Security checks across malware telemetry and agentic risk
The skill is a coherent agent-messaging tool, but it needs review because an MCP tool can pull/install and run server software, remove Docker containers on the target port, and leave a local service running without a separate approval step.
Install only if you intentionally want agents to communicate through a keep server. Pin package, image, or Go module versions before use; do not let an agent call keep_ensure_server unless you are comfortable with Docker/Go running code locally; keep the service bound to trusted local networks; monitor and stop the container or background process when finished; and do not send secrets or unreviewed memory through agent messages.
)
# Start new container
result = subprocess.run(
[
"docker", "run", "-d",
"--name", f"keep-server-{port}",logger.info("Trying Go fallback...")
try:
# Install the server binary
result = subprocess.run(
["go", "install", "github.com/clcrawford-dev/keep-server@latest"],
capture_output=True,
text=True,# Remove existing containers on this port
for container_id in existing_containers:
subprocess.run(
["docker", "rm", "-f", container_id],
capture_output=True,
timeout=10,if go_bin:
# Start server in background
subprocess.Popen(
[str(go_bin)],
stdout=subprocess.DEVNULL,
stderr=subprocess.DEVNULL,65/65 vendors flagged this skill as clean.