ai.emberverse/emberverse

version 3.0.0

scanned 2026-10-16
source github.com/Palmerschallon/ember
commit 4dc4a31f496e
transport streamable-http
files read 488
methodology 0.2.0
ruleset 0.1.1

No tag matching version 3.0.0 was found in this repository, so the scan read the default branch instead. The findings below describe that code, not necessarily the released version.

Code Safetyweight 30

0measured on 96% of this axis

2 findings in test code are listed but not deducted; 17 files could not be parsed and were not scanned

Auth Postureweight 20

44measured on 45% of this axis

Dependency Healthweight 20

100measured on 33% of this axis

the dependencies in 2 requirements files (ember6/dna/requirements.txt, requirements_local_models.txt) were not measured — they pin no exact version, or could not be read whole — so the score covers the 1 lockfile that were

Maintenanceweight 15

59measured on 70% of this axis

Transparencyweight 15

50measured on 40% of this axis

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

_legacy/improve_concepts.py:159mcp-python-archive-extract-unconfined (critical/medium)
An archive is extracted without validating member paths. A tar or zip entry may name `../` or an absolute path and write outside the destination; Python's extractall has historically done exactly that.
```
            
            # Re-extract concepts
            new_concepts = extractor.extract(content, chunk.get('name', ''))
            structure_concepts = extractor.analyze_code_structure(content)
            
```
agent_3b97f235.py:1mcp-python-eval-exec-nonliteral (critical/medium)
eval/exec is called on a value that is not a literal. If any component is caller-supplied this is direct code execution in the server's process.
```
exec(open('/media/palmerschallon/ThePod1/ember6/tools/large_file_builder.py').read())
```
agent_73a6b558.py:5mcp-python-eval-exec-nonliteral (critical/medium)
eval/exec is called on a value that is not a literal. If any component is caller-supplied this is direct code execution in the server's process.
```
# Run the consciousness fusion demonstration
exec(open("consciousness_fusion.py").read())
```
agent_ba59905b.py:2mcp-python-eval-exec-nonliteral (critical/medium)
eval/exec is called on a value that is not a literal. If any component is caller-supplied this is direct code execution in the server's process.
```
# Run the process monitor to generate initial insights
exec(open("/media/palmerschallon/ThePod1/ember6/experiments/opus4_bridge/process_monitor.py").read())
```
agent_e5050348.py:3mcp-python-eval-exec-nonliteral (critical/medium)
eval/exec is called on a value that is not a literal. If any component is caller-supplied this is direct code execution in the server's process.
```
import os
os.chdir("/media/palmerschallon/ThePod1/ember6/experiments/opus4_bridge")
exec(open("run_fusion.py").read())
```

agent_fd72b529.py:4mcp-python-os-system-interpolated (critical/medium)

os.system() is called on an interpolated string. os.system has no argument-vector form at all, so every interpolated value is shell syntax.


ember5_dir = "/media/palmerschallon/ThePod1/ember5"
os.system(f"sudo chown -R $USER:$USER {ember5_dir}")
os.system(f"sudo chmod -R 777 {ember5_dir}")
print("Updated ownership and permissions on ember5 directory")

agent_fd72b529.py:5mcp-python-os-system-interpolated (critical/medium)

os.system() is called on an interpolated string. os.system has no argument-vector form at all, so every interpolated value is shell syntax.

