pypi / dynamic-mcp

dynamic-mcp 1.0.9

Riskhigh Vulnsnone

processes: 754
operations: 53K
packages: 53
compiler runs: 3
connections: 8
build time: 3m 26s
job time: 3m 26s
capture: 556 KB
records: 93K
bytes / record: 6.0

MCP server for dynamic analysys: BPFtrace, crash dump

published 2026-07-30 · source · home page mcp dynamic bpftrace crash analysis debugging kernel View on PyPI Release

Graph

egress · high

Checks

16 of 19 clear Network activity Filesystem writes +1 more

Build behavior▲✓✓✓✓✓✓✓✓▲✓

Supply chain✓▲✓✓✓✓✓

Pipeline✓

Detections

Connected to a tunnel endpoint: api.trycloudflare.com:443

api.trycloudflare.com:443 › api.trycloudflare.com:443

high
Build wrote to a sensitive file

cloudflared

medium
Package code dialled an undeclared host, and nothing answered

api.cloudflare.com:443 › api.cloudflare.com:443, pypi.org

medium
Package code connected to an undeclared host

github.com:443 › github.com:443, pypi.org

medium
Connected to a default hosting domain: production.dynamic-agent.workers.dev:443

production.dynamic-agent.workers.dev:443 › production.dynamic-agent.workers.dev:443

medium
Package code connected to an undeclared host

region1.v2.argotunnel.com:7844 › region1.v2.argotunnel.com:7844, pypi.org

medium
Package code connected to an undeclared host

region2.v2.argotunnel.com:7844 › region2.v2.argotunnel.com:7844, pypi.org

medium
Package code connected to an undeclared host

release-assets.githubusercontent.com:443 › release-assets.githubusercontent.com:443, pypi.org

medium

Network

8 peers

api.trycloudflare.com:443 dynamic-mcp's own build code · cloudflared · Cloudflare, Inc. undeclared
production.dynamic-agent.workers.dev:443 dynamic-mcp's own build code · dynamic-mcp; dynamic-mcp-http (dynamic-mcp) · Cloudflare, Inc. undeclared
api.cloudflare.com:443 dynamic-mcp's own build code · cloudflared · Cloudflare, Inc. unjudged
github.com:443 dynamic-mcp's own build code · dynamic-mcp · GitHub, Inc. unjudged
region1.v2.argotunnel.com:7844 dynamic-mcp's own build code · cloudflared · Cloudflare, Inc. unjudged
region2.v2.argotunnel.com:7844 dynamic-mcp's own build code · cloudflared · Cloudflare, Inc. unjudged
release-assets.githubusercontent.com:443 dynamic-mcp's own build code · dynamic-mcp · Fastly, Inc. unjudged
files.pythonhosted.org:8080 the package manager · python3.14 (dynamic-mcp) via pypi.org ecosystem

Vulnerabilities6		Fix	Severity
Dependencies
pip 25.1.1		>=26.2.0
CVE-2025-8869	pip's fallback tar extraction doesn't check symbolic links point to extraction directory		medium
CVE-2026-13346	pip would incorrectly handle doubly-encoded package URLs from indexes		medium
CVE-2026-3219	pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files		medium
CVE-2026-6357	pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere		medium
CVE-2026-8643	pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory		medium
CVE-2026-1703	pip Path Traversal vulnerability		low

Dependencies53	Build behaviour
aiohappyeyeballs2.7.1
aiohttp3.14.5
aiosignal1.4.0
annotated-types0.8.0
anyio4.16.0
attrs26.1.0
build1.6.1
certifi2026.10.23
cffi2.1.1
click8.5.0
cryptography50.0.2
frozenlist1.8.0
h110.16.0
httpcore1.0.9
httpx0.28.1
httpx-sse0.4.3
idna3.20
iniconfig2.3.1
jsonschema4.26.0
jsonschema-specifications2025.9.1
mcp1.30.0
multidict7.2.1
packaging26.3
pexpect4.9.0
pluggy1.7.0
propcache0.5.4
psutil7.2.2
ptyprocess0.7.0
pycparser3.12
pydantic2.14.3
pydantic-core2.50.4
pydantic-settings2.16.2
pygments2.21.0
pyjwt2.15.1
pyproject-hooks1.3.3
pytest9.2.0
python-dateutil4.0.0
python-dotenv1.2.4
python-multipart0.0.33
referencing0.37.0
rpds-py2026.9.1
sse-starlette3.6.0
starlette1.10.0
typing-extensions4.16.0
typing-inspection0.4.5
tzdata2026.6
uvicorn0.54.0
yarl1.25.1
pip25.1.1
pip26.3
setuptools84.2.1
wheel0.48.0
~ip25.1.1

Versions8

1 of 1 jobs captured: build-import success · Generated 2026-11-06 · run e202e1ec-cada-4eb3-869f-6449a313f2e3

analysis 0.1.0 · 2026-11-06 · 4346b99 · graph v2

dynamic-mcp opens a public Cloudflare tunnel to an unauthenticated remote shell and sends the URL to the publisher

Conclusion: malicious
Covers: 0.2.0, 0.3.0, 0.3.4, 1.0.4, 1.0.6, 1.0.7, 1.0.8 and 1.0.9
Reviewed by: Bitbison
Updated: 2026-11-06

An MCP crash-analysis server that, by default, downloads cloudflared, exposes an unauthenticated bash-execution server through a public tunnel, and reports the URL to the publisher.

dynamic-mcp is a PyPI package published by 42Research Ltd that presents itself as an MCP (Model Context Protocol) server for crash-dump and kernel analysis, wrapping the crash utility and bpftrace.

