io.github.oraios/serena

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

• Injection surface

  unscannable25% of grade

  Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

  No tool descriptions, server instructions, prompts, or resources were fetched; nothing to scan for injection.

• Supply chain

  fail25% of grade

  Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

  Python build script executes at build time: subprocess in build script

• Credential hygiene

  warn15% of grade

  How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

  src/solidlsp/lsp_protocol_handler/lsp_types.py: assigns a literal to token (Prog…en (len 13)) — non-provider secret literal; prefer environment intake. Reads secrets from the environment (e.g. scripts/build_news_json.py) — the recommended intake shape.

• Permission scope

  fail15% of grade

  Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

  HIGH: shell/exec capability AND network egress together — download-and-execute risk (repo_dir_sync.py: os.system/os.popen/os.exec* call; src/serena/agent.py: outbound HTTP/socket call). HIGH: shell/exec capability AND destructive filesystem writes together (repo_dir_sync.py: os.system/os.popen/os.exec* call; repo_dir_sync.py: open(…, 'w'/'a'/'x') write-mode file access). discloses shell/exec capability: repo_dir_sync.py: os.system/os.popen/os.exec* call discloses shell/exec capability: docs/create_toc.py: os.system/os.popen/os.exec* call discloses shell/exec capability: scripts/build_news_json.py: os.system/os.popen/os.exec* call discloses shell/exec capability: scripts/bump_version.py: os.system/os.popen/os.exec* call discloses shell/exec capability: src/serena/cli.py: subprocess.* call discloses shell/exec capability: src/serena/dashboard.py: subprocess.* call discloses shell/exec capability: src/serena/util/dotnet.py: subprocess.* call discloses shell/exec capability: src/serena/util/shell.py: subprocess.* call with shell=True (command-injection prone) discloses shell/exec capability: src/solidlsp/ls_process.py: subprocess.* call with shell=True (command-injection prone) discloses shell/exec capability: src/solidlsp/ls_utils.py: subprocess.* call discloses shell/exec capability: src/solidlsp/language_servers/bsl_language_server.py: subprocess.* call discloses shell/exec capability: src/solidlsp/language_servers/clojure_lsp.py: subprocess.* call discloses shell/exec capability: src/solidlsp/language_servers/common.py: subprocess.* call with shell=True (command-injection prone) discloses shell/exec capability: src/solidlsp/language_servers/eclipse_jdtls.py: subprocess.* call discloses shell/exec capability: src/solidlsp/language_servers/erlang_language_server.py: subprocess.* call discloses shell/exec capability: src/solidlsp/language_servers/fsharp_language_server.py: subprocess.* call discloses shell/exec capability: src/solidlsp/language_servers/gopls.py: subprocess.* call discloses shell/exec capability: src/solidlsp/language_servers/julia_server.py: subprocess.* call with shell=True (command-injection prone) discloses shell/exec capability: src/solidlsp/language_servers/lean4_language_server.py: subprocess.* call discloses shell/exec capability: src/solidlsp/language_servers/nixd_ls.py: subprocess.* call discloses shell/exec capability: src/solidlsp/language_servers/ocaml_lsp_server.py: subprocess.* call discloses shell/exec capability: src/solidlsp/language_servers/perl_language_server.py: subprocess.* call discloses shell/exec capability: src/solidlsp/language_servers/phpactor.py: subprocess.* call discloses shell/exec capability: src/solidlsp/language_servers/powershell_language_server.py: subprocess.* call discloses shell/exec capability: src/solidlsp/language_servers/r_language_server.py: subprocess.* call discloses shell/exec capability: src/solidlsp/language_servers/ruby_lsp.py: subprocess.* call discloses shell/exec capability: src/solidlsp/language_servers/rust_analyzer.py: subprocess.* call discloses shell/exec capability: src/solidlsp/language_servers/scala_language_server.py: subprocess.* call discloses shell/exec capability: src/solidlsp/language_servers/solargraph.py: subprocess.* call discloses shell/exec capability: src/solidlsp/language_servers/sourcekit_lsp.py: subprocess.* call discloses shell/exec capability: src/solidlsp/language_servers/systemverilog_server.py: subprocess.* call discloses shell/exec capability: src/solidlsp/language_servers/zls.py: subprocess.* call discloses shell/exec capability: src/solidlsp/language_servers/elixir_tools/elixir_tools.py: subprocess.* call discloses shell/exec capability: test/solidlsp/angular/conftest.py: subprocess.* call discloses shell/exec capability: test/solidlsp/elixir/conftest.py: subprocess.* call discloses shell/exec capability: test/solidlsp/erlang/conftest.py: subprocess.* call discloses shell/exec capability: test/solidlsp/php/test_php_basic.py: subprocess.* call discloses shell/exec capability: test/solidlsp/svelte/conftest.py: subprocess.* call discloses dynamic code execution: src/solidlsp/language_servers/solargraph.py: uses eval/exec/__import__ discloses broad/destructive filesystem access: repo_dir_sync.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: repo_dir_sync.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: docs/autogen_docs.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: docs/autogen_docs.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: docs/autogen_docs.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: scripts/demo_diagnostics.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/serena/cli.