What the reviewer found

Deployer guide for exec-vps-mcp, a tutorial project whose sole declared purpose is an unrestricted root-shell MCP tool run over an SSH tunnel bound to 127.0.0.1, with extensive guardrails (never expose the port publicly, never paste private keys, ask before destructive commands). The installer should know any MCP client wired to it gets full root command execution on the VPS - that's the deliberate feature, not a hidden backdoor.

• remote-exec — runs code fetched from the network
• dual-use — a security tool that can be misused

What was read

The file as it ships in yding-git/exec-vps-mcp:

• AGENTS.md

What the static scan said

The scan flagged 4things. The reviewer kept 0 and dismissed 4 as false.

• PE2Asks for root — false positive
• PE3Reaches for credential files — false positive
• AS1Reads agent configuration directories — false positive
• SHRuns shell commands — false positive

How this review was made

Sonnet 5 read the files above on 7 September 2026 and answered three questions: is it dangerous to whoever installs it, is each scanner finding real, and what should the installer know. The verdict is bound to the file's hash; when the file changes, it is scanned afresh and reviewed again. A script that changes while the definition does not is not re-reviewed — that is a known gap. How the scan and the review work.

Produced by agentmods.dev · Sonnet 5 · 7 September 2026