f9882
Is it safe? With care — CAUTION, grade B (83/100). It exposes 1 tool: 1 read, 0 write and 0 destructive. The audit recorded 5 findings (0 critical, 1 high, 1 medium, 3 low). Maintainer's description: 👾 Open source implementation of the ChatGPT Code Interpreter
Cite
Cite this page
ModelsAtlas. “Code Interpreter API MCP server (shroominic/codeinterpreter-api)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/shroominic/code-interpreter-api
Trust audit
Audit 0.4.1 · full source read 21 Sep 2026
5 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.
What the source does
- FilesystemDeclared1 observation
- NetworkDeclared3 observations
- ShellNone observedNothing seen in the source
- DependenciesPinnedNothing floats
- SecretsFoundSee the findings
“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.
Five audit layers
| Layer | What we check | Result |
|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS |
L1 Static source | Secrets, path traversal, supply chain | FAIL 4 findings |
L2 Instructions | Prompt injection and authority framing in docs and tool descriptions | PASS 1 finding |
L3 Inventory | Declared tools match the source | PASS |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED |
Provenance & runtime
Who published it, and what the audit could and could not run
Provenance
- Repository owner
shroominicUser accountAccount type recorded when we read the repository. - PackagePublished on PyPI
codeinterpreterapi, no version recorded - LicenceMITFrom the repository, as read at the audited commit.
- Last push23 months agoActivity of the repository when we read it.
- Source commit readb7708f9f9882The audit covers exactly this commit, read on 21 Sep 2026.
Runtime
- Sandbox runNot run yetThis audit read the source only; it did not execute the server.
- Tool inventory1 declaredRead from the source and classed read, write or destructive.
Every value here is read from the record's own repository and audit.Suggest a correction
Findings (5)
Sorted by severity
HIGHHard-coded secretssecret.db_uri · src/codeinterpreterapi/config.py:36
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.db_uri · docs/settings.md:71
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.decode_call · src/codeinterpreterapi/session.py:244
file_buffer = BytesIO(base64.b64decode(output.content))
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.decode_call · src/codeinterpreterapi/session.py:292
file_buffer = BytesIO(base64.b64decode(output.content))
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWPrompt injectionprompt.transfer_instruction · docs/deploy.md:8
- Get your API key from [CodeBox](https://pay.codeboxapi.com/b/00g3e6dZX2fTg0gaEE) (you get an email with the api-key)
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
Tools it exposes
1 declared in source · 0 destructive
| Tool | Risk | What it does |
|---|---|---|
python | read | Input a string of code to a ipython interpreter. |
Install
audited commit b7708f9
Read the findings first. The most severe is Hard-coded secrets (high) at src/codeinterpreterapi/config.py.
One-click links open your editor with the config below filled in, exactly as the snippets show it. The audit covers commit b7708f9 only.
claude mcp add codeinterpreterapi -- uvx codeinterpreterapi
{
"mcpServers": {
"codeinterpreterapi": {
"command": "uvx",
"args": [
"codeinterpreterapi"
]
}
}
}The command does not pin a version; the audit covers commit b7708f9f9882. Transport: not declared. No environment variables required.
Audit history
- !CAUTION B 83 / 100
Source changed, verdict held ·
b7708f9f9882
README badge
For maintainers · updates on every re-audit
[](https://modelsatlas.com/mcp/shroominic/code-interpreter-api/)
The badge always shows the latest audit; a maintainer cannot pin an old verdict.
Other ratings
Cited, never blended into our score
No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.
Questions about Code Interpreter API MCP server
What is the Code Interpreter API MCP server?
What tools does Code Interpreter API expose?
Is Code Interpreter API safe to connect to an agent?
What credentials does Code Interpreter API need?
How current is this page?
Sources
- shroominic/codeinterpreter-api on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
- ModelsAtlas trust audit — CAUTION verdict for commit b7708f9f9882Observed · 21 Sep 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What is the Code Interpreter API MCP server?
- What tools does Code Interpreter API expose?
- Is Code Interpreter API safe to connect to an agent?