LingChen-tsjmdlc/pyside-iconify-mcp

Review signals: 1 connection review, 3 known vulnerability.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 8 distinct locations. 1 attributed processes.

PID 2259: <guest-path> · pyside-iconify-mcp

OSV reports a known vulnerability in this dependency version. 2 distinct locations. 3 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• get_reference with no topic lists the reference topics: Real input produced the expected result: # pyside-iconify reference topics

  Source: Input: optional `topic`. Without a topic it lists them

  Input: {"tool": "get_reference", "arguments": {}}

  Expected: topic list header

  Command: uv run pyside-iconify-mcp tools/call {"tool": "get_reference", "arguments": {}}

  Observed: …# pyside-iconify reference topics\n\nGenerated for pyside-iconify 1.2.0. Call get_reference with one of:\n\n- `overview`: What the library is, which entry point to use, icon names, rules\n- `icon_widget`: IconWidget: full signature, methods and signals\n- `get_icon`: get_icon and get_pixmap: signature, and what they do not support\n- `set_icon`: set_icon: putting icons on buttons, actions, tabs, items, windows\n- `colors`: Every accepted color form, mappings, theme and state colors\n- `sizes`: Every accepted size form\n- `animation`: Built-in effects and the icon's own SMIL animation\n- `pitfa

• get_reference returns Markdown generated from the installed library: Real input produced the expected result: # Colors

  Source: Output: Markdown. The signatures are generated from the installed `pyside-iconify`

  Input: {"tool": "get_reference", "arguments": {"topic": "colors"}}

  Expected: Colors markdown section

  Command: uv run pyside-iconify-mcp tools/call {"tool": "get_reference", "arguments": {"topic": "colors"}}

  Observed: …# Colors\n\n## Accepted color values\n\n| Form | Example | Notes |\n| --- | --- | --- |\n| CSS / SVG color name | `\"red\"`, `\"rebeccapurple\"` | Resolved by Qt |\n| HEX | `\"#f00\"`, `\"#ff0000\"`, `\"#ff000080\"` | 3, 4, 6 or 8 digits. The 8-digit form is `#RRGGBBAA` (alpha last, CSS order), not Qt's `#AARRGGBB` |\n| `rgb()` / `rgba()` | `\"rgb(255, 0, 0)\"`, `\"rgba(255, 0, 0, 0.5)\"` | Comma separated. Channels are integers 0-255 or percentages; alpha is 0-1 or a percentage |\n| `hsl()` / `hsla()` | `\"hsl(210, 50%, 40%)\"` | Comma separated. Saturation and lightness must be percentages |

Examples

• Offline test suite documented in README Development section: command completed successfully

  Source: README.md Development

  Input: uv run pytest -v

  Expected: all tests pass

  Command: uv run pytest -v

  Observed: jects_bad_input[kwargs0-empty] PASSED [ 97%] tests/tools/test_search_icons.py::test_search_rejects_bad_input[kwargs1-too long] PASSED [ 97%] tests/tools/test_search_icons.py::test_search_rejects_bad_input[kwargs2-invalid icon set prefix] PASSED [ 98%] tests/tools/test_search_icons.py::test_search_rejects_bad_input[kwargs3-limit] PASSED [ 98%] tests/tools/test_search_icons.py::test_search_rejects_bad_input[kwargs4-limit] PASSED [ 99%] tests/tools/test_search_icons.py::test_empty_prefix_means_all_sets PASSED [100%] ============================= 180 passed in 5.17s ==============================

Local or hosted: local

Run the pyside-iconify-mcp stdio MCP server from the checkout and call its get_reference tool (topic colors) to get version-matched pyside-iconify usage Markdown

