mixelpixx/KiCAD-MCP-Server

Review signals: 1 connection review, 271 known vulnerability.

Reviewed as expected for a test run: resolver address lookups that send no data.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 52.168.112.67:443 1 attributed processes.

PID 13585: <guest-path> · tests

OSV reports a known vulnerability in this dependency version. 18 distinct locations. 115 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• create_project initializes a new KiCAD project: Real input did not produce the expected result: Created project: claimcheck

  Source: `create_project` - Initialize new KiCAD projects

  Input: {"tool": "create_project", "arguments": {"name": "claimcheck", "path": "<guest-path>"}}

  Expected: project files created and tool reports success

  Command: node dist/index.js tools/call {"tool": "create_project", "arguments": {"name": "claimcheck", "path": "<guest-path>"}}

  Observed: {"content": [{"type": "text", "text": "Python process for KiCAD scripting is not running"}], "isError": true}

Examples

• TypeScript unit tests of the MCP server pass offline: command completed successfully

  Source: package.json scripts test:ts

  Input: npm run test:ts

  Expected: 112 tests pass under vitest

  Command: npm run test:ts

  Observed: 2026-10-24 04:42:14,665] [INFO] Router tools registered successfully stderr | tests-ts/no-stale-tool-references.test.ts > discovery responses do not reference deleted tools > every tool named in a discovery response is actually registered [2026-10-24 04:42:14,666] [INFO] Registering router tools [2026-10-24 04:42:14,667] [INFO] Router tools registered successfully stderr | tests-ts/request-correlation.test.ts > Python bridge response correlation > discards a late response and resolves only the matching request [2026-10-24 04:42:16,116] [WARN] Discarding stale Python response 1; waiting for 2

• Python test suite runs offline with the documented pytest command: command completed successfully

  Source: package.json scripts test:py

  Input: pytest tests/test_schematic_batch.py

  Expected: tests pass under pytest

  Command: <guest-path> tests/test_schematic_batch.py -q

  Observed: 1-172, 180-181, 204-218, 244-246, 250, 253, 255, 264-267, 277-300, 313-315 python/utils/symbol_instances.py 300 232 130 2 17% 53-55, 59-61, 71-75, 83-88, 98-113, 128-138, 147-187, 192-199, 213-223, 227-230, 240-247, 260-261, 273-277, 286-292, 312-345, 363-376, 394-403, 417, 421-422, 444-511 -------------------------------------------------------------------------------------------- TOTAL 25144 23983 9708 60 4% Coverage HTML written to dir htmlcov Coverage XML written to file coverage.xml 18 passed in 11.51s

Local or hosted: local

create_project MCP tool via node dist/index.js (README Installation + MCP stdio usage)