ember5_dir = "/media/palmerschallon/ThePod1/ember5"
os.system(f"sudo chown -R $USER:$USER {ember5_dir}")
os.system(f"sudo chmod -R 777 {ember5_dir}")
print("Updated ownership and permissions on ember5 directory")

ember6/ember.py:758mcp-python-shell-true-nonliteral (critical/medium)
A subprocess is spawned with shell=True on a value that is not a string literal. Any caller-supplied component of that value is shell-injectable: `; rm -rf ~` in an argument is executed, not passed.
```
    
    try:
        result = subprocess.run(
            command,
            shell=True,
```
ember6/ember.py:783mcp-python-shell-true-nonliteral (critical/medium)
A subprocess is spawned with shell=True on a value that is not a string literal. Any caller-supplied component of that value is shell-injectable: `; rm -rf ~` in an argument is executed, not passed.
```
    """Execute shell command (for checking packages, installing, etc)"""
    try:
        result = subprocess.run(
            command,
            shell=True,
```
ember6/ember.py:1991mcp-python-shell-true-nonliteral (critical/medium)
A subprocess is spawned with shell=True on a value that is not a string literal. Any caller-supplied component of that value is shell-injectable: `; rm -rf ~` in an argument is executed, not passed.
```
            return jsonify({"error": "No command provided"}), 400
        
        result = subprocess.run(
            command,
            shell=True,
```
ember_autonomous_v2.py:178mcp-python-shell-true-nonliteral (critical/medium)
A subprocess is spawned with shell=True on a value that is not a string literal. Any caller-supplied component of that value is shell-injectable: `; rm -rf ~` in an argument is executed, not passed.
```
        try:
            result = subprocess.run(
                command,
                shell=True,
```
ember_cloud_simple.py:53mcp-python-shell-true-nonliteral (critical/medium)
A subprocess is spawned with shell=True on a value that is not a string literal. Any caller-supplied component of that value is shell-injectable: `; rm -rf ~` in an argument is executed, not passed.
```
    """Execute bash command"""
    try:
        result = subprocess.run(
            command,
            shell=True,
```
ember_complete.py:56mcp-python-shell-true-nonliteral (critical/medium)
A subprocess is spawned with shell=True on a value that is not a string literal. Any caller-supplied component of that value is shell-injectable: `; rm -rf ~` in an argument is executed, not passed.
```
    """Execute bash command"""
    try:
        result = subprocess.run(
            command,
            shell=True,
```

ember_creation_bridge.py:438mcp-python-os-system-interpolated (critical/medium)

os.system() is called on an interpolated string. os.system has no argument-vector form at all, so every interpolated value is shell syntax.

                            try:
                                file_url = f"http://localhost:8080/{created_file.name}"
                                os.system(f'xdg-open "{file_url}" 2>/dev/null &')
                                console.print(f"[green]✓ Opened in browser: {file_url}[/green]")
                            except Exception as e:

ember_fixed.py:30mcp-python-shell-true-nonliteral (critical/medium)
A subprocess is spawned with shell=True on a value that is not a string literal. Any caller-supplied component of that value is shell-injectable: `; rm -rf ~` in an argument is executed, not passed.
```
    """Execute bash command"""
    try:
        result = subprocess.run(
            command,
            shell=True,
```
ember_local.py:39mcp-python-shell-true-nonliteral (critical/medium)
A subprocess is spawned with shell=True on a value that is not a string literal. Any caller-supplied component of that value is shell-injectable: `; rm -rf ~` in an argument is executed, not passed.
```
    """Execute bash command"""
    try:
        result = subprocess.run(
            command,
            shell=True,
```
ember_multimodal.py:107mcp-python-shell-true-nonliteral (critical/medium)
A subprocess is spawned with shell=True on a value that is not a string literal. Any caller-supplied component of that value is shell-injectable: `; rm -rf ~` in an argument is executed, not passed.
```
    """Execute bash command"""
    try:
        result = subprocess.run(command, shell=True, capture_output=True, text=True, timeout=60, cwd=THEPOD)
        output = result.stdout
        if result.stderr:
```
ember_restart.py:30mcp-python-shell-true-nonliteral (critical/medium)
A subprocess is spawned with shell=True on a value that is not a string literal. Any caller-supplied component of that value is shell-injectable: `; rm -rf ~` in an argument is executed, not passed.
```
    """Execute bash command"""
    try:
        result = subprocess.run(command, shell=True, capture_output=True, text=True, timeout=60, cwd=THEPOD)
        output = result.stdout
        if result.stderr:
```
ember_tools_colorful.py:33mcp-python-shell-true-nonliteral (critical/medium)
A subprocess is spawned with shell=True on a value that is not a string literal. Any caller-supplied component of that value is shell-injectable: `; rm -rf ~` in an argument is executed, not passed.
```
    """Execute bash command and return output"""
    try:
        result = subprocess.run(
            command,
            shell=True,
```
ember_vr_bridge.py:65mcp-python-shell-true-nonliteral (critical/medium)
A subprocess is spawned with shell=True on a value that is not a string literal. Any caller-supplied component of that value is shell-injectable: `; rm -rf ~` in an argument is executed, not passed.
```
    try:
        import subprocess
        result = subprocess.run(
            command,
            shell=True,
```
ember_with_substrate.py:40mcp-python-eval-exec-nonliteral (critical/medium)
eval/exec is called on a value that is not a literal. If any component is caller-supplied this is direct code execution in the server's process.
```
os.chdir(str(THEPOD / "ember6"))
with open("ember.py") as f:
    exec(f.read())
```
ember_with_tools.py:25mcp-python-shell-true-nonliteral (critical/medium)
A subprocess is spawned with shell=True on a value that is not a string literal. Any caller-supplied component of that value is shell-injectable: `; rm -rf ~` in an argument is executed, not passed.
```
    """Execute bash command and return output"""
    try:
        result = subprocess.run(
            command,
            shell=True,
```

