Security audit

Cherry Mcp

Security checks across malware telemetry and agentic risk

Overview

This is a coherent local MCP bridge, but it exposes powerful configured tools over an unauthenticated localhost HTTP API and can store or print secrets in plaintext.

Install only if you understand that this creates a persistent local bridge able to invoke whatever MCP tools you configure. Keep it bound to 127.0.0.1, use only trusted MCP server commands, avoid storing API keys with set-env when possible, protect config.json, avoid sharing show-config output, and add authentication or firewall controls before using high-privilege tools.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill describes capabilities to read environment variables and expose network-accessible HTTP endpoints, but it does not declare corresponding permissions. This creates a transparency and trust problem: agents or reviewers may underestimate what the skill can access or expose, increasing the chance of unsafe deployment with secrets or network reachability the user did not expect.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The bridge exposes an unauthenticated POST /<server>/restart endpoint that can stop and relaunch managed child processes. Even if bound to localhost by default, this materially expands control over backend services beyond passive status exposure and enables denial of service or repeated process churn by any party that can reach the bridge.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The HTTP API allows arbitrary tool invocation and restart actions with no authentication, while also setting Access-Control-Allow-Origin: * for browser access. In this skill context, the bridge is specifically designed to expose MCP tools over REST, so missing auth is more dangerous because MCP tools may perform sensitive local actions such as file access, command execution, or network operations.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: `set-env` stores arbitrary environment-variable values, including likely secrets such as API tokens, directly into `config.json` in plaintext. If that file is readable by other local users, accidentally committed, backed up insecurely, or exposed through another bug, credentials for downstream MCP servers can be disclosed.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: `show-config` prints the full loaded configuration object, which includes `servers[*].env` values, to stdout. This can expose secrets in terminals, logs, shell history captures, CI output, or remote sessions, turning stored plaintext credentials into easily leaked data.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: bridge.js:56

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: cli.js:119