time

modelcontextprotocol/servers/src/time

This MCP server lets an AI agent check the current time and convert times between IANA timezones. It has no significant security risks and only reads the system clock and timezone data.

What it can reach

System

Reads the system clock, local timezone configuration, and system timezone database files

Findings

1. LowDocker image creates a non-root user but still runs as root

   src/time/Dockerfile:33

   The Dockerfile creates an unprivileged 'app' user and assigns ownership of the virtual environment to it, but omits a 'USER app' instruction. When run via Docker, the server process runs as root inside the container instead of the unprivileged user.

   Fix: Add 'USER app' before the ENTRYPOINT instruction in the Dockerfile (and ensure the Python interpreter used by the virtual environment is accessible to the 'app' user).