Atlas / MCP servers / vespo92 / TrueNAS Core

TrueNAS CoreSAFE

Name: TrueNAS Core
Author: vespo92

mcp/vespo92/truenas-core

MCP server by vespo92 · Audited 2026-10-08

⚑ Report / re-scan Source ↗

A working TrueNAS Core MCP Server

Verdict

SAFE

Grade

Trust score

85 /100

Exposed tools

1 1r · 0w · 0d

Transport

—

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://www.python.org/downloads/) [](https://github.com/modelcontextprotocol/python-sdk) [](LICENSE) [](https://pypi.org/project/truenas-mcp-server/)

A production-ready Model Context Protocol (MCP) server for TrueNAS Core and SCALE systems. Control and manage your TrueNAS storage and virtualization through natural language with Claude or other MCP-compatible clients.

Automatic variant detection: The server automatically detects whether you're connected to TrueNAS Core or SCALE and enables the appropriate features.

🚀 Features

Universal Features (Core & SCALE)

User Management - Create, update, delete users and manage permissions
Storage Management - Manage pools, datasets, volumes with full ZFS support
File Sharing - Configure SMB, NFS, and iSCSI shares
Snapshot Management - Create, delete, rollback snapshots with automation
System Monitoring - Check system health, pool status, and resource usage

TrueNAS SCALE Features (24.04+)

Automatically enabled when connected to SCALE

Apps - Manage Docker Compose-based TrueNAS applications
Incus Instances - Control Incus VMs and containers (SCALE 25.04+)
Legacy VMs - Manage bhyve virtual machines

Enterprise Features

Type-Safe Operations - Full Pydantic models for request/response validation
Comprehensive Error Handling - Detailed error messages and recovery guidance
Production Logging - Structured logging with configurable levels
Connection Pooling - Efficient HTTP connection management with retry logic
Rate Limiting - Built-in rate limiting to prevent API abuse
Environment-Based Config - Flexible configuration via environment variables

📦

Read from source at commit b38a16eac1b0OBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add truenas-mcp-server --env TRUENAS_API_KEY=${TRUENAS_API_KEY} -- uvx truenas-mcp-server

claude-desktop

{
  "mcpServers": {
    "truenas-mcp-server": {
      "command": "uvx",
      "args": [
        "truenas-mcp-server"
      ],
      "env": {
        "TRUENAS_API_KEY": "${TRUENAS_API_KEY}"
      }
    }
  }
}

Exposed tools (1)

1 read · 0 write · 0 destructive.

Tool	Risk	Description
`debug_env`	read	Debug function to check environment variables

Trust audit

SAFEgrade B · trust 85/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	WARN
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: declared (2 observation(s))
Shell: none-observed
Dependencies: pinned
Secrets in source: found

Findings (18)

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

tests/quick_test.py:6

api_key = "3-4vPYKNTxvN9BymmhgU77JDvrQBPbOdkCr7oM7n7ODScoZA7xaiKM1Al6uNNlKldS"

LOWInventory / provenance · inv.hidden_file · CWE-1104

.pre-commit-config.yaml

.pre-commit-config.yaml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

truenas_mcp_server/cache/manager.py:165

return hashlib.md5(key_str.encode()).hexdigest()

LOWInformation disclosure · disclose.log_secret · CWE-209, CWE-532

tests/test_api_direct.py:25

print(f"API Key: {api_key[:10]}...{api_key[-10:]}")

LOWInformation disclosure · disclose.log_secret · CWE-209, CWE-532

utils/test_api_auth.sh:46

print(f"API Key: {api_key[:10]}...{api_key[-10:]}")

LOWInformation disclosure · disclose.log_secret · CWE-209, CWE-532

utils/test_api_auth.sh:47

print(f"Key Length: {len(api_key)} characters")