1. Conduid
  2. Search
  3. Claude Code MCP Rce
MCP server · Search

Claude Code MCP Rce

by · github.com/jashidsany/claude-code-mcp-rce

Security research: Silent arbitrary command execution via malicious .mcp.json in Claude Code. Demonstrates how modified MCP server configurations execute without re-validation after initial trust. Reported to Anthropic via HackerOne, closed as Informative (by-design behavior).

Unclaimed last commit 7 months ago search
InstallView source
34Low

Scored a month ago · breakdown

About Claude Code MCP Rce

Claude Code MCP Rce is an MCP server published by jashidsany in the Search category: security research: Silent arbitrary command execution via malicious .mcp.json in Claude Code. Demonstrates how modified MCP server configurations execute without re-validation after initial trust. Reported to Anthropic via HackerOne, closed as Informative (by-design behavior).

Six months or more without a commit doesn't mean the server is broken, but check the open issues before depending on it in production.

Install

From source
git clone https://github.com/jashidsany/claude-code-mcp-rce

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about Claude Code MCP Rce

Powered by Claude · Grounded in docs

I know everything about Claude Code MCP Rce. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

6 checks have not been run yet.

Questions

About Claude Code MCP Rce

How do I install Claude Code MCP Rce?

No package has been published for this server, so install it from source: clone the repository and follow its README.

Is Claude Code MCP Rce safe to use with an AI agent?

Its trust score is 34 out of 100 (low). Conduid hasn't run static security checks on this repository yet, so review the source yourself before granting it credentials. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Claude Code MCP Rce still maintained?

The last commit was 7 months ago. That's long enough that you should check whether the maintainer is responding to issues before depending on it.