Server Implementation
Source that hides what it actually does — long base64 / hex blobs piped into `exec`, compressed payloads, one-character variable names, or unicode-homoglyph identifiers designed to defeat reading by humans and scanners.
Obfuscation is not a bug; it is a signal. Legitimate MCP servers are usually short, readable, and boring. When a package ships a 4 000-character base64 blob that gets decoded and `exec`d, or a gzipped/marshalled payload stored in a string literal, the author is trying to conceal behaviour from the reader. The common patterns are `exec(__import__('zlib').decompress(base64.b64decode(...)))`, deeply-nested lambda chains, and minified single-line modules shipped outside of a build step.
MCP packages are installed and trusted wholesale by agents — there is no code review gate, no browser same-origin policy, no syscall sandbox. A maintainer who ships obfuscated source is asking to be trusted on faith alone. Because our scanner reads source, not execution, obfuscation is both a red flag on its own merits and a way for other threats (exfiltration, command injection) to hide from regex-based detectors.
# tools.py — the entire module |
import base64, zlib |
exec(zlib.decompress(base64.b64decode( |
"eJxLTSxJ1cvJLNZLL0osUChKTS5O1S1LzSxKVahQSM4o0FHIzEvPLdBRSMzJLFMo" |
"Ss0pVijIzCxWAPIV0vLzFYCcZCAXyMssKlZIzi8tSU3RKyhNLEnVy0wrLk3MSdVL" |
"LEotLtHT08tJzVNITM7PS8nPLMlMzUvXSy0pzi/KLCpKTMvIzEtPzC8uyS8uyczX" |
"yyxJTcrMSU3TS8vPLClNzcnJT8ssSUzKzEvJz8zLTVXI0UvLzEnPL0pVSEtMBwBt" |
"IkOE" |
))) |
# tools.py — readable, auditable source |
from mcp.server.fastmcp import FastMCP |
mcp = FastMCP("my-server") |
@mcp.tool() |
def add(a: int, b: int) -> int: |
"""Return a + b.""" |
return a + b |
We flag base64/hex literals longer than ~200 characters passed to `exec`, `eval`, `compile`, or `Function()`, calls to `zlib.decompress` / `gzip.decompress` fed directly into code execution, single-line modules over 2 000 characters outside recognised minified bundles, and unicode-homoglyph identifiers (Cyrillic letters posing as Latin).
See the full threat catalog for every documented detection.
CVEs of the same CWE class. Not MCP-specific, but exemplify the failure mode MCPSafe detects.
MCPSafe runs this check — and every other rule in the catalog — on any MCP server you paste in.
Scan now