Is Lachesis MCP server safe?
Yes, with the usual care.
Safe to use. Minor gaps such as a missing repository or slower maintenance.
No critical or high findings in the latest scan.
Public scan report
scanner v0.1.9 · 2026-09-20 · same rubric, same numbers if you re-run it
2 medium
- Code scan217 source files scanned15/25
- –Live reliabilityno gateway calls yet and no remote to proben/a
- –Tool poisoningtools not inspected (local package is not executed); not countedn/a
- Auth qualitylocal package, no credentials required12/15
- Maintenancelast push 13 days ago15/15
- Maintainer identityregistry namespace matches repository owner7/10
Findings (2)
- mediumeval / new Function used
exec.evallachesis_cpg-0.5.3/lachesis/_atropos_catalog/models/javascript/sinks.json: … "corroboration": 2, "notes": "new Function(body)" }, { "id": "javascr… - mediumsubprocess with shell=True
exec.shell-truelachesis_cpg-0.5.3/lachesis/_atropos_catalog/models/python/sinks.json: … "corroboration": 3, "notes": "shell=True makes arg0 a shell command; the shell c…
Overall 75/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON