Atlas / MCP servers / w1ckedxt / Cynical Sally

Cynical SallyBLOCK

Name: Cynical Sally
Author: w1ckedxt

mcp/w1ckedxt/cynical-sally

MCP server by w1ckedxt · ai · ai code review · claude · Audited 2026-10-07

Brutally honest senior-engineer code reviews for Claude Code, Cursor & Windsurf - and your terminal. Scores, evidence-backed issues, usable fixes.

Verdict

BLOCK

Grade

Trust score

59 /100

Exposed tools

8 8r · 0w · 0d

Transport

stdio

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Cynical Sally

Brutally honest code reviews. In your terminal and your AI editor. Because "You're absolutely right" is probably absolutely wrong. npm i -g @cynicalsally/cli · MCP server for Claude Code, Cursor & Windsurf

Read from source at commit 784cd3af253aOBSERVED · 2026-10-07

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code (npm)

claude mcp add cli -- npx -y @cynicalsally/[email protected] mcp

Exposed tools (8)

8 read · 0 write · 0 destructive.

Tool	Risk	Description
`sally_brainstorm`	read
`sally_explain`	read
`sally_frontend`	read
`sally_marketing`	read
`sally_refactor`	read
`sally_review_pr`	read
`sally_roast`	read
`sally_usage`	read

Trust audit

BLOCKgrade F · trust 59/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (5 observation(s))
Network: declared (5 observation(s))
Shell: declared (8 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (15)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/commands/upgrade.ts:45

exec(`${openCmd} "${url}"`);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/utils/background.ts:36

exec(`osascript -e 'display notification "${safeMessage}" with title "${safeTitle}"'`);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

src/utils/background.ts:38

exec(`notify-send "${safeTitle}" "${safeMessage}"`);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/utils/files.ts:94

"id_rsa",

Why it matters. touches a credential store

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/utils/files.ts:96

"id_ecdsa",

Why it matters. touches a credential store

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/utils/files.ts:97

"id_ed25519",

Why it matters. touches a credential store

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/utils/files.ts:102

".netrc",

Why it matters. touches a credential store

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

src/utils/track.ts:7

const { version } = require("../../package.json") as { version: string };

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

package.json

@modelcontextprotocol/sdk, chalk, commander, inquirer, ora, @types/node, typescript

Why it matters. 7 dependency range(s) float

Fix. pin exact versions or ship a lockfile