Mcp Manager Gateway

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  src/mcp_manager/home_migration.py, line 100

  shutil.rmtree(staging)

  src/mcp_manager/imports.py, line 307

  result = subprocess.run([node, "-e", script, str(path)], capture_output=True, timeout=10, check=False,

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  src/mcp_manager/static/core.js, line 9

  '=').slice(1).join('=');const res=await fetch('/api/v1'+path,{method,credentials:'incl

  .github/workflows/docker-image.yml, line 70

  with urllib.request.urlopen(pypi_url, timeout=10) as resp:

  .github/workflows/release-all.yml, line 42

  with urllib.request.urlopen(pypi_url, timeout=10) as resp:

  Show more

  compose.mysql.yaml, line 62

  - "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8765/readyz', timeout=3)"

  compose.yaml, line 35

  - "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8765/readyz', timeout=3)"

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  deploy/windows/manage.ps1, line 4

  # 配置存 .env（脚本同级目录），配置不写注册表。

  deploy/windows/manage.ps1, line 10

  $envFile = Join-Path $scriptDir '.env'

  deploy/windows/manage.ps1, line 45

  # 读取 .env（脚本同级目录），返回哈希表（键大写）。

  Show more

  deploy/windows/manage.ps1, line 78

  Write-Host "--- 当前 .env 内容（敏感值已隐藏，$envFile）---"

  deploy/windows/manage.ps1, line 82

  Write-Host ' （尚无 .env；将使用默认值）'

  deploy/windows/manage.ps1, line 91

  Write-Host '已创建默认 .env。'

  deploy/windows/manage.ps1, line 94

  Write-Host '编辑 .env（保存并关闭后，下次启动生效）:'

  deploy/windows/manage.ps1, line 98

  Write-Host '已用记事本打开 .env。保存并关闭后按回车重新显示...'

  src/mcp_manager/cli.py, line 161

  bridge.add_argument("--token", default=os.environ.get("MCP_MANAGER_TOKEN", ""))

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Concern

  contains a minified payload.

  OBFUSCATION_MINIFIED_PAYLOAD

  uv.lock, line 1

  version = 1

  src/mcp_manager/static/app.js, line 86

  async function auth(register=false){resetTableSelection();selectionPage=null;const username=field('用户名'),password=field('密码','','password');username.input.required=true;username.in

  src/mcp_manager/static/app.js, line 87

  $('#app').replaceChildren(el('div',{class:'auth'},el('section',{class:'card'},el('div',{class:'brand'},el('span',{class:'brand-icon'},icon('link')),bootstrap.title||'MCP Manager'),

  Show more

  src/mcp_manager/static/app.js, line 88

  async function dashboard(main,signal){main.append(title('仪表盘','服务运行与工具调用，一目了然。',[button('刷新',refresh)]));const d=await api('/dashboard',{signal});const stats=[['总调用次数',d.calls,'累计调

  src/mcp_manager/static/app.js, line 89

  const points=d.daily||[],max=Math.max(1,...points.map(x=>x.calls));const svg=document.createElementNS('http://www.w3.org/2000/svg','svg');svg.setAttribute('viewBox','0 0 700 190');

  src/mcp_manager/static/app.js, line 92

  let busy=false;const tick=async()=>{if(busy||signal.aborted||document.hidden||!main.isConnected)return;busy=true;try{const next=await api('/dashboard',{signal});const values=[next.

  src/mcp_manager/static/app.js, line 172

  async function users(main,signal){main.append(title('用户管理','管理账户、角色和 MCP 服务授权。',[button('创建用户',()=>userEditor(),'primary')]));await tablePage(main,{path:'/users',signal,columns:[['

  src/mcp_manager/static/app.js, line 173

  async function userEditor(row){const username=field('用户名',row?.username||''),email=field('邮箱',row?.email||'','email'),password=field(row?'新密码（留空不修改）':'密码','','password'),role=selec

  src/mcp_manager/static/app.js, line 182

  async function mcps(main,signal){main.append(title('MCP 服务','集中配置服务，按需启动，共享 MCP 完整能力。',[button('导入配置',()=>mcpImport(refresh)),button('导出配置',()=>ask('是否导出全部 MCP 服务配置为 JSON 文件？敏感字段将脱

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit a07410ef33c0. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. contains a minified payload.

Date and source

Date checked: 23 Oct 2026

Read how this letter is chosen