io.github.KryptosAI/mcp-seatbelt

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  requests shell access. No manifest field names shell or command execution.

  PERMISSION_SHELL_UNDECLARED

  ARCHITECTURE.md, line 318

  | **stdio** | `StdioClient` | `child_process.spawn` with piped stdio; newline-delimited JSON-RPC framed via `readline` on **stdout**, with a best-effort JSON parser on **stderr** t

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  scripts/run-benchmarks.ts, line 130

  const response = await fetch(url, {

  src/commands/benchmark.ts, line 24

  const response = await fetch(`http://localhost:${port}/${serverName}`, {

  src/commands/benchmark.ts, line 89

  await fetch(`http://localhost:${port}/health`);

  Show more

  src/commands/benchmark.ts, line 99

  const serversResponse = await fetch(`http://localhost:${port}/servers`);

  src/commands/benchmark.ts, line 115

  const probe = await fetch(`http://localhost:${port}/${serverName}`, {

  src/commands/benchmark.ts, line 133

  const response = await fetch(`http://localhost:${port}/health`);

  src/commands/benchmark.ts, line 159

  const finalResponse = await fetch(`http://localhost:${port}/health`);

  src/commands/dashboard.ts, line 312

  const resp = await fetch('/' + encodeURIComponent(currentSimServer) + '/explain', {

  src/commands/dashboard.ts, line 343

  fetch('/api/stats')

  src/policy/llm-judge.ts, line 257

  response = await fetch(apiEndpoint, {

  src/policy/llm-judge.ts, line 272

  response = await fetch(apiEndpoint, {

  src/policy/threat-intel.ts, line 22

  const res = await fetch(THREATFOX_API, {

  src/proxy/notifications.ts, line 15

  const response = await fetch(webhook.url, {

  src/proxy/server.ts, line 438

  fetch(this.url, {

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL

  src/index.ts, line 152

  const secret = opts.secret as string || process.env.SEATBELT_AUDIT_SECRET;

  src/commands/proxy.ts, line 43

  apiKey: opts.judgeKey || process.env.OPENAI_API_KEY || process.env.ANTHROPIC_API_KEY,

  marketing/whitepaper.md, line 74

  13:02:47 Agent reads ~/.ssh/config (credential discovery)

  Show more

  src/commands/proxy.ts, line 48

  const auditSecret = opts.auditSecret || process.env.SEATBELT_AUDIT_SECRET;

  src/commands/proxy.ts, line 85

  process.env.MCP_SEATBELT_API_KEY = opts.authKey;

  marketing/whitepaper.md, line 75

  13:03:12 Agent writes to ~/.ssh/authorized_keys (persistence)

  marketing/whitepaper.md, line 86

  13:02:47 READ ~/.ssh/config → HONEYTOKEN DETECTED.

  marketing/whitepaper.md, line 88

  13:03:12 WRITE ~/.ssh/authorized_keys → [attack-chain] persistence detected.

  marketing/whitepaper.md, line 94

  > **Key Insight:** Seatbelt doesn't just block individual calls. It tracks sequences. A single `read /etc/passwd` might be legitimate. `read /etc/passwd` followed by `write ~/.ssh/

  marketing/whitepaper.md, line 121

  **Tool Poisoning.** A malicious MCP server advertises a benign-sounding tool name (e.g., `read_config`) but executes a shell command or reads from `~/.aws/credentials` when invoked

  marketing/whitepaper.md, line 265

  │ paths (/etc/passwd, C:\Windows\System32, ~/.ssh/authorized_keys) │

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Pass

  No encoded or minified payload found.

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 5a20f0db6c45. requests shell access. No manifest field names shell or command execution. can reach a host that is not written as a fixed address. reads a credential or environment file.

Date and source

Date checked: 19 Oct 2026

Read how this letter is chosen