cd <guest-path> && ls -la && id -u && cat /etc/os-release | head -3 && python3 --version && git --version 2>&1; ls /inputs 2>&1; ls <guest-path> 2>&1
cd <guest-path> && cat README.md | head -300
cd <guest-path> && grep -n '^#' README.md | head -120
cd <guest-path> && grep -n -i 'install\|quick\|python\|node\|kicad' README.md | sed -n '1,200p' | cut -c1-220 | head -150
cd <guest-path> && sed -n '930,1010p' README.md
cd <guest-path> && (node --version; npm --version; which kicad-cli; python3 -c "import pcbnew" 2>&1 | tail -1; pip3 --version; sudo -n true && echo SUDO_OK; cat /etc/apt/sources.list.d/* 2>/dev/null | head -5; echo "proxy=$HTTPS_PROXY $https_proxy") 2>&1
cd <guest-path> && git init -q 2>&1; git remote add origin https://github.com/mixelpixx/KiCAD-MCP-Server 2>&1; timeout 120 git fetch --depth 1 origin cbb59a6203997f5e916be7e0480d63fe5519134a 2>&1 | tail -5; echo "rc=$?"; git log --oneline -1 FETCH_HEAD 2>&1
cd <guest-path> && git reset --mixed FETCH_HEAD 2>&1 | tail -2; git status --short | head -20; echo "---"; git status --short | wc -l
export DEBIAN_FRONTEND=noninteractive; sudo apt-get update -qq 2>&1 | tail -3; sudo apt-get install -y -qq software-properties-common python3-pip python3-venv curl ca-certificates 2>&1 | tail -3; sudo add-apt-repository --yes ppa:kicad/kicad-9.0-releases 2>&1 | tail -5; echo "rc=$?"
export DEBIAN_FRONTEND=noninteractive; sudo apt-get update -qq 2>&1 | tail -3; timeout 1500 sudo apt-get install -y -qq kicad kicad-libraries > /tmp/kicad-install.log 2>&1; echo "rc=$?"; tail -5 /tmp/kicad-install.log; which kicad-cli; kicad-cli --version 2>&1 | head -2
export DEBIAN_FRONTEND=noninteractive; curl -fsSL https://deb.nodesource.com/setup_20.x -o /tmp/nodesource_setup.sh 2>&1; echo "dl_rc=$?"; sudo -E bash /tmp/nodesource_setup.sh > /tmp/nodesource.log 2>&1; echo "setup_rc=$?"; tail -3 /tmp/nodesource.log; sudo apt-get install -y -qq nodejs 2>&1 | tail -2; node --version; npm --version
python3 -c "import pcbnew; print(pcbnew.GetBuildVersion())" 2>&1 | tail -1; ls /usr/lib/python3/dist-packages | grep -i pcb; /usr/bin/python3 --version; cat <guest-path>
cd <guest-path> && python3 -m venv --system-site-packages <guest-path> 2>&1 | tail -2; <guest-path> --version; timeout 900 <guest-path> install -q -r <guest-path> > <guest-path> 2>&1; echo "pip_rc=$?"; tail -5 <guest-path>; <guest-path> -c "import pcbnew, kipy, skip; print('ok', pcbnew.GetBuildVersion())" 2>&1 | tail -1
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && timeout 1200 npm install > <guest-path> 2>&1; echo "npm_install_rc=$?"; tail -5 <guest-path>; timeout 600 npm run build > <guest-path> 2>&1; echo "build_rc=$?"; tail -8 <guest-path>
cd <guest-path> && cat package.json | head -50; echo ---; grep -n 'dist/index\|npm start\|npm test\|pytest\|stdio\|mcpServers' README.md | cut -c1-200 | head -40
cd <guest-path> && sed -n '1199,1262p' README.md; echo ----; cat .env.example; echo ----; grep -rn "PYTHON\|KICAD_PYTHON\|python3\|'python'" src/*.ts src/**/*.ts 2>/dev/null | grep -i 'env\|spawn\|python' | head -20
cd <guest-path> && sed -n '705,722p' README.md; grep -n 'create_project' README.md | head; echo ---; wc -l <guest-path>; grep -n 'def \|expected_file\|stays_running' <guest-path> | head -60
cd <guest-path> && grep -rn '"create_project"' src python | head -5; grep -rn -A25 "name: \"create_project\"" src | head -50
mkdir -p <guest-path> && cd <guest-path> && export KICAD_PYTHON=<guest-path> && { printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"t","version":"1"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"create_project","arguments":{"projectName":"claimdemo","path":"<guest-path>"}}}'; sleep 25; } | timeout 60 node dist/index.js 2><guest-path> | cut -c1-900; echo "rc=${PIPESTATUS[1]}"; tail -5 <guest-path> | cut -c1-300; ls -la <guest-path> <guest-path> 2>&1
