AI Analysis
The package shows low risk in terms of network, shell, obfuscation, and credential handling. However, the metadata risk score is elevated due to missing maintainer information and a suspicious link.
- Suspicious non-HTTPS link
- Missing maintainer information
Per-check LLM notes
- Network: The network calls appear to be standard HTTPS requests with session management, which is common and generally safe.
- Shell: Executing shell commands like 'git ls-files' can be legitimate for version control operations within a package, but could also indicate more nefarious activities without additional context.
- Obfuscation: No obfuscation patterns detected, indicating low risk.
- Credentials: No credential harvesting patterns detected, indicating low risk.
- Metadata: Suspicious non-HTTPS link and missing maintainer information suggest potential risks.
Package Quality Overall: Medium (5.2/10)
Test suite present — 7 test file(s) found
Test runner config found: conftest.py7 test file(s) detected (e.g. conftest.py)
Some documentation present
Detailed PyPI description (14702 chars)
No contributing guide or governance files found
Development Status classifier >= Beta
Partial type annotation coverage
Type checker (mypy / pyright / pytype) referenced in project846 type-annotated function signatures detected in source
Unable to verify contributor count: no GitHub repository found
No GitHub repository linked — contributor count unavailable
Heuristic Checks
Found 2 network call pattern(s)
i_key self._session = requests.Session() self._session.verify = verify if not veritoken self._session = requests.Session() self._session.verify = verify if not veri
No obfuscation patterns detected
Found 1 shell execution pattern(s)
h): try: result = subprocess.run( ["git", "ls-files", "--cached", "--others", "--
No credential harvesting patterns detected
No typosquatting candidates detected
Email domain looks legitimate: example.com>
Found 1 suspicious link(s) on the package page
Non-HTTPS external link: http://arr-mcp-mcp:8000/mcp
No GitHub repository linked
No GitHub repository link found
2 maintainer concern(s) found
Author name is missing or very shortAuthor "" appears to have only 1 package on PyPI (new or inactive account)
No known vulnerabilities found in OSV database.
AI App Starter Prompt
Build a simple Python application using the arr-mcp package to demonstrate its core features.