MCP server · Audited from source

tilion-fortress MCP server

by tiliondev/fortressNOASSERTION licenceAudited 20 Oct 2026 · source 02cc5591090f

npm tilion-fortress 151.0.7910stdio★ 769

!CAUTIONGrade B · 87/100 · 20 Oct 2026 · 02cc559

769GitHub stars

Is it safe? With care — CAUTION, grade B (87/100). The tool list is built at runtime, so we cannot read it from the source. The audit recorded 17 findings (0 critical, 1 high, 0 medium, 11 low). Maintainer's description: Stealth Chromium engine that stops scrapers and browser agents from getting blocked, with one line of code change.

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “tilion-fortress MCP server (tiliondev/fortress)”. Retrieved 20 Oct 2026. https://modelsatlas.com/mcp/tiliondev/fortress

Trust audit

Audit 0.4.1 · full source read 20 Oct 2026

Trust score87/100!CAUTION B

0 critical1 high0 medium11 low5 info

17 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared5 observations
NetworkDeclared6 observations
ShellDeclared5 observations
DependenciesPinnedNothing floats
SecretsNone foundNo keys in source

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

Layer	What we check	Result
`L0` Provenance	Repo owner, licence, archive status, activity	PASS 7 findings
`L1` Static source	Secrets, path traversal, supply chain	FAIL 7 findings
`L2` Instructions	Prompt injection and authority framing in docs and tool descriptions	PASS 2 findings
`L3` Inventory	Declared tools match the source	PASS 1 finding
`L4` Sandbox	Run in isolation and watch behaviour	SKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

Repository owner tiliondevOrganizationAccount type recorded when we read the repository.
PackagePublished on npmtilion-fortress at version 151.0.7910
LicenceNOASSERTIONFrom the repository, as read at the audited commit.
Last push14 days agoActivity of the repository when we read it.
Source commit read02cc5591090fThe audit covers exactly this commit, read on 20 Oct 2026.

Runtime

Sandbox runNot run yetThis audit read the source only; it did not execute the server.
Tool inventoryBuilt at runtimeThe source declares no tools; the server lists them when a client connects, so we cannot read them.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (17)

Sorted by severity

HIGHNetwork egressnet.metadata_ip · mcp/server.py:91

F-04 Network egressCWE-200 · CWE-319Layer L1

if host.lower() in ("localhost", "metadata.google.internal"):

Why: cloud metadata endpoint: the classic SSRF credential grab
Fix: —

LOWInventory / provenanceinv.hidden_file · .lycheeignore

F-13 Inventory / provenanceCWE-1104Layer L0

.lycheeignore

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.hidden_file · .pre-commit-config.yaml

F-13 Inventory / provenanceCWE-1104Layer L0

.pre-commit-config.yaml

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWNetwork egressnet.raw_ip · AGENTS.md:171

F-04 Network egressCWE-200 · CWE-319Layer L1

Poll `http://127.0.0.1:9222/json/version` with a finite deadline, for example

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · AGENTS.md:195

F-04 Network egressCWE-200 · CWE-319Layer L1

browser = p.chromium.connect_over_cdp("http://127.0.0.1:9222")

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · AGENTS.md:207

F-04 Network egressCWE-200 · CWE-319Layer L1

const browser = await chromium.connectOverCDP("http://127.0.0.1:9222");

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · AGENTS.md:219

F-04 Network egressCWE-200 · CWE-319Layer L1

const browser = await puppeteer.connect({ browserURL: "http://127.0.0.1:9222" });

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.raw_ip · AGENTS.md:390

F-04 Network egressCWE-200 · CWE-319Layer L1

base = 'http://127.0.0.1:9222'

Why: No further detail recorded for this rule.
Fix: —

LOWObfuscation / stealthobf.decode_call · mcp/server.py:379

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

fh.write(base64.b64decode(b64))

Why: No further detail recorded for this rule.
Fix: —

LOWPrivilege escalation / persistencereview.unsafe_action · AGENTS.md

F-06 Privilege escalation / persistenceCWE-269 · CWE-250Layer L2

Persist the selected commands on **user PATH**, without an administrator-wide PATH change.

