AI Analysis
The package exhibits high credential risk due to suspicious file access patterns and significant obfuscation, suggesting potential malicious intent. These factors outweigh the benign nature of its network and metadata risks.
- High credential risk due to attempted access of '/etc/shadow.json'
- Significant obfuscation through base64 decoding
Per-check LLM notes
- Network: The package uses standard HTTP requests and asynchronous clients which are common for interacting with APIs or services. This is likely part of its intended functionality.
- Shell: No shell execution patterns were detected, indicating no risk from this aspect.
- Obfuscation: The use of base64 decoding for payloads may indicate an attempt to hide code or data from casual inspection, which is not inherently malicious but increases suspicion.
- Credentials: Accessing '/etc/shadow.json' and similar paths suggests an attempt to read sensitive system files, which is highly indicative of malicious activity aimed at harvesting credentials.
- Metadata: The presence of non-HTTPS links and the author having only one package may indicate a less established project, but no clear signs of malicious intent.
Package Quality Overall: Medium (6.6/10)
Test suite present — 27 test file(s) found
Test runner config found: pyproject.toml27 test file(s) detected (e.g. test_api_name.py)
Some documentation present
Documentation URL: "Documentation" -> https://awslabs.github.io/mcp/servers/openapi-mcp-server/Detailed PyPI description (23035 chars)
No contributing guide or governance files found
No CONTRIBUTING, CODE_OF_CONDUCT, or governance files found
Partial type annotation coverage
102 type-annotated function signatures detected in source
Active multi-contributor project
42 unique contributor(s) across 100 commits in awslabs/mcpActive community — 5 or more distinct contributors
Heuristic Checks
Found 4 network call pattern(s)
int}') response = requests.post(token_endpoint, headers=headers, data=data) iftion pooling client = httpx.AsyncClient( base_url=base_url, headers=headers,y: response = httpx.get(url, timeout=10.0) response.raise_for_statuste HTTP client async with httpx.AsyncClient(base_url='http://localhost:8002') as client: logger.
Found 3 obfuscation pattern(s)
decoded_payload = base64.b64decode(payload).decode('utf-8') import jsondecoded = base64.b64decode(payload) payload_data = json.loads(damespace packages. __path__ = __import__('pkgutil').extend_path(__path__, __name__) # Copyright Amazon.com, In
No shell execution patterns detected
Found 2 credential access pattern(s)
'spec_path': '/etc/shadow.json', 'base_url': 'https://public-api.examresolved.__str__ = lambda s: '/etc/shadow.json' MockPath.return_value.resolve.return_value =
No typosquatting candidates detected
Email domain looks legitimate: users.noreply.github.com>
Found 4 suspicious link(s) on the package page
Non-HTTPS external link: http://10.0.0.5:8080/openapi.jsonNon-HTTPS external link: http://10.0.0.5:8080Non-HTTPS external link: http://...`Non-HTTPS external link: http://`
Repository awslabs/mcp appears legitimate
1 maintainer concern(s) found
Author "Amazon Web Services" appears to have only 1 package on PyPI (new or inactive account)
No known vulnerabilities found in OSV database.
💬 Discussion Feed
No discussion yet. Be the first to share your thoughts!
Report Abuse / Security Issue