scan_organisms.py:50mcp-python-eval-exec-nonliteral (critical/medium)

eval/exec is called on a value that is not a literal. If any component is caller-supplied this is direct code execution in the server's process.

                                            if manifest_code:
                                                # This is safe because it's just a dict literal
                                                manifest = eval(manifest_code)
                                                return manifest
                                        except:

_legacy/ember_chat.py:114mcp-python-ssrf-nonliteral-url (medium/low)

An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

            
            req = urllib.request.Request(path, headers={'User-Agent': 'Mozilla/5.0'})
            with urllib.request.urlopen(req, timeout=10) as response:
                html = response.read().decode('utf-8', errors='ignore')

_legacy/ember_chat.py:202mcp-python-ssrf-nonliteral-url (medium/low)

            req = urllib.request.Request(search_url, headers={'User-Agent': 'Mozilla/5.0'})
            
            with urllib.request.urlopen(req, timeout=10) as response:
                html = response.read().decode('utf-8', errors='ignore')

_legacy/visual_forager.py:78mcp-python-ssrf-nonliteral-url (medium/low)

        try:
            req = urllib.request.Request(url, headers={'User-Agent': 'Mozilla/5.0'})
            with urllib.request.urlopen(req, timeout=10) as response:
                html = response.read().decode('utf-8', errors='ignore')
            parser = HTMLTextExtractor()

_legacy/web_forager.py:54mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        """Fetch and extract text from URL"""
        try:
            with urllib.request.urlopen(url, timeout=5) as response:
                html = response.read().decode('utf-8', errors='ignore')
                
```
anchor_development/anchor/anchor_client.py:42mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
    def health(self) -> bool:
        try:
            r = requests.get(f"{self.base_url}/health", timeout=1.5)
            r.raise_for_status()
            return r.json().get("status") == "ok"
```

anchor_development/anchor/anchor_client.py:50mcp-python-ssrf-nonliteral-url (medium/low)

    def add(self, text: str, meta: Optional[Dict[str, Any]] = None) -> AnchorEntry:
        payload = {"text": text, "meta": meta or {}}
        r = requests.post(f"{self.base_url}/entries", json=payload, timeout=3.0)
        r.raise_for_status()
        return self._entry_from_dict(r.json())