What dynamic-mcp does

When a user launches the server — including dynamic-mcp --help, which the CLI does not treat as a help flag — it starts an HTTP server on 0.0.0.0:8080. Unless the environment variable ENABLE_REVERSE_CONNECTION is set to false, it first downloads the cloudflared executable from the cloudflare/cloudflared GitHub repository's latest release, installs it under ~/.local/bin, and executes cloudflared tunnel --url http://localhost:8080, which creates a public Cloudflare quick tunnel to the local server. It then sends the resulting https://<random>.trycloudflare.com URL together with its tool list to https://production.dynamic-agent.workers.dev/api/mcp/connect, and posts a heartbeat to the same host every 20 seconds. The exposed server accepts requests at /api/mcp/request (and the SSE endpoints) without any authentication, and those requests can run arbitrary bash -c commands, bpftrace scripts and crash-utility commands with the user's privileges. The README describes only local stdio and HTTP use and does not mention the tunnel, the registration, or the remote command execution.

What the code does

The lines below are from 1.0.9. Every version since the first does the same by default: 0.2.0, 0.3.0 and 0.3.4 (December 2025) open the tunnel and register its URL with https://dynamic.artem-blagodarenko.workers.dev, exposing the crash-utility and bpftrace tools; 1.0.4 (July 25, 2026) adds the bash -c tool, so from then on the tunnel exposes arbitrary command execution; 1.0.6 onward register with production.dynamic-agent.workers.dev.

src/dynamic_mcp/server.py:1489-1490 — async_main() sets ENABLE_REVERSE_CONNECTION=true whenever the variable is not already set, so the reverse tunnel is on by default.
src/dynamic_mcp/server.py:1530-1552 — command-line handling has no --help path; without a --stdio flag the server starts in HTTP mode bound to 0.0.0.0:8080.
src/dynamic_mcp/server.py:175-201 — setup_tunnel() creates a TunnelManager and starts the tunnel.
src/dynamic_mcp/tunnel_manager.py:83-104 — _download_cloudflared() fetches https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-<arch>, writes it to ~/.local/bin/cloudflared, and makes it executable; no version is pinned and no signature or checksum is verified.
src/dynamic_mcp/tunnel_manager.py:126-131 — start_tunnel() executes cloudflared tunnel --url http://localhost:<port>.
src/dynamic_mcp/server.py:1387-1406 — register_with_dynamic() POSTs the server name, capabilities and tunnel URL to https://production.dynamic-agent.workers.dev/api/mcp/connect.
src/dynamic_mcp/server.py:1409-1432 — heartbeat_loop() re-posts to the same host every 20 seconds.
src/dynamic_mcp/server.py:989-1080 — the HTTP app's /api/mcp/request endpoint parses a JSON method and dispatches it directly to the tool handlers, with no authentication.
src/dynamic_mcp/server.py:643-680 — _handle_execute_bash() runs bash -c <command> and returns its output.

Timeline (UTC)

When	What
December 28, 2025	0.2.0, the first version, is published to PyPI; it already opens a public tunnel to the server by default and registers its URL with the publisher
December 29, 2025	0.3.0 and 0.3.4
July 25, 2026	1.0.4 adds `bash -c` execution to the exposed tools; 1.0.6 and 1.0.7 the same day
July 30, 2026	1.0.8 and 1.0.9
November 6, 2026	All eight versions still served by PyPI: about ten months of a default-on tunnel, and about three and a half months of remote command execution

If you installed it

Uninstall the package (pip uninstall dynamic-mcp) and remove the downloaded ~/.local/bin/cloudflared if this package installed it. If you must keep it, set ENABLE_REVERSE_CONNECTION=false before launching so it does not open the public tunnel or register with the publisher, and do not run dynamic-mcp or dynamic-mcp-http without that variable. Treat any machine that ran it as compromised: the publisher was given a live public URL to an unauthenticated command-execution service.

Indicators

hosts: api.trycloudflare.comgithub.comrelease-assets.githubusercontent.comregion1.v2.argotunnel.comregion2.v2.argotunnel.comapi.cloudflare.comproduction.dynamic-agent.workers.devdynamic.artem-blagodarenko.workers.dev
files: ~/.local/bin/cloudflared
processes: cloudflared tunnel --url http://localhost:8080

What was examined

0.2.0: sha256:0bff3040ed529ee375518da86155c42a6b68728d313c73b062aa1af2ab6d0b47
0.3.0: sha256:fceac1d33e5df88243ae556884a83939c00281174a472ce094d93a3be53b0f2e
0.3.4: sha256:073f625bd24e43984baed89d809c8683bc360d38d468f298390e244ba52be9aa
1.0.4: sha256:0048531f647fecdfc72b6d97d2e943ab7d70d88b73f1a3365be9a409385cf633
1.0.6: sha256:994b43457af5c534a7f80864c9d4af37ca7a7f35d98d613d392a2dab453a0a2c
1.0.7: sha256:939ac7771ec415bb440ce2a10f149b35c3119f905f20c2f1118afc367f9c21ce
1.0.8: sha256:785d0c7cdf33851deb73125a9445e0d82ff570bd70d373b972e37d4368573617
1.0.9: sha256:cebb5d206b015b1b851121e31946f5a0a0b42daa697cfece1429d6f396623179