MCP, MCP server
Apm Sdk Python
MCP server and workflow skills for Synology ActiveProtect Manager (APM).
Compatibility: Not stated.
Grade C
One Medium finding. Read the report before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
NETWORK_HOST_FROM_INPUT
Why this grade
- NETWORK_HOST_FROM_INPUT Medium
A file takes a URL or endpoint as input and has no fixed host list.
packages/synology-apm-sdk/src/synology_apm/sdk/collections/_shared.py, line 245
return await fetch(plan_id)
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
examples/_common.py, line 179
os.remove(path)
scripts/check_actions_versions.py, line 131
result = subprocess.run(["git", "ls-remote", *args], capture_output=True, text=True, check=False)
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Serious
accepts a host from input, with no fixed list in this file.
NETWORK_HOST_FROM_INPUT
packages/synology-apm-sdk/src/synology_apm/sdk/collections/_shared.py, line 245
return await fetch(plan_id)
packages/synology-apm-sdk/src/synology_apm/sdk/collections/_shared.py, line 262
return await fetch()
packages/synology-apm-sdk/src/synology_apm/sdk/collections/_shared.py, line 441
async def fetch(offset: int, limit: int) -> tuple[list[WorkloadVersion], int | None]:
Show more
packages/synology-apm-sdk/src/synology_apm/sdk/collections/_shared.py, line 885
async def fetch(offset: int, limit: int) -> tuple[list[dict[str, Any]], int | None]:
packages/synology-apm-sdk/src/synology_apm/sdk/collections/activities.py, line 169
async def fetch(
packages/synology-apm-sdk/src/synology_apm/sdk/collections/backup_servers.py, line 112
async def fetch(offset: int, limit: int) -> tuple[list[BackupServer], int | None]:
packages/synology-apm-sdk/src/synology_apm/sdk/collections/backup_servers.py, line 135
async def fetch(offset: int, limit: int) -> tuple[list[dict[str, Any]], int | None]:
packages/synology-apm-sdk/src/synology_apm/sdk/collections/gws.py, line 281
async def fetch(offset: int, limit: int) -> tuple[list[dict[str, Any]], int | None]:
packages/synology-apm-sdk/src/synology_apm/sdk/collections/m365.py, line 296
async def fetch(offset: int, limit: int) -> tuple[list[dict[str, Any]], int | None]:
packages/synology-apm-sdk/src/synology_apm/sdk/collections/machine.py, line 244
async def fetch(offset: int, limit: int) -> tuple[list[dict[str, Any]], int | None]:
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_DOTENV
examples/_common.py, line 94
f" Set it via `uv run --env-file .env ...` / export {var}=<value>, or "
examples/apm_import_export.py, line 49
Environment variables (see .env.example and examples/README.md):
examples/backup_activity_report.py, line 17
Environment variables (see .env.example and examples/README.md):
Show more
examples/backup_catchup.py, line 23
Environment variables (see .env.example and examples/README.md):
examples/billing_report.py, line 48
Environment variables (see .env.example and examples/README.md):
examples/export_m365_mailbox.py, line 44
Environment variables (see .env.example and examples/README.md):
examples/export_verification_videos.py, line 23
Environment variables (see .env.example and examples/README.md):
examples/restore_activity_report.py, line 14
Environment variables (see .env.example and examples/README.md):
packages/synology-apm-sdk/src/synology_apm/sdk/config.py, line 314
or os.environ.get("APM_PASSWORD", "")
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Note
a file was over the read cap and was not fully read.
OBFUSCATION_FILE_OVER_READ_CAP
uv.lock, line 1
version = 1
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit ec3e778c7021. can delete files. accepts a host from input, with no fixed list in this file. reads a credential or environment file. a file was over the read cap and was not fully read.
Date and source
Date checked:
github.com
Commit graded: ec3e778c702180a473ba047bee2730fe5199f44e
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.