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: src/serena/cli.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/serena/code_editor.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/serena/dashboard.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/serena/hooks.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: src/serena/hooks.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/serena/config/serena_config.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/serena/memories/memory_manager.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/ls.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/ls.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: src/solidlsp/ls_utils.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: src/solidlsp/ls_utils.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/language_servers/ada_language_server.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/language_servers/al_language_server.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/language_servers/bash_language_server.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/language_servers/clangd_language_server.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/language_servers/clojure_lsp.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/language_servers/csharp_language_server.py: path traversal ('../') combined with file access discloses broad/destructive filesystem access: src/solidlsp/language_servers/cue_language_server.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/language_servers/dart_language_server.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/language_servers/eclipse_jdtls.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/language_servers/groovy_language_server.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/language_servers/haxe_language_server.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: src/solidlsp/language_servers/haxe_language_server.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/language_servers/hlsl_language_server.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/language_servers/kotlin_language_server.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/language_servers/marksman.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/language_servers/ocaml_lsp_server.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/language_servers/omnisharp.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/language_servers/pascal_server.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: src/solidlsp/language_servers/pascal_server.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/language_servers/phpactor.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/language_servers/svelte_language_server.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: src/solidlsp/language_servers/systemverilog_server.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/language_servers/taplo_server.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/language_servers/terraform_ls.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/language_servers/vue_language_server.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: src/solidlsp/language_servers/elixir_tools/elixir_tools.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: src/solidlsp/util/zip.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: test/resources/repos/ruby/test_repo/examples/user_management.rb: path traversal ('../') combined with file access discloses broad/destructive filesystem access: test/serena/test_cli_project_commands.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: test/serena/test_cli_project_commands.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: test/serena/test_symbol_editing.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: test/serena/config/test_global_ignored_paths.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: test/serena/config/test_serena_config.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: test/serena/util/test_file_system.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: test/solidlsp/test_ls_common.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: test/solidlsp/test_ls_common.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: test/solidlsp/bsl/test_bsl_basic.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: test/solidlsp/bsl/test_bsl_basic.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: test/solidlsp/cpp/test_cpp_basic.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: test/solidlsp/pascal/test_pascal_auto_update.py: open(…, 'w'/'a'/'x') write-mode file access discloses broad/destructive filesystem access: test/solidlsp/pascal/test_pascal_auto_update.py: destructive filesystem call (shutil.rmtree/os.remove/etc.) discloses broad/destructive filesystem access: test/solidlsp/pascal/test_pascal_auto_update.py: path traversal ('../') combined with file access Capability DISCLOSURE, not a verdict: static analysis sees the primitive is present and reachable, not whether its use is attacker-controlled.

• Version behavior

  unscannable10% of grade

  Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

  no prior version to diff (first sight of io.github.oraios/[email protected]); version-drift / rug-pull cannot be evaluated. Cold-start risk is covered by point-in-time checks (injection_surface, supply_chain, credential_hygiene), not here.

• Transport config

  fail10% of grade

  Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

  source performs runtime self-update / download-and-execute (bypasses version_behavior); manifest/source references analytics behavior — disclosure