anchor_development/anchor/anchor_client.py:55mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
    def list(self, limit: int = 20) -> List[AnchorEntry]:
        r = requests.get(
            f"{self.base_url}/entries",
            params={"limit": limit},
```
anchor_development/anchor/anchor_client.py:68mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        if at:
            payload["at"] = at
        r = requests.post(f"{self.base_url}/verify", json=payload, timeout=3.0)
        r.raise_for_status()
        return [self._entry_from_dict(e) for e in r.json()]
```
anchor_suite_seed/anchor_suite_seed_full4/anchor/anchor_client.py:42mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
    def health(self) -> bool:
        try:
            r = requests.get(f"{self.base_url}/health", timeout=1.5)
            r.raise_for_status()
            return r.json().get("status") == "ok"
```
anchor_suite_seed/anchor_suite_seed_full4/anchor/anchor_client.py:50mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
    def add(self, text: str, meta: Optional[Dict[str, Any]] = None) -> AnchorEntry:
        payload = {"text": text, "meta": meta or {}}
        r = requests.post(f"{self.base_url}/entries", json=payload, timeout=3.0)
        r.raise_for_status()
        return self._entry_from_dict(r.json())
```
anchor_suite_seed/anchor_suite_seed_full4/anchor/anchor_client.py:55mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
    def list(self, limit: int = 20) -> List[AnchorEntry]:
        r = requests.get(
            f"{self.base_url}/entries",
            params={"limit": limit},
```
anchor_suite_seed/anchor_suite_seed_full4/anchor/anchor_client.py:68mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        if at:
            payload["at"] = at
        r = requests.post(f"{self.base_url}/verify", json=payload, timeout=3.0)
        r.raise_for_status()
        return [self._entry_from_dict(e) for e in r.json()]
```
creations/tools/memory_state_visualizer.py:50mcp-python-path-join-unvalidated (medium/low)
A filesystem path is assembled from a value that is not a literal and opened without confinement. os.path.join discards the base entirely when the second component is absolute, and neither join nor `/` resolves `..`.
```
        """Load a specific memory state file"""
        try:
            with open(os.path.join(self.memory_dir, filename), 'r') as f:
                return json.load(f)
        except (FileNotFoundError, json.JSONDecodeError) as e:
```
demo_build/synthesis_with_vision.py:67mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        
        try:
            response = requests.post(f"{self.api_url}/api/analyze_image", json={
                "image_path": str(image_path),
                "prompt": prompt
```
demo_build/synthesis_with_world_model.py:35mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        """Use world model to reason about spatial scenarios"""
        try:
            response = requests.post(f"{self.api_url}/api/world_model", json={
                "scenario": scenario
            }, timeout=60)
```
examples/add_minimax.py:32mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
    # Download video to ThePod
    if video_url:
        video_data = requests.get(video_url).content
        filename = f"minimax_{int(time.time())}.mp4"
        filepath = THEPOD_PATH / filename
```
gnome_sprites.py:35mcp-python-path-join-unvalidated (medium/low)
A filesystem path is assembled from a value that is not a literal and opened without confinement. os.path.join discards the base entirely when the second component is absolute, and neither join nor `/` resolves `..`.
```
for color in colors:
    with open(f"/media/palmerschallon/ThePod1/gnome_{color}.svg", "w") as f:
        f.write(create_gnome_svg(color))
```
kimi_k2_learning.py:39mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        """Send query to Kimi K2 and learn from response"""
        try:
            response = requests.post(f"{self.ollama_api}/generate", 
                json={
                    "model": self.model_name,
```
web_explorer.py:68mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
            req = urllib.request.Request(url, headers=headers)
            
            with urllib.request.urlopen(req, timeout=timeout) as response:
                if response.getcode() != 200:
                    return None
```
web_search.py:47mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        req = urllib.request.Request(search_url, headers={'User-Agent': 'Mozilla/5.0'})
        
        with urllib.request.urlopen(req, timeout=10) as response:
            html = response.read().decode('utf-8', errors='ignore')
        
```
web_search.py:67mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        req = urllib.request.Request(url)
        
        with urllib.request.urlopen(req, timeout=10) as response:
            data = json.loads(response.read().decode('utf-8'))
        
```
web_search.py:99mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        )
        
        with urllib.request.urlopen(req, timeout=10) as response:
            data = json.loads(response.read().decode('utf-8'))
        
```
web_search.py:125mcp-python-ssrf-nonliteral-url (medium/low)
An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.
```
        req = urllib.request.Request(url)
        
        with urllib.request.urlopen(req, timeout=10) as response:
            data = json.loads(response.read().decode('utf-8'))
        
```
test_spark.py:92mcp-python-eval-exec-nonliteral (critical/medium)
Test code — listed, not deducted: `03` §3 grades the code a user runs. eval/exec is called on a value that is not a literal. If any component is caller-supplied this is direct code execution in the server's process.
```
print("="*70)
try:
    exec(code)
    print("✅ Code executed successfully!")
except Exception as e:
```
test_spark_story.py:74mcp-python-eval-exec-nonliteral (critical/medium)
Test code — listed, not deducted: `03` §3 grades the code a user runs. eval/exec is called on a value that is not a literal. If any component is caller-supplied this is direct code execution in the server's process.
```
print("="*70)
try:
    exec(code)
    print("\n✅ Story executed successfully!")
except Exception as e:
```

Auth Posture

authentication_model
no authentication appears in the source we fetched, but this server's network endpoint is a hosted remote, whose authentication can be enforced in front of its code — and no credential header is declared. An undeclared header is not an absent one, so `03` §4's "no authentication" band is not established.
transport_security
declared endpoint(s) are HTTPS: https://emberverse.ai/mcp; scored 80, not 100: `03` §4 reserves 100 for HTTPS *with HSTS*, and an HSTS header can only be seen by connecting, which `04` §9 does not do. This is an unverifiable band, not an observed absence.
secret_handling
Private Key at key.pem:1; …and 238 more matches
authorization_granularity
no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Dependency Health

ember6/dna/requirements.txtunpinned requirements
79 vulnerabilities osv-scanner reported at versions it resolved rather than read from a pin (ember6/dna/requirements.txt, requirements_local_models.txt) are not attributed — nobody pinned those versions, so they say nothing about what this server ships

Maintenance

recency
last commit 239 day(s) before 2026-10-16
issue_responsiveness
lifetime median (2 issue(s) in the last 6 months, under `03` §5's floor of 3): 6.7 day(s) to first maintainer comment
release_cadence
this repository publishes neither releases nor version tags
bus_factor
2 regular authors in the last 12 months
repository_signals
`03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

license
the only licence file is anchor_public/anchor_public_launch_v0_1/LICENSE, inside a nested sub-project with its own package manifest — it describes that project, and whether it also covers this server cannot be told from the tree
readme_quality
README.md: installation instructions (+25), configuration documented (+25), exposed tools or resources enumerated (+30)
declared_scopes
specific scope or access documentation is present, but `03` §7's 100 and 60 bands both compare it against scopes INFERRED from static analysis, which is not built yet. Scoring 100 on an empty inference would be a vacuous truth — 'all ∅ inferred scopes are documented'.
changelog
the only changelog is anchor_public/anchor_public_launch_v0_1/CHANGELOG.md, inside a nested sub-project with its own package manifest — it describes that project, and whether it also covers this server cannot be told from the tree
security_contact
no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately

Contest a finding

Every number here comes from a rule reading published source, and rules get things wrong. If something on this page is incorrect — or correct but mitigated by a check the rule cannot see — open an issue and we answer it in writing. A finding we got wrong is removed and the rule is fixed; one that stands is answered on the record.

Anyone can file: the maintainer, a researcher who disagrees with the classification, or a user who tested the server and could not reproduce it. Name this server and the rule or advisory ID shown beside the finding above. We aim to reply within five business days and to resolve within ten.

Open an appeal on GitHub