ModelsAtlas
Explore
Atlas / MCP servers / zhongzitongxue / Xiaozhi Tools

Xiaozhi ToolsBLOCK

mcp/zhongzitongxue/xiaozhi-tools
MCP server by zhongzitongxue · mcp server · mcp tools · xiaozhi ai · Audited 2026-10-08
⚑ Report / re-scanSource ↗

一个图形化界面的小智MCP服务连接器,包含多种工具! 自动部署服务,方便小白给小智Ai添加MCP工具

Verdict
BLOCK
Grade
F
Trust score
45 /100
Exposed tools
74 74r · 0w · 0d
Transport
stdio
License
—
Stars
52
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

简介

这是一个由 15.9岁的粽子同学 瞎搞的项目工具

开发的项目可能不太规范,弄得也不是很好,抱歉!

希望通过这个项目工具,能够帮助大家快速方便的部署小智Ai的MCP协议的工具服务

如果你有任何想法或建议,可加入 QQ 群:1036585294 或者直接联系作者微信:AWHLXXH

本工具以Python作为主要的建立连接,图形界面由VB6设计比较简陋,bat文件辅助启动与部署

[!TIP] #### 您可以点击链接查看飞书 小智接入 MCP 教程与工具 文档 了解更多。

使用环境

  • 推荐Windows10及以上 操作系统
  • 需要Python版本不小于3.10

演示视频

👉 软件安装教程(必看)【抖音】

👉 小智Ai 操控主人电脑【抖音】

已实现功能:

控制电脑

  • 1.运行电脑端程序 预设软件 或 具体路径
  • 2.在电脑上打开URL网址 网页名 或 具体URL网址
  • 3.在电脑上运行CMD指令 预设指令 或 具体指令
  • 4.官方的计算器示例
  • 5.创建文件写入内容
  • 6.读取复制内容
  • 7.填入一段内容
  • 8.回车发送
  • 9.撤销操作
  • 10.锁定电脑
  • 11.电脑关机计划
  • 12.设置电脑音量
  • 13.调用系统截图工具
  • 14.显示桌面
  • 15.查看系统资源使用情况
  • 16.查看电脑配置信息 & 获取桌面完整路径
  • 17.设置Windows系统深浅色主题
  • 18.向微信指定联系人发送内容
  • 19.更换桌面壁纸

开放API 工具

  • 1.获取心灵毒鸡汤
  • 2.获取抖音热点
  • 3.获取随机一言
  • 4.获取舔狗日记
  • 5.获取星座运势
  • 6.运势抽签
  • 7.获取百度知乎微博实时热榜
  • 8.获取名人名言
  • 9.获取每日一句
  • 10.获取绕口令
  • 11.查询油价
  • 12.获取新年祝福语
  • 13.获取今日电影票房
  • 14.获取脑筋急转弯
  • 15.每日早报
  • 16.今天吃什么
  • 17.搜索百度百科
  • 18.获取历史上的今天
  • 19.获取万年历
  • 20.获取深证成指
  • 21.查询个股行情
  • 22.查询公司基本面
  • 23.查询高铁票
  • 24.获取回声洞
  • 25.推送巴法消息

ALAPI 工具

[!IMPORTANT] #### 您需要先 [注册此网站](https://www.alapi.cn/) 获取请求Token *详细启用教程请等待完善*
  • 1.获取心灵毒鸡汤
  • 2.获取早报
  • 3.获取舔狗日记
  • 4.获取一言
  • 5.获取土味情话
  • 6.获取笑话大全
  • 7.获取油价查询
  • 8.查询快递 V1
  • 9.查询快递 V2
  • 10.获取星座运势
  • 11.获取节假日查询

控制洛雪音乐软件 工具

  • 1.洛雪音乐_搜索并播放音
  • 2.洛雪音乐_暂停或继续播放音乐
  • 3.洛雪音乐_下一首音乐
  • 4.洛雪音乐_上一首音乐
Read from source at commit d1cdcff9bfe2OBSERVED · 2026-10-08
Advertisement
02

Exposed tools (74)

74 read · 0 write · 0 destructive.

