Vaara MCP Server

What the code does

We read the source, 3 d ago · rules 995398eba69f

Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.

      "pattern": "bash\\s+-i\\s+>&?\\s+/dev/tcp/",

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

    "/etc/crontab", "/etc/cron.d/", "/etc/cron.hourly/", "/etc/cron.daily/",

        let proc = Process()

        result = subprocess.run([sys.executable, str(checker)])

        hash_alg, size_of_select = struct.unpack_from(">HB", attest_bytes, off)
        off += 3
        if off + size_of_select > len(attest_bytes):

      child = spawn(VAARA_BIN, ["hook", subcommand, "--client", "opencode"], {

    return os.path.normpath(os.path.join(cwd, path))

      "message": "Read of /etc/shadow or related privileged files."

  $("settings").innerHTML = Object.entries(c.fields).map(([key, f]) => {

const DEMO = {"envelope": {"payload": "eyJfdHlwZSI6Imh0dHBzOi8vaW4tdG90by5pby9TdGF0ZW1lbnQvdjEiLCJwcmVkaWNhdGUiOnsiYWdlbnRfaWQiOiJhZ2VudDphY21lL2NoZWNrb3V0LWJvdC8xIiwiZGVjaWRlZF9hdCI6IjIwMjYtMDYtMjNUMTI6MDA6MDVaIiwiZGVjaXNpb24iOiJkZW55IiwicG9saWN5X2V2YWx1YXRpb25zIjpbeyJwb2xpY3lfa…

USER 0

    env = dict(os.environ) if env is None else env

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

Connect this server

This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.

claude mcp add vaara-server -- uvx vaara

{
  "mcpServers": {
    "vaara-server": {
      "command": "uvx",
      "args": [
        "vaara"
      ]
    }
  }
}

[mcp_servers.vaara-server]
command = "uvx"
args = ["vaara"]

{
  "mcpServers": {
    "vaara-server": {
      "command": "uvx",
      "args": [
        "vaara"
      ]
    }
  }
}

{
  "servers": {
    "vaara-server": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "vaara"
      ]
    }
  }
}

Optional settings from the registry entry, left out of the block above: VAARA_DB (Path to the SQLite audit DB. Defaults to vaara_audit.db in the working directory), VAARA_API_KEY (Optional shared secret. When set, every tool call must include _api_key in its arguments. Leave unset for single-tenant stdio deployments where process isolation is enough).