grim-mcp server

by AbduljabbarBXR·io.github.AbduljabbarBXR/grim-mcp·v0.6.2

Security audit for AI agents: code, deps, exposure, secrets, drift, SBOM, and IoC.

C62/100grade C

What users say

No reviews yet

Safety scan

C62/100

Adoption

Growing

1 stars822 downloads/wk

Reviews

Nobody has reviewed grim-mcp yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

No tool declarations could be read from the package source. They show once the server is installed.

scanner v0.1.8 · 2026-09-19 · same rubric, same numbers if you re-run it

4 medium

Code scan33 source files scanned; 32 source files scanned5/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancelast push 0 days ago15/15
Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

mediumsubprocess with shell=Trueexec.shell-true

python/grim/core/fixplan.py: …fe_load(", line, count=1), False # shell=True with untrusted input -> disable shell e…

mediumeval / new Function usedexec.eval

python/grim/engines/codepatterns.py: …\beval\s*\("), "high", "eval() usage", "eval executes arbitra…

mediumsubprocess with shell=Trueexec.shell-true

grim-mcp-0.6.2/src/grim/core/fixplan.py: …fe_load(", line, count=1), False # shell=True with untrusted input -> disable shell e…

mediumeval / new Function usedexec.eval

grim-mcp-0.6.2/src/grim/engines/codepatterns.py: …\beval\s*\("), "high", "eval() usage", "eval executes arbitra…

Overall 62/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

2026-09-19restoreD → Cscore 62: subprocess with shell=True; eval / new Function used; subprocess with shell=True
2026-09-19restoreF → Dscore 54: curl | sh in a script; curl | sh in a script; subprocess with shell=True

Runs npx -y grim-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add grim-mcp -- npx -y grim-mcp

Is grim-mcp server safe?: With care: it is graded C, so read the findings first (62/100). Read the grim-mcp safety report
How do I install grim-mcp?: It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does grim-mcp need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is grim-mcp maintained?: The last commit was in the last day (2026-09-19). The latest release is v0.6.2.
What can I use instead of grim-mcp?: Servers from other publishers that do the same job: npm Registry MCP Server, Draugr MCP server and Connection String Secret Audit MCP server. Compare all grim-mcp alternatives.

Same job from other publishers: the closest match first, then the best rated.

npm Registry MCP Server
npm registry MCP server — package intelligence, security audits, dependency analysis
More from YawLabs →
not reviewed
Growing
B
Draugr
Security scanning for AI agents: SAST, SCA, secrets, IaC, DAST, ranked by real risk.
not reviewed
Growing
A
Connection String Secret Audit
26 rules and 32 safe-replacement snippets for hardcoded connection strings, keys and kubeconfigs acr
More from jmshinhwa →
not reviewed
Growing
A
MCP Security & Vulnerability Auditor
Static AST security scanner detecting command injection, leaked secrets, and SSRF in MCP tools.
not reviewed
Growing
B
Reversecore MCP
Security-first MCP server for reverse engineering, malware analysis, forensics, and SAST.
not reviewed
Established
B