Simple-MCP-Server-with-Python

ruslanmv/Simple-MCP-Server-with-Python

This project is a tutorial and minimal example MCP server in Python that provides a two-number addition tool, a greeting resource, and a code review prompt template. The MCP server itself has no security risks as it only performs basic in-memory operations, though the optional Ubuntu setup script pipes a remote script directly into a root shell.

What it can reach

Other

The MCP server only performs in-memory integer addition and string formatting over standard input and output.

Findings

1. LowOptional install script executes unpinned remote script as root

   install.sh:34

   The optional setup script downloads a setup script from deb.nodesource.com and pipes it directly into sudo bash without verifying a checksum, and also removes existing system Node.js packages.

   Fix: Install Node.js and Python dependencies manually or verify the downloaded repository key and package hashes rather than piping curl into sudo bash.