MCP.Market

Is Sugar MCP server safe?

Yes, with the usual care.

B82/100grade B

Safe to use. Minor gaps such as a missing repository or slower maintenance.

No critical or high findings in the latest scan.

How Sugar compares

Against every graded Productivity MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
82/100
higher than 58% of 1,299 Productivity servers
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break

What its tools let an agent do: 5 read · 1 create

Public scan report

scanner v0.1.10 · 2026-10-01 · same rubric, same numbers if you re-run it

1 medium
  • Code scan76 source files scanned20/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 15 days ago15/15
  • Maintainer identitynamespace and repository owner differ; GitHub account older than a year6/10

Findings (1)

  • mediumsubprocess with shell=Trueexec.shell-true
    sugarai-3.4.2/sugar/executor/hooks.py: … cmd, shell=True, cwd=str(self.proje…
Overall 82/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

Other servers that do what Sugar does

  • Svelte MCP
    The official Svelte MCP server providing docs and autofixing tools for Svelte development
    A
  • Tidewave Phoenix
    Runtime-level MCP server for Phoenix development: run code, read logs, query the DB, read docs.
    More from tidewave-ai →
    B
  • Hunch
    Focus-free macOS control for AI agents: drive your real Mac apps in the background, no stolen focus.
    A

Sugar reviews, tools and install