grim-mcp server

by AbduljabbarBXR·io.github.AbduljabbarBXR/grim-mcp·v0.6.2·1 stars

Security audit for AI agents: code, deps, exposure, secrets, drift, SBOM, and IoC.

C62/100grade C

What users say

No reviews yet

Safety scan

C62/100

Adoption

Growing

1 stars179 downloads/wk

Reviews

Nobody has reviewed grim-mcp yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

No tool declarations could be read from the package source. They show once the server is installed.

scanner v0.1.10 · 2026-10-15 · same rubric, same numbers if you re-run it

4 medium

Code scan33 source files scanned; 32 source files scanned5/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 12 days ago15/15
Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

mediumsubprocess with shell=Trueexec.shell-true

python/grim/core/fixplan.py: …fe_load(", line, count=1), False # shell=True with untrusted input -> disable shell e…

mediumeval / new Function usedexec.eval

python/grim/engines/codepatterns.py: …\beval\s*\("), "high", "eval() usage", "eval executes arbitra…

mediumsubprocess with shell=Trueexec.shell-true

grim-mcp-0.6.2/src/grim/core/fixplan.py: …fe_load(", line, count=1), False # shell=True with untrusted input -> disable shell e…

mediumeval / new Function usedexec.eval

grim-mcp-0.6.2/src/grim/engines/codepatterns.py: …\beval\s*\("), "high", "eval() usage", "eval executes arbitra…

Overall 62/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

Against every graded Security MCP server, from our own scans and uptime checks. Updated after each scan run.

Release history: 2 versions in the registry since 2026-09-18, latest 2026-09-19, typically one every 1 day.

Runs npx -y grim-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add grim-mcp -- npx -y grim-mcp

2026-09-19restoreD → Cscore 62: subprocess with shell=True; eval / new Function used; subprocess with shell=True
2026-09-19restoreF → Dscore 54: curl | sh in a script; curl | sh in a script; subprocess with shell=True

Is grim-mcp server safe?: With care: it is graded C, so read the findings first (62/100). Read the grim-mcp safety report
How do I install grim-mcp?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does grim-mcp need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is grim-mcp maintained?: The last commit was 32 days ago (2026-10-03). The latest release is v0.6.2.
What can I use instead of grim-mcp?: Servers from other publishers that do the same job: Skylos MCP server, Wireshark MCP server and Mastyf AI MCP server.
How does grim-mcp compare with other Security MCP servers?: safety score 62/100 (higher than 17% of 915 Security servers); github stars 1 (more than 60% of 587 Security servers); downloads a week 179 (more than 73% of 248 Security servers with a package). Full comparison.

Same job from other publishers: the closest match first, then the best rated.

Skylos
Dead code, security, secrets detection and code quality for Python, TypeScript, Go.
not reviewed
Established
C
Wireshark
Professional network analysis with tshark. Security audits, deep-dives, and threat detection.
not reviewed
Established
A
Mastyf AI
Runtime proxy for MCP security, cost governance & audit
not reviewed
Growing
B
Guardvibe
Deterministic security layer your AI can't be. 644 rules, 39 tools, CLI + doctor + host audit.
not reviewed
Growing
C
Dechonet
30 security tools for AI agents: phishing links, exposure maps, DNS, SSL, PQC, history, pivots.
not reviewed
Growing
A