io.github.flujo-app/mcp-sandbox-computer-vm-for-ai

The evidence

Every deduction below names the artefact that produced it. Nothing on this page was executed: the source was read, never run, and no running server was contacted.

Code Safety

• src/kilntainers/fly_runtime.py:81mcp-python-ssrf-nonliteral-url (medium/low)

  An outbound HTTP request is made to a URL that is not a literal. If any part of it is caller-supplied, the server can be steered at internal hosts — cloud metadata endpoints, admin ports, other tenants.

  def _open_url(url: str):
      request = urllib.request.Request(url, headers={"User-Agent": _USER_AGENT})
      return urllib.request.urlopen(request, timeout=60)
  
  

• src/kilntainers/backends/test_wasm_go_busybox.py:105mcp-python-path-join-unvalidated (medium/low)

  Test code — listed, not deducted: `03` §3 grades the code a user runs. A filesystem path is assembled from a value that is not a literal and opened without confinement. os.path.join discards the base entirely when the second component is absolute, and neither join nor `/` resolves `..`.

          """Test that ls command works."""
          # Create some test files from Python
          with open(os.path.join(sandbox._sandbox_dir, "file1.txt"), "w") as f:
              f.write("content1")
          with open(os.path.join(sandbox._sandbox_dir, "file2.txt"), "w") as f:

• src/kilntainers/backends/test_wasm_go_busybox.py:107mcp-python-path-join-unvalidated (medium/low)

  Test code — listed, not deducted: `03` §3 grades the code a user runs. A filesystem path is assembled from a value that is not a literal and opened without confinement. os.path.join discards the base entirely when the second component is absolute, and neither join nor `/` resolves `..`.

          with open(os.path.join(sandbox._sandbox_dir, "file1.txt"), "w") as f:
              f.write("content1")
          with open(os.path.join(sandbox._sandbox_dir, "file2.txt"), "w") as f:
              f.write("content2")
  

• src/kilntainers/backends/test_wasm_go_busybox.py:126mcp-python-path-join-unvalidated (medium/low)

  Test code — listed, not deducted: `03` §3 grades the code a user runs. A filesystem path is assembled from a value that is not a literal and opened without confinement. os.path.join discards the base entirely when the second component is absolute, and neither join nor `/` resolves `..`.

          """Test that cat can read multiple files."""
          # Create test files from Python
          with open(os.path.join(sandbox._sandbox_dir, "a.txt"), "w") as f:
              f.write("AAA")
          with open(os.path.join(sandbox._sandbox_dir, "b.txt"), "w") as f:

• src/kilntainers/backends/test_wasm_go_busybox.py:128mcp-python-path-join-unvalidated (medium/low)

  Test code — listed, not deducted: `03` §3 grades the code a user runs. A filesystem path is assembled from a value that is not a literal and opened without confinement. os.path.join discards the base entirely when the second component is absolute, and neither join nor `/` resolves `..`.

          with open(os.path.join(sandbox._sandbox_dir, "a.txt"), "w") as f:
              f.write("AAA")
          with open(os.path.join(sandbox._sandbox_dir, "b.txt"), "w") as f:
              f.write("BBB")
  

• src/kilntainers/backends/test_wasm_go_busybox.py:147mcp-python-path-join-unvalidated (medium/low)

  Test code — listed, not deducted: `03` §3 grades the code a user runs. A filesystem path is assembled from a value that is not a literal and opened without confinement. os.path.join discards the base entirely when the second component is absolute, and neither join nor `/` resolves `..`.

          """Test that grep command works."""
          # Create test files from Python
          with open(os.path.join(sandbox._sandbox_dir, "test.txt"), "w") as f:
              f.write("hello world\ngoodbye world")
  

• src/kilntainers/backends/test_wasm_go_busybox.py:167mcp-python-path-join-unvalidated (medium/low)

  Test code — listed, not deducted: `03` §3 grades the code a user runs. A filesystem path is assembled from a value that is not a literal and opened without confinement. os.path.join discards the base entirely when the second component is absolute, and neither join nor `/` resolves `..`.

