UUnified Memory Forensics MCP ServerUnified Memory Forensics MCP Server - Multi-tier engine combining Rust speed with Vol3 coverage.

mcp-so:memory-forensics-mcp-server_x746b

View source
F
20/100

First Seen

Feb 18, 2026

Last Scanned

Feb 20, 2026

Findings

5

Score

20/100

CRITICAL 2
HIGH 2
LOW 1

Findings (5)

CRITICAL
Download-and-execute
L45

Detects patterns of downloading and piping to shell execution

curl
-LsSf
https://astral.sh/uv/install.sh
|
sh
FIX

Download the file first, verify its integrity (checksum, signature), inspect it, then run it. Prefer package managers over raw downloads. Never fetch-and-run in one step.

FP?

Likely FP if the target is a well-known installer (e.g., rustup, Homebrew) from its canonical HTTPS domain, though the pattern is inherently risky.

CRITICAL
Curl or wget piped to shell
L45

Detects downloading scripts piped directly to a shell interpreter

curl
-LsSf
https://astral.sh/uv/install.sh
|
sh
FIX

Download the script first, inspect it, verify its checksum, then run it. Do not pipe curl/wget output directly to sh/bash. Prefer package manager installs.

FP?

Likely FP if the download is from a well-known installer domain (e.g., brew.sh, rustup.rs), though this pattern is inherently risky even with trusted sources.

HIGH
MCP server auto-registration
L99

Detects automatic registration of MCP servers into agent configuration

claude mcp
add
FIX

Pin the curl/wget download to a specific URL with version and verify the downloaded file's SHA-256 checksum before using it. Prefer package manager installs over raw downloads.

FP?

Likely FP if the download is from a well-known canonical source (e.g., official GitHub release) and the documentation includes checksum verification steps.

HIGH
MCP server auto-registration
L112

Detects automatic registration of MCP servers into agent configuration

claude mcp
add
FIX

Pin the curl/wget download to a specific URL with version and verify the downloaded file's SHA-256 checksum before using it. Prefer package manager installs over raw downloads.

FP?

Likely FP if the download is from a well-known canonical source (e.g., official GitHub release) and the documentation includes checksum verification steps.

LOW
Chained shell command execution
L45

Detects chained commands using shell operators with dangerous operations

curl
-LsSf
https://astral.sh/uv/install.sh
|
sh
FIX

Break chained commands into discrete, individually validated steps. Avoid piping untrusted output directly into a shell interpreter.

FP?

Likely FP if the matched text is a documentation example showing a common installer one-liner for a well-known tool with a canonical URL.