Two independent threads: mcpnuke becomes installable, and three checks stop
reporting an authentication failure on a transport that has no authentication.
Distribution
install.sh is a one-liner for people who want the tool rather than the repo.
It picks uv tool, pipx or pip --user, whichever you have — all three
isolate the install so mcpnuke's dependency pins cannot disturb the rest of
your Python.
curl -LsSf https://raw.githubusercontent.com/babywyrm/mcpnuke/main/install.sh | bashFixed: mcpnuke-runner printed a raw ModuleNotFoundError in a base
install. It is installed by the base package but implemented behind the
optional server extra, so a fresh install's second command looked broken
rather than under-provisioned. It now names the extra and exits 2.
Not yet on PyPI. The publish workflow is built, tested and ran green on
this tag, but the upload is gated on a PYPI_PUBLISH repository variable and
stays skipped until the trusted publisher is registered. Install from source
or via install.sh --from in the meantime.
Findings
Three checks reported a missing authentication boundary on stdio, which is a
pipe to a subprocess the scanner launched itself — there is no credential to
withhold and no second caller. They fired on 5 of 5 pinned open-source
servers: 100%, the signature of a finding that carries no information.
| Check | Severity | Now |
|---|---|---|
pre_auth_injection |
HIGH | Not reported on stdio |
anon_budget_exhaust |
HIGH | Not probed at all on stdio, saving 25 calls per scan |
native_function_identity_erasure |
MEDIUM | Not reported on stdio |
Across the five servers: 185 findings → 170, and 34 HIGH → 24, CRITICAL
unchanged at 18. The re-snapshot was a pure deletion — 75 lines removed, none
added — so nothing else moved. All three remain fully active on HTTP and SSE,
where the boundary is real.
A scan of an unchanged stdio server will therefore report fewer findings,
and --diff against an older baseline will show them as resolved. That is the
fix landing, not the server changing.
Also
- A stdio reference target and false-positive harness. stdio was previously
unmeasured while being the transport most users have, which is how the three
checks above shipped. It found the third of them on its first run. - First tests for
pre_auth_injectionandnative_function_identity_erasure,
neither of which had any.
Known: behavioral_rate_limit still fires on all five stdio targets. It
was grouped with the class above originally and deliberately left alone — an
agent stuck in a loop really can hammer a local server.
Full detail in CHANGELOG.md.