Atlas / MCP servers / williamcloudqi / MATLAB

MATLABBLOCK

mcp/williamcloudqi/matlab-1

The MATLAB MCP server provides AI users with powerful scientific computing and data analysis capabilities. It allows users to execute MATLAB code directly in conversations, generate MATLAB scripts from natural language descriptions, and access MATLAB documentation.

Verdict
BLOCK
Grade
F
Trust score
47 /100
Exposed tools
2 1r · 1w · 0d
Transport
sse · stdio
License
Apache-2.0
Stars
54
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

We welcome contributions from everyone.

A powerful MCP server that integrates MATLAB with AI, allowing you to execute MATLAB code, generate MATLAB scripts from natural language descriptions, and access MATLAB documentation directly through your AI assistant.

Features

Resources

  • Access MATLAB documentation via matlab://documentation/getting-started URI
  • Get started guide with examples and usage instructions

Tools

  • execute_matlab_code - Execute MATLAB code and get results
  • Run any MATLAB commands or scripts
  • Option to save scripts for future reference
  • View output directly in your conversation
  • generate_matlab_code - Generate MATLAB code from natural language
  • Describe what you want to accomplish in plain language
  • Get executable MATLAB code in response
  • Option to save generated scripts

Development

Install dependencies:

npm install

Build the server:

npm run build

For development with auto-rebuild:

npm run watch

Requirements

  • MATLAB installed on your system
  • Node.js (v14 or higher)

Installation

Installing via Smithery

To install MATLAB MCP Server for Claude Desktop automatically via Smithery:

npx -y @smithery/cli install @WilliamCloudQi/matlab-mcp-server --client claude

1. Install the package

npm install -g matlab-mcp-server

Or clone the repository and build it yourself:

git clone https://github.com/username/matlab-mcp-server.git
cd matlab-mcp-server
npm install
npm run build

2. Configure cline to use the server

To use with cline , add the server con

Read from source at commit f0ebf8f95646OBSERVED · 2026-10-08
Advertisement
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add matlab-mcp-server -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "matlab-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}
03

Exposed tools (2)

1 read · 1 write · 0 destructive.

ToolRiskDescription
execute_matlab_codewriteExecute MATLAB code and return the results
generate_matlab_codereadGenerate MATLAB code from a natural language description
04

Trust audit

BLOCKgrade F · trust 47/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (5 observation(s))
Shell
declared (10 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
node_modules_files/depd/index.js:425
var deprecatedfn = new Function('fn', 'log', 'deprecate', 'message', 'site',
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
node_modules_files/depd/index.js:427
'return function (' + args + ') {' +
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
node_modules_files/function-bind/implementation.js:74
bound = Function('binder', 'return function (' + joiny(boundArgs, ',') + '){ return binder.apply(this,arguments); }')(binder);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
node_modules_files/node-matlab/lib/index.js:20
exec(`matlab -help`, (error, stdout, stderr) => {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
node_modules_files/node-matlab/lib/index.js:68
exec(
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHSupply chain · supply.typosquat · CWE-829, CWE-1357
node_modules_files/iconv-lite/package.json
request ~ requests
Why it matters. dependency name one edit from a popular package
Fix. verify the package; likely typosquat
MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532
node_modules_files/@types/node/url.d.ts:543
* console.log(myURL.password);
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
node_modules_files/iconv-lite/encodings/sbcs-data-generated.js:100
"chars": "€پ‚ƒ„...†‡ˆ‰ٹ‹Œچژڈگ‘’“”•–—کTMڑ›œں ،¢£¤¥¦§ ̈©ھ«¬® ̄°±23 ́μ¶· ̧1؛»1⁄41⁄23⁄4؟ہءآأؤإئابةتثجحخدذرزسشصض×طظعغـفقكàلâمنهوçèéêëىيîïًٌٍَôُِ÷ّùْûüے"
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
node_modules_files/iconv-lite/encodings/sbcs-data-generated.js:373
"chars": "«»...“”�•‘’� กขฃคฅฆงจฉชซฌญฎฏฐฑฒณดตถทธนบปผฝพฟภมยรฤลฦวศษสหฬอฮฯะัาําิีึืฺุู–—฿เแโใไๅๆ็่้๊๋์ํTM๏๐๑๒๓๔๕๖๗๘๙®©����"
LOWInventory / provenance · inv.hidden_file · CWE-1104
node_modules_files/.package-lock.json
.package-lock.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
node_modules_files/concat-map/.travis.yml
.travis.yml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
node_modules_files/function-bind/.nycrc
.nycrc
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
node_modules_files/hasown/.nycrc
.nycrc
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
node_modules_files/is-core-module/.nycrc
.nycrc
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
node_modules_files/uuid/lib/md5.js:22
return crypto.createHash('md5').update(bytes).digest();
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
node_modules_files/uuid/lib/sha1.js:22
return crypto.createHash('sha1').update(bytes).digest();
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
node_modules_files/resolve/test/resolver/multirepo/packages/package-a/index.js:9
var expected = path.join(__dirname, '../../node_modules/jquery/dist/jquery.js');
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
node_modules_files/resolve/test/resolver/multirepo/packages/package-a/index.js:19
assert.equal(resolve.sync('../../node_modules/jquery', { basedir: basedir, preserveSymlinks: false }), expected);
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
node_modules_files/resolve/test/resolver/multirepo/packages/package-a/index.js:33
assert.equal(resolve.sync('../../../../../node_modules/jquery', { basedir: basedir, preserveSymlinks: true }), expected);
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
node_modules_files/resolve/test/resolver/without_basedir/main.js:1
var resolve = require('../../../');
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
node_modules_files/resolve/test/symlinks.js:31
fs.symlinkSync('../../package', packageDir, 'dir');
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
node_modules_files/@types/node/buffer.d.ts:1897
function atob(data: string): string;
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
node_modules_files/typescript/lib/lib.webworker.d.ts:8713
atob(data: string): string;
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
node_modules_files/typescript/lib/lib.webworker.d.ts:9525
declare function atob(data: string): string;
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
node_modules_files/zod/lib/index.mjs:1006
const decoded = JSON.parse(atob(base64));

Gates applied: no_behavioural_pass.

Audited 2026-10-08 · audit v0.4.1 · source sha f0ebf8f95646full audit observations/trust-audit/mcp-server/williamcloudqi__matlab-1.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-08f0ebf8f95646BLOCKF47first audit
06

Questions

What is the MATLAB MCP server?

The MATLAB MCP server provides AI users with powerful scientific computing and data analysis capabilities. It allows users to execute MATLAB code directly in conversations, generate MATLAB scripts from natural language descriptions, and access MATLAB documentation.

What tools does MATLAB expose?

2 in total: 1 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is MATLAB safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (47/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does MATLAB need?

No credential environment variables were found in its source, so it appears to need none.

How does MATLAB run?

It speaks sse and stdio, so it runs as a local process your client starts. It is published on npm as matlab-mcp-server at 0.1.0.

How current is this page?

The grade is for one exact copy of the source (f0ebf8f95646), read on 2026-10-08. The repository is watched and re-audited when it changes.

Advertisement