          # Create directory structure from Python
          os.makedirs(os.path.join(sandbox._sandbox_dir, "subdir"), exist_ok=True)
          with open(os.path.join(sandbox._sandbox_dir, "subdir", "file.txt"), "w") as f:
              f.write("wasm is cool")
          with open(os.path.join(sandbox._sandbox_dir, "root.txt"), "w") as f:

• src/kilntainers/backends/test_wasm_go_busybox.py:169mcp-python-path-join-unvalidated (medium/low)

  Test code — listed, not deducted: `03` §3 grades the code a user runs. A filesystem path is assembled from a value that is not a literal and opened without confinement. os.path.join discards the base entirely when the second component is absolute, and neither join nor `/` resolves `..`.

          with open(os.path.join(sandbox._sandbox_dir, "subdir", "file.txt"), "w") as f:
              f.write("wasm is cool")
          with open(os.path.join(sandbox._sandbox_dir, "root.txt"), "w") as f:
              f.write("wasm rules")
  

• src/kilntainers/backends/test_wasm_go_busybox.py:217mcp-python-path-join-unvalidated (medium/low)

  Test code — listed, not deducted: `03` §3 grades the code a user runs. A filesystem path is assembled from a value that is not a literal and opened without confinement. os.path.join discards the base entirely when the second component is absolute, and neither join nor `/` resolves `..`.

          """Test head and tail commands."""
          # Create a file with multiple lines
          with open(os.path.join(sandbox._sandbox_dir, "lines.txt"), "w") as f:
              for i in range(1, 11):
                  f.write(f"line {i}\n")

• src/kilntainers/backends/test_wasm_go_busybox.py:247mcp-python-path-join-unvalidated (medium/low)

  Test code — listed, not deducted: `03` §3 grades the code a user runs. A filesystem path is assembled from a value that is not a literal and opened without confinement. os.path.join discards the base entirely when the second component is absolute, and neither join nor `/` resolves `..`.

      async def test_wc_command(self, sandbox):
          """Test wc (word count) command."""
          with open(os.path.join(sandbox._sandbox_dir, "wc_test.txt"), "w") as f:
              f.write("one two three\nfour five six\n")
  

• src/kilntainers/backends/test_wasm_go_busybox.py:308mcp-python-path-join-unvalidated (medium/low)

  Test code — listed, not deducted: `03` §3 grades the code a user runs. A filesystem path is assembled from a value that is not a literal and opened without confinement. os.path.join discards the base entirely when the second component is absolute, and neither join nor `/` resolves `..`.

          """Test that the filesystem persists across exec calls."""
          # Create a file via Python
          with open(os.path.join(sandbox._sandbox_dir, "persist.txt"), "w") as f:
              f.write("persistent data")
  

Auth Posture

• authentication_model

  stdio transport: the client launches the server as a subprocess, so the OS process boundary is the auth boundary — `03` §4 does not penalise absent auth here

• transport_security

  declared transport: stdio — launched as a subprocess by the client, so the security boundary is the client process, not a network port (`03` §4)

• secret_handling

  detect-secrets matched 4 credential-shaped string(s), every one from a keyword or entropy heuristic (Hex High Entropy String, Secret Keyword). Those flag placeholders, variable names and content hashes as readily as credentials, so they do not establish the committed credential `03` §4's 0 asserts, and this sub-check is not scored; Secret Keyword at src/kilntainers/backends/test_e2b.py:132; Hex High Entropy String at src/kilntainers/backends/test_fly.py:28; Secret Keyword at src/kilntainers/backends/test_modal.py:304; Secret Keyword at src/kilntainers/backends/test_modal_integration.py:122

• authorization_granularity

  no tool registration was recognised anywhere in the source. An MCP server registers tools by definition, so this is a gap in our detection rather than a server with none, and `03` §4's threshold cannot be applied to it.

Maintenance

• recency

  last commit 40 day(s) before 2026-10-16

• issue_responsiveness

  this repository has no issues `03` §5's window covers. An unanswered issue scores 0 under §5, but a repository with no issues filed has not failed to answer one.

• release_cadence

  median release gap 13 days (by releases), last release 40 day(s) ago

• bus_factor

  3 authors with >= 5 commits in 12 months

• repository_signals

  `03` §5 scores this by quartile WITHIN the server's category, which needs a distribution across every scanned server and so cannot be computed while scanning one. It is a post-pass over the crawl and that pass does not exist yet.

Transparency

• license

  LICENSE present with no SPDX-License-Identifier tag; identified as 'MIT' from its text

• readme_quality

  README.md: installation instructions (+25), configuration documented (+25), states what the server does in the first 200 words (+20)

• declared_scopes

  specific scope or access documentation is present, but `03` §7's 100 and 60 bands both compare it against scopes INFERRED from static analysis, which is not built yet. Scoring 100 on an empty inference would be a vacuous truth — 'all ∅ inferred scopes are documented'.

• changelog

  no CHANGELOG in the fetched source. `03` §7's partial credit for tagged releases carrying release notes is not applied here — that needs the forge API, which this check does not call

• security_contact

  no SECURITY.md and no disclosure contact in the README, so a finder has no route to report a vulnerability privately