cd <guest-path> && grep -rn -B2 -A12 '"create_project"' python/schemas/tool_schemas.py | head -40; grep -rln 'def create_project\|create_project' python | head; sed -n 1,30p src/tools/project.ts
cd <guest-path> && export KICAD_PYTHON=<guest-path> && { printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"t","version":"1"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"create_project","arguments":{"name":"claimdemo","path":"<guest-path>"}}}'; sleep 30; } | timeout 60 node dist/index.js 2><guest-path> | cut -c1-1200; echo; ls -la <guest-path> <guest-path> 2>&1 | head -20
cd <guest-path> && cat <guest-path> | cut -c1-400 | head -60
cd <guest-path> && export KICAD_PYTHON=<guest-path> && { printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"t","version":"1"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}'; sleep 8; printf '%s\n' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"create_project","arguments":{"name":"claimdemo","path":"<guest-path>"}}}'; sleep 5; } | timeout 60 node dist/index.js 2><guest-path> | cut -c1-1200; echo; ls -la <guest-path> <guest-path> 2>&1 | head -20
sed -n 41,47p <guest-path>; sed -n 384,444p <guest-path>
cd <guest-path> && rm -f <guest-path> && grep -c 'Initialize new KiCAD projects' README.md && grep -n '`create_project` - Initialize new KiCAD projects' README.md && ls -la .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["node","dist/index.js"],"cwd":"<guest-path>","env":{"KICAD_PYTHON":"<guest-path>"},"tool":"create_project","arguments":{"name":"probedemo","path":"<guest-path>"},"expected_text":"Created project: probedemo"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"create_project initializes a new KiCAD project","source":"`create_project` - Initialize new KiCAD projects","input":"name=claimcheck path=<guest-path>","expected":"project files created and tool reports success","probe_kind":"mcp","argv":["node","dist/index.js"],"tool":"create_project","arguments":{"name":"claimcheck","path":"<guest-path>"},"expected_text":"Created project: claimcheck","cwd":"<guest-path>","env":{"KICAD_PYTHON":"<guest-path>"}}]
EOF
python3 -m json.tool .coldpass/probe.json >/dev/null && python3 -m json.tool .coldpass/claims.json > /dev/null && echo JSON_OK
cd <guest-path> && grep -rn -i 'cron\|schedul\|--once\|--now\|webhook\|setInterval\|while True' README.md python/kicad_interface.py src/*.ts 2>/dev/null | cut -c1-180 | head -20; echo ---; cat requirements-dev.txt; echo ---; sed -n 1,20p pytest.ini
cd <guest-path> && timeout 900 <guest-path> install -q -r requirements-dev.txt > <guest-path> 2>&1; echo "devpip_rc=$?"; tail -3 <guest-path>; export NODE_USE_ENV_PROXY=1 KICAD_PYTHON=<guest-path>; PATH=<guest-path> timeout 1500 npm test > <guest-path> 2>&1; echo "test_rc=$?"; grep -E 'Test Files|Tests |passed|failed' <guest-path> | tail -8
cd <guest-path> && grep -E '^FAILED|^ERROR| Test Files| Tests ' <guest-path> | cut -c1-300 | head -20; grep -n 'vitest\|Test Files' <guest-path> | head -5
cd <guest-path> && grep -n -A12 '_ test_minimal_fixture_exports_pdf _\|_ test_kicad_keeps_the_block_as_written _' <guest-path> | cut -c1-260 | head -60
