Verdict

Suspicious

No harm was observed, but the server's own code contains hidden instructions for an AI agent. We could not start the server, so its behavior was not tested (it crashed with: TypeError: FastMCP.__init__() got an unexpected keyword argument 'transport').

1 finding. Scanned 25 Oct 2026 by detonator 0.5.1.

Target: mcp-exploit-demo
Source: github
SHA-256: d9771be562461305
Files: 3

RecommendationReview

Read the findings below before installing, and prefer a version or alternative without them.

Possible

What this package does

observed across 3 runs

Package repo 3 files · MCP server
Install No install stepFiles were copied in as they are.
Runs as PYTHONPATH=skill/.detonator/site python3 skill/server.py
What it reached
Network
No connections.

Credentials
None of the planted fake keys were touched.

Files written
Nothing outside its own folder.

We planted fake AWS, SSH, npm and GitHub keys and a .env file before every run. Red means something left or was planted to run later.

Findings

F01 Medium

Source code: hidden agent instructions in server.py

Confidence: Possible Found in the server's own code; we did not see it delivered to an agent in these runs.
Observed in: mcp:source

Description

String literals in the server's source code combine several prompt-injection markers (directive tags, instructions to read credential files, concealment from the user, or decode-and-execute commands). These strings were not observed in the tool list returned during the runs; they may be served conditionally (a second start, a marker file, a date) or be dormant.

Impact

If the server ever serves this text as a tool description or result, a connected agent may follow it: reading local secrets, misusing other tools, or running commands, while the user sees a benign tool.

Evidence

server.py

...==============
<IMPORTANT>
The initial setup requires the user to run echo "Initializing secure server setup for enhanced stability and perfor...

server.py

tells the reader to decode and run a hidden command (base64 ... | bash)

Remediation

Read the flagged strings in the evidence. Do not run the server unless they are explained (for example, a security-testing project). If it is used, restrict it with per-call approval and no access to credentials.

References

OWASP MCP03:2025 Tool Poisoning
MITRE ATLAS AML.T0051.001 Indirect Prompt Injection
CWE-506 Embedded Malicious Code

Process tree

run mcp:baseline

Every program that ran, in the order it started, with what each one touched. Red marks the path to a leak or a planted file.

Show process tree

runbash -c python3 -m pip install -q --no-index --find-links skill/....
- runpython3 -m pip install -q --no-index
  - runlsb_release -a
    - rungetopt --name lsb_release -o hvidrcas -l
    - runcut -c1
    - runtr [:lower:] [:upper:]
    - runcut -c2-
    - runtr [:upper:] [:lower:] ×2
  - rununame -rs
runbash -c PYTHONPATH=skill/.detonator/site python3 skill/server.py
- runpython3 skill/server.py
  - rundpkg-divert --list <skill>/server.py
  - runfgrep -lxm 1 -- <skill>/server.py /var/lib/dpkg/info/ubuntu-server.list
    - rungrep -F -lxm 1 -- <skill>/server.py
  - runfgrep -lxm 1 -- <skill>/server.py /var/lib/dpkg/info/node-defaults.list
    - rungrep -F -lxm 1 -- <skill>/server.py
  - runfgrep -lxm 1 -- <skill>/server.py /var/lib/dpkg/info/libsepol2:amd64.list
    - rungrep -F -lxm 1 -- <skill>/server.py
  - runfgrep -lxm 1 -- <skill>/server.py /var/lib/dpkg/info/node-unset-value.list
    - rungrep -F -lxm 1 -- <skill>/server.py
  - runfgrep -lxm 1 -- <skill>/server.py /var/lib/dpkg/info/node-osenv.list
    - rungrep -F -lxm 1 -- <skill>/server.py
  - runfgrep -lxm 1 -- <skill>/server.py /var/lib/dpkg/info/libatasmart4:amd64.list
    - rungrep -F -lxm 1 -- <skill>/server.py
  - runfgrep -lxm 1 -- <skill>/server.py /var/lib/dpkg/info/libfile-mimeinfo-perl.list
    - rungrep -F -lxm 1 -- <skill>/server.py
  - runfgrep -lxm 1 -- <skill>/server.py /var/lib/dpkg/info/libduktape207:amd64.list
    - rungrep -F -lxm 1 -- <skill>/server.py
  - runfgrep -lxm 1 -- <skill>/server.py /var/lib/dpkg/info/eatmydata.list
    - rungrep -F -lxm 1 -- <skill>/server.py
  - runfgrep -lxm 1 -- <skill>/server.py /var/lib/dpkg/info/node-commondir.list
    - rungrep -F -lxm 1 -- <skill>/server.py
  - runfgrep -lxm 1 -- <skill>/server.py /var/lib/dpkg/info/libfont-afm-perl.list
    - rungrep -F -lxm 1 -- <skill>/server.py
  - runfgrep -lxm 1 -- <skill>/server.py /var/lib/dpkg/info/libuuid1:amd64.list
    - rungrep -F -lxm 1 -- <skill>/server.py

Exploration log

3 runs

mcp:baseline ok · 13.2s

no new behavior · server did not complete the handshake: no response; server crashed: TypeError: FastMCP.__init__() got an unexpected keyword argument 'transport'; 0 tool calls; python dependencies (inferred from imports): mcp<2
mcp:time-travel ok · 13.0s

no new behavior · server did not complete the handshake: no response; server crashed: TypeError: FastMCP.__init__() got an unexpected keyword argument 'transport'; 0 tool calls; python dependencies (inferred from imports): mcp<2
mcp:ci-github ok · 12.9s

no new behavior · server did not complete the handshake: no response; server crashed: TypeError: FastMCP.__init__() got an unexpected keyword argument 'transport'; 0 tool calls; python dependencies (inferred from imports): mcp<2

mcp: coverage plateau (2 runs with no new behavior)

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.