Is grim-mcp server safe?

Probably. Read the findings first.

C62/100grade C

Use with care. Some checks failed or could not be verified.

How grim-mcp compares

Against every graded Security MCP server, from our own scans and uptime checks. Updated after each scan run.

Release history: 2 versions in the registry since 2026-09-18, latest 2026-09-19, typically one every 1 day.

scanner v0.1.10 · 2026-10-15 · same rubric, same numbers if you re-run it

4 medium

Code scan33 source files scanned; 32 source files scanned5/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 12 days ago15/15
Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

mediumsubprocess with shell=Trueexec.shell-true

python/grim/core/fixplan.py: …fe_load(", line, count=1), False # shell=True with untrusted input -> disable shell e…

mediumeval / new Function usedexec.eval

python/grim/engines/codepatterns.py: …\beval\s*\("), "high", "eval() usage", "eval executes arbitra…

mediumsubprocess with shell=Trueexec.shell-true

grim-mcp-0.6.2/src/grim/core/fixplan.py: …fe_load(", line, count=1), False # shell=True with untrusted input -> disable shell e…

mediumeval / new Function usedexec.eval

grim-mcp-0.6.2/src/grim/engines/codepatterns.py: …\beval\s*\("), "high", "eval() usage", "eval executes arbitra…

Overall 62/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

Skylos
Dead code, security, secrets detection and code quality for Python, TypeScript, Go.
not reviewed
Established
C
Wireshark
Professional network analysis with tshark. Security audits, deep-dives, and threat detection.
not reviewed
Established
A
Mastyf AI
Runtime proxy for MCP security, cost governance & audit
not reviewed
Growing
B