ToolRiskDescription
PPT_上一页或上一步read
PPT_下一页或下一步read
PPT_从头放映read
PPT_从当页开始放映read
PPT_结束放映read
今天吃什么read
写入填入一段内容read
向微信指定联系人发送内容read
向微信指定联系人发送复制的内容read
向微信联系人发送指定文件read
回车发送read
在文档上查找内容read
在电脑上创建文件与入内容read
在电脑上创建文件与写入内容read
在电脑上打开URL网址read
在电脑上运行CMD命令read
填入写入一段内容read
接收巴法消息read
推送巴法消息read
搜索百度百科read
撤销操作read
显示电脑桌面read
更换桌面壁纸read
查看电脑配置信息read
查看系统资源使用情况read
查询三大平台热点read
查询个股行情read
查询公司基本面read
查询实时公交read
查询快递V1read
查询快递V2read
查询抖音热榜read
查询星座运势read
查询油价read
查询节假日read
查询高铁票read
每日早报read
洛雪音乐_上一首音乐read
洛雪音乐_下一首音乐read
洛雪音乐_搜索并播放音乐read
洛雪音乐_播放收藏列表read
洛雪音乐_暂停或继续播放音乐read
电脑关机计划read
自动搜索并打开软件程序read
获取一言read
获取万年历read
获取今日电影票房read
获取历史上的今天read
获取名人名言read
获取回声洞read
获取土味情话read
获取心灵毒鸡汤read
获取房间温湿度read
获取新年祝福语read
获取早报read
获取星座运势read
获取桌面完整路径read
获取每日一句read
获取深证成指read
获取笑话大全read
获取绕口令read
获取脑筋急转弯read
获取舔狗日记read
获取随机一言read
计算器read
让KimiAi做某事read
让豆包Ai做某事read
设置主人电脑系统深浅色主题read
设置主人电脑系统的音量read
读取复制内容read
调用系统截图工具read
运势抽签read
运行电脑端预设软件文件或程序read
锁定电脑read
03

Trust audit

BLOCKgrade F · trust 45/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (5 observation(s))
Network
declared (10 observation(s))
Shell
declared (8 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (16)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
MCP_Windows/Windows+AL_API.py:121
result = eval(python_expression)
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
MCP_Windows/Windows+OPEN_API.py:128
result = eval(python_expression)
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
MCP_Windows/Windows.py:107
result = eval(python_expression)
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
MCP_Windows/Windows+AL_API.py:1207
response = requests.get(url, headers=headers, params=querystring, verify=False)
Why it matters. certificate verification is disabled
Fix. leave verification on
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
MCP_Windows/Windows+AL_API.py:1236
response = requests.get(url, headers=headers, params=querystring, verify=False)
Why it matters. certificate verification is disabled
Fix. leave verification on
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
MCP_Windows/Windows+AL_API.py:1268
response = requests.get(url, headers=headers, params=querystring, verify=False)
Why it matters. certificate verification is disabled
Fix. leave verification on
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
MCP_Windows/Windows+AL_API.py:1295
response = requests.get(url, headers=headers, params=querystring, verify=False)
Why it matters. certificate verification is disabled
Fix. leave verification on
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
MCP_Windows/Windows+AL_API.py:1325
response = requests.get(url, headers=headers, params=querystring, verify=False)
Why it matters. certificate verification is disabled
Fix. leave verification on
MEDIUMInventory / provenance · inv.binary · CWE-1104
MCP_Windows/数据/多智能接入地址/AAA间隔时长.exe
AAA间隔时长.exe
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
MCP_Windows/数据/每次启动时自动检查更新!.exe
每次启动时自动检查更新!.exe
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
MCP_Windows/组件/开机自启动/小智Ai_MCP_自启动服务.exe
小智Ai_MCP_自启动服务.exe
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
MCP_Windows/组件/开机自启动/小智Ai_MCP_自启动服务.lnk
小智Ai_MCP_自启动服务.lnk
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
MCP_Windows/组件/快捷跳转/Windows控制台.lnk
Windows控制台.lnk
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.no_license · CWE-1104
Why it matters. no LICENSE file and no repo licence
Fix. add a licence
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
MCP_Windows/Requirements.txt
python-dotenv, websockets, mcp, pydantic, fastmcp, pyautogui, pyperclip, paho-mqtt
Why it matters. 12 requirement(s) not pinned with ==
Fix. pin exact versions
INFOInventory / provenance · inv.oversize · CWE-1104
MCP_Windows/小智Ai_MCP_操控PC.exe
MCP_Windows/小智Ai_MCP_操控PC.exe
Why it matters. 15261696 bytes not read

Gates applied: no_behavioural_pass, no_license.

Audited 2026-10-08 · audit v0.4.1 · source sha d1cdcff9bfe2full audit observations/trust-audit/mcp-server/zhongzitongxue__xiaozhi-tools.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-08d1cdcff9bfe2BLOCKF45first audit
05

Questions

What is the Xiaozhi Tools MCP server?

一个图形化界面的小智MCP服务连接器,包含多种工具! 自动部署服务,方便小白给小智Ai添加MCP工具

What tools does Xiaozhi Tools expose?

74 in total: 74 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Xiaozhi Tools safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (45/100) and found 8 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does Xiaozhi Tools need?

No credential environment variables were found in its source, so it appears to need none.

How does Xiaozhi Tools run?

It speaks stdio, so it runs as a local process your client starts.

How current is this page?

The grade is for one exact copy of the source (d1cdcff9bfe2), read on 2026-10-08. The repository is watched and re-audited when it changes.

Advertisement