Why: Automatically modifying the user's PATH during install is a persistent system change made without a per-step consent.
Fix: rewrite it so the instruction says plainly what it does, and asks the user before it acts

LOWPrivilege escalation / persistencereview.unsafe_action · AGENTS.md

F-06 Privilege escalation / persistenceCWE-269 · CWE-250Layer L2

Do not access their inbox or send email without explicit permission.

Why: The instruction anticipates agent-initiated access to the user's mail, a capability the package description does not admit.
Fix: rewrite it so the instruction says plainly what it does, and asks the user before it acts

LOWInventory / provenancemcp.no_tools_extracted · mcp/server.json

F-13 Inventory / provenanceCWE-1104Layer L3

Why: the tool list is enumerated at runtime by tools/list, not declared in source
Fix: the page says so rather than showing an empty table

INFOInventory / provenanceinv.oversize · docs/assets/banner-fortress.png

F-13 Inventory / provenanceCWE-1104Layer L0

docs/assets/banner-fortress.png

Why: 10524150 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · docs/assets/browserscan.png

F-13 Inventory / provenanceCWE-1104Layer L0

docs/assets/browserscan.png

Why: 3350763 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · docs/assets/demo.gif

F-13 Inventory / provenanceCWE-1104Layer L0

docs/assets/demo.gif

Why: 1488995 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · docs/assets/dockerhub-banner.png

F-13 Inventory / provenanceCWE-1104Layer L0

docs/assets/dockerhub-banner.png

Why: 8062100 bytes not read
Fix: —

INFOInventory / provenanceinv.oversize · docs/assets/fortress-fingerprint.gif

F-13 Inventory / provenanceCWE-1104Layer L0

docs/assets/fortress-fingerprint.gif

Why: 5068761 bytes not read
Fix: —

Tools it exposes

None declared in source

The tool list is built at runtime, so we cannot read it from the source.

Install

Package version 151.0.7910 · audited commit 02cc559

Read the findings first. The most severe is Network egress (high) at mcp/server.py.

claude mcp add tilion --env TILION_API_KEY=${TILION_API_KEY} -- uvx tilion==0.1.3 tilion-mcp

The command pins the package version recorded in the source (151.0.7910); the audit covers commit 02cc5591090f. Transport: stdio. Reads these environment variables: CAPTCHA_API_KEY, GITHUB_TOKEN, TILION_API_KEY. Give it the narrowest token it needs.

Audit history

2026-10-20
!CAUTION B 87 / 100
First audit · 02cc5591090f

README badge

For maintainers · updates on every re-audit

[![ModelsAtlas: CAUTION B](https://modelsatlas.com/mcp/tiliondev/fortress/badge.svg)](https://modelsatlas.com/mcp/tiliondev/fortress/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about tilion-fortress MCP server

What is the tilion-fortress MCP server?

Stealth Chromium engine that stops scrapers and browser agents from getting blocked, with one line of code change.

Is tilion-fortress safe to connect to an agent?

With care. The audit graded it B (87/100) and found 17 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does tilion-fortress need?

It reads CAPTCHA_API_KEY, GITHUB_TOKEN and TILION_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does tilion-fortress run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as tilion-fortress at 151.0.7910.

How current is this page?

The grade is for one exact copy of the source (02cc5591090f), read on 2026-10-20. The repository is watched and re-audited when it changes.

Sources

tiliondev/fortress on GitHub — the source we read, its licence, stars and activityObserved · 20 Oct 2026
ModelsAtlas trust audit — CAUTION verdict for commit 02cc5591090fObserved · 20 Oct 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the tilion-fortress MCP server?
GChatGPT CClaude PPerplexity
Is tilion-fortress safe to connect to an agent?
GChatGPT CClaude PPerplexity
What credentials does tilion-fortress need?
GChatGPT CClaude PPerplexity