Moira MCP Server

What the code does

We read the source, 1 h ago · rules 995398eba69f

A value the model can set ends up inside a file or shell call. That is not a flaw by itself — for a terminal server it is the job — but it is where things go wrong when it is not.

      const child = spawn(

Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.

trap 'rm -rf "$temporary"' EXIT HUP INT TERM

    runuser -u workspace -- /bin/sh -c "cat /opt/moira-workspace-payload/header-$arch.txt /opt/moira-workspace-payload/moira-workspace-linux-$arch.tar.gz | /bin/sh /opt/moira-workspace-payload/install.sh" && \

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

const child = spawn(process.execPath, ["--import", tsxLoaderPath, scriptPath, ...args], {

  const sourcePath = path.join(helpDirectory, relativePath);

  const backdrop = 50 + Math.max(0, depth - 1) * 3;

    const baseUrl = this.config.apiUrl || "https://api.telegram.org/bot";

  for (const name of await readdir("/workspaces")) {

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.