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat README.md 2>/dev/null | head -c 6000
ls /inputs 2>&1; ls <guest-path> 2>&1; echo CDP=$CDP_URL; curl -s -m 10 -i $CDP_URL/json/version | head -20
cd <guest-path> && tail -c +6000 README.md | head -c 5000; echo; echo ---; cat .python-version; grep -n requires-python pyproject.toml; which uv uvx; uv --version 2>&1
cd <guest-path> && timeout 900 uv sync --group test 2>&1 | tail -30; echo EXIT=$?
cd <guest-path> && timeout 900 uv run pytest -v 2>&1 | tail -15; echo EXIT=${PIPESTATUS[0]}
cd <guest-path> && ls src/pyside_iconify_mcp/tools/ && grep -n "def \|topic" src/pyside_iconify_mcp/tools/get_reference.py | head -40; grep -n "def \|scripts" -A3 pyproject.toml | grep -i script -A2; ls docs; head -c 1500 <guest-path> | head -40; grep -n "mcp" <guest-path> | head -30
cd <guest-path> && sed -n 286,300p src/pyside_iconify_mcp/tools/get_reference.py; sed -n 366,380p src/pyside_iconify_mcp/tools/get_reference.py; grep -n "is_monotone\|monotone" src/pyside_iconify_mcp/tools/check_icons.py | head -5; timeout 60 uv run pyside-iconify-mcp </dev/null 2>&1 | head -5; echo EXIT=$?
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["uv","run","pyside-iconify-mcp"],"cwd":"<guest-path>","tool":"get_reference","arguments":{"topic":"colors"},"expected_text":"# Colors"}
EOF
cat > .coldpass/claims.json <<'EOF'
[
{"kind":"claim","claim":"get_reference with no topic lists the reference topics","source":"Input: optional `topic`. Without a topic it lists them","input":"no arguments","expected":"topic list header","probe_kind":"mcp","argv":["uv","run","pyside-iconify-mcp"],"tool":"get_reference","arguments":{},"expected_text":"# pyside-iconify reference topics","cwd":"<guest-path>"},
{"kind":"claim","claim":"get_reference returns Markdown generated from the installed library","source":"Output: Markdown. The signatures are generated from the installed `pyside-iconify`","input":"topic colors","expected":"Colors markdown section","probe_kind":"mcp","argv":["uv","run","pyside-iconify-mcp"],"tool":"get_reference","arguments":{"topic":"colors"},"expected_text":"# Colors","cwd":"<guest-path>"}
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: pyproject [project.scripts] pyside-iconify-mcp = pyside_iconify_mcp.server:main is a stdio MCP server that runs only when a client calls it; README Development lists only uv sync, uv run pytest, uv run pyside-iconify-mcp. No scheduler, cron, loop, webhook, --once or --now found.","checks":[]}
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Offline test suite documented in README Development section","source":"README.md Development","input":"uv run pytest -v","expected":"all tests pass","argv":["uv","run","pytest","-v"],"cwd":"<guest-path>","expected_text":"180 passed"}]
EOF
python3 -m json.tool .coldpass/probe.json >/dev/null && python3 -m json.tool .coldpass/claims.json >/dev/null && python3 -m json.tool .coldpass/cycles.json >/dev/null && python3 -m json.tool .coldpass/examples.json >/dev/null && echo OK; ls <guest-path>
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -c 6000; echo EXIT=${PIPESTATUS[0]}
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo EXIT=$?; python3 -I -c "import json,sys; d=json.load(open('<guest-path>')) if open('<guest-path>').read(1)=='{' else None; print(d and {k:v for k,v in d.items() if k in ('valid','ok','status','errors')})" ; grep -o '"valid": [a-z]*' <guest-path> | head; grep -o '"errors": \[[^]]*\]' <guest-path> | head -3
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run the pyside-iconify-mcp stdio MCP server from the checkout and call its get_reference tool (topic colors) to get version-matched pyside-iconify usage Markdown","operation_scope":"Local stdio MCP server from the pinned checkout (commit f9be7f7ef4030a1d24e13dffe2b53d4fe0cc3a04). Needs uv and Python per .python-version (3.13) or a compatible interpreter. get_reference is offline. search_icons and check_icons need network access to api.iconify.design and were not exercised. No browser or credentials were needed; the CDP endpoint was checked but not used.","steps":["uv sync --group test","uv run pytest -v (180 passed)","uv run pyside-iconify-mcp (stdio MCP server; probed via get_reference topic colors, returned '# Colors' Markdown)","<env-var>=<guest-path> python3 -I <guest-path> --validate --replay (valid: true)"],"deviations":["The task named /inputs/coldpass-preflight.py, which does not exist in the guest; ran the provided <guest-path> instead.","The workspace is not a git repository and no pinned-commit fetch was needed; the checkout already matched the supplied source snapshot.","Client install commands in the README use uvx pyside-iconify-mcp from PyPI; per the README Development section I ran the local checkout with uv run instead."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
python3 -m json.tool .coldpass/report.json >/dev/null && echo OK; ls -la .coldpass