Zn Gate MCP Server

What the code does

We read the source, 4 min ago · rules ccca72095570

A value the model can set ends up inside a file or shell call. That is not a flaw by itself — for a terminal server it is the job — but it is where things go wrong when it is not.

      fs.writeFileSync(opened.fd, text);

Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.

  /\b(?:send|upload|post|exfiltrate|forward|transmit|leak|e-?mail|copy|share|paste)\b[^\n]{0,120}?(?:\.env\b|~\/\.ssh|id_rsa|id_ed25519|\.aws\/credentials|\.npmrc|\.netrc|\.git-credentials|api[ _-]?keys?|access[ _-]?tokens?|secrets?|credentials?|passwords?|private[ _-]?keys?|envi…

… _-]?keys?|environment variables)\b[^\n]{0,120}?(?:https?:\/\/|webhook|pastebin|discord(?:app)?\.com|gist\.github|ngrok|requestbin|attacker)/i,

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

  /\b(?:curl|wget|http|iwr|invoke-webrequest|invoke-restmethod)\b[^\n|]{0,200}?(?:-d|--data(?:-binary|-raw|-urlencode)?|-F|--form|-T|--upload-file|--post-file|-InFile|-Body)[\s=]{1,3}["']?@?[^\s"']{0,40}?(?:\.env\b|\.ssh\/|id_rsa|id_ed25519|\.aws\/credentials|\.npmrc|\.netrc|\.git-credentials)/i,

  const res = spawnSync(cmd, args, {

    for (const x of exts) out.push(path.join(dir, name + x));

    pattern: /(?:^|[\s"'`(\[])(?:~|\/home\/[^\s/]+|\/root)?\/?\.(?:ssh\/(?:id_rsa|id_ed25519|authorized_keys)|aws\/credentials|env(?:\.[a-z0-9]+)?)(?![A-Za-z0-9_])|\/etc\/(?:shadow|passwd)(?![A-Za-z0-9_])/i,

… _-]?keys?|environment variables)\b[^\n]{0,120}?(?:https?:\/\/|webhook|pastebin|discord(?:app)?\.com|gist\.github|ngrok|requestbin|attacker)/i,

Found in continuous integration, deployment or infrastructure files, or in a neighbouring package of the same monorepo. None of this is installed when you add the server: it describes how the project is built and released. We list it because a leaked key in a build pipeline is still a real problem, but it is not something this server does on your machine.

      - name: Delete caches of closed pull requests
        env:
          GH_TOKEN: ${{ github.token }}

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

claude mcp add zn-gate -- npx -y zn-gate

{
  "mcpServers": {
    "zn-gate": {
      "args": [
        "-y",
        "zn-gate"
      ],
      "command": "npx"
    }
  }
}

[mcp_servers.zn-gate]
command = "npx"
args = ["-y", "zn-gate"]

{
  "mcpServers": {
    "zn-gate": {
      "args": [
        "-y",
        "zn-gate"
      ],
      "command": "npx"
    }
  }
}

{
  "mcpServers": {
    "zn-gate": {
      "args": [
        "-y",
        "zn-gate"
      ],
      "command": "npx"
    }
  }
}

This one needs environment variables set before it will start: ZN_LOCAL_ONLY (Set to true to force local-only mode, even if ZN_CLOUD=1.), ZN_CLOUD (Set to 1 to let prompt analysis also query the optional cloud classifier. Off by default.), ZN_API_KEY (API key for the optional cloud check. Has no effect without ZN_CLOUD=1.). The author declared them in the registry entry; get the values from the project itself.