Bawbel Scanner runs on your own machine — the client starts it, so there is no endpoint to ping. 79 installs a week from pypi. Last commit 23 May 2026.
Scan MCP servers and skill files for AVE vulnerabilities. Conformance scoring and threat intel.
We read the source, 20 min ago · rules 3dff92dd89df
A value the model can set ends up inside a file or shell call. That is not a flaw by itself — for a terminal server it is the job — but it is where things go wrong when it is not.
result = subprocess.run( # nosec B603 # noqa: S603
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
result = subprocess.run( # nosec B603 # noqa: S603
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
That is not a flaw by itself — but it is where things go wrong when it is not the job. We re-read this code on every release. Watch it and you hear from us the day another one appears.
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add bawbel-mcp -- uvx bawbel-mcp
{
"mcpServers": {
"bawbel-mcp": {
"args": [
"bawbel-mcp"
],
"command": "uvx"
}
}
}
[mcp_servers.bawbel-mcp]
command = "uvx"
args = ["bawbel-mcp"]
{
"mcpServers": {
"bawbel-mcp": {
"args": [
"bawbel-mcp"
],
"command": "uvx"
}
}
}
{
"mcpServers": {
"bawbel-mcp": {
"args": [
"bawbel-mcp"
],
"command": "uvx"
}
}
}
Security scanner for MCP servers and skill files. Detects AVE vulnerabilities before production.
Security scanner for MCP servers and skill files. Detects AVE vulnerabilities before production.
MCP server to scan smart contracts on Base for honeypots, rug pulls, and vulnerabilities.
Security co-pilot for AI agents. Scan for vulnerabilities, audit MCP servers, verify governance.
Scan installed MCP servers for security vulnerabilities with 16 detection engines.
HTTP MCP Server for comprehensive Python vulnerability scanning and security analysis.
MCP server for Snyk API & Web — DAST scanning, findings management, and vulnerability triage
OWASP threat scanner auditing codebases for safety leaks.
Answers built from our own checks of this server.