cd <guest-path> && cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"TypeScript unit tests of the MCP server pass offline","source":"package.json scripts test:ts","input":"npm run test:ts","expected":"112 tests pass under vitest","argv":["npm","run","test:ts"],"cwd":"<guest-path>","env":{"NODE_USE_ENV_PROXY":"1"},"expected_text":"112 passed"},{"kind":"example","claim":"Python test suite runs offline with the documented pytest command","source":"package.json scripts test:py","input":"pytest tests/test_schematic_batch.py","expected":"tests pass under pytest","argv":["<guest-path>","tests/test_schematic_batch.py","-q"],"cwd":"<guest-path>","env":{"KICAD_PYTHON":"<guest-path>"},"expected_text":"passed"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: README.md (no cron, schedule, --once, --now, or webhook text), python/kicad_interface.py and src/*.ts (no scheduler or polling loop). The server is a request-driven stdio MCP server that runs only when a client calls a tool, so there is no product cycle to trigger by hand.","checks":[]}
EOF
python3 -m json.tool .coldpass/examples.json >/dev/null && python3 -m json.tool .coldpass/cycles.json >/dev/null && echo OK; PATH=<guest-path> <env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "check_rc=$?"; tail -c 3000 <guest-path>
cd <guest-path> && python3 - <<'EOF'
import json,re
t=open('<guest-path>').read()
print(len(t))
for m in re.finditer(r'"(problems|errors|problem|error)"\s*:\s*(\[.*?\]|"[^"]*")', t):
    print(m.group(0)[:800]); print('--')
print(t[:1500])
EOF
cd <guest-path> && python3 - <<'EOF'
import re
t=open('<guest-path>').read()
for m in re.finditer(r'not running|isError|"working\\\\": (true|false)', t):
    print(t[max(0,m.start()-200):m.end()+60].replace('\\\\','\\')); print('=====')
    break
i=t.find('tool_result'); print(t[i:i+400])
EOF
grep -n 'problems' <guest-path> | head -2 | cut -c1-100; grep -o 'claim[^,]*replay[^"]*' <guest-path> | head -3 | cut -c1-300
cd <guest-path> && grep -rn 'is not running' src | head; grep -rn -B12 'Python process for KiCAD scripting is not running' src/kicad-server.ts src/*.ts 2>/dev/null | head -40 | cut -c1-200
cd <guest-path> && grep -rn 'process.env\.[A-Z_]*' -o src | sort | uniq -c | sort -rn | head -30; sed -n 700,730p src/server.ts | cut -c1-200
cd <guest-path> && export KICAD_PYTHON=<guest-path>; for d in 0 1 3; do n=timing$d; out=$( { printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"t","version":"1"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'; sleep $d; printf '%s\n' "{\"jsonrpc\":\"2.0\",\"id\":3,\"method\":\"tools/call\",\"params\":{\"name\":\"create_project\",\"arguments\":{\"name\":\"$n\",\"path\":\"<guest-path>\"}}}"; sleep 4; } | timeout 60 node dist/index.js 2>/dev/null | grep '"id":3' | cut -c1-260 ); echo "delay=$d -> $out"; done; ls <guest-path>
cd <guest-path> && rm -f <guest-path> && pgrep -fa 'dist/index.js|kicad_interface' | head -3; PATH=<guest-path> <env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "check_rc=$?"; python3 -c "
import json,re
t=open('<guest-path>').read()
i=t.find('\"valid\"'); print(t[i:i+200] if i>=0 else t[:300])
print('problems mentions:', len(re.findall(r'problem', t)))
for k in ['probe replay failed','claims:','examples','cycle']:
    print(k, t.count(k))
"; ls <guest-path>
cd <guest-path> && python3 -c "
import json
t=open('<guest-path>').read()
i=t.find('{'); 
d=json.loads(t[i:t.rfind('}')+1])
for p in d['problems']: print(p[:3000]); print('---')
" ; echo; cat .coldpass/probe.json; echo; cat .coldpass/claims.json
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{
  "outcome": "blocked",
  "fault_owner": "repo",
  "operation": "create_project MCP tool via node dist/index.js (README Installation + MCP stdio usage)",
  "operation_scope": "Node MCP server at pinned commit cbb59a6 started with KICAD_PYTHON=<guest-path>; probe and claim call create_project(name, path=<guest-path>).",
  "steps": [
    "Installed Node 20 (NodeSource setup_20.x from README) and python3-pip/python3-venv via apt.",
    "Installed KiCad 9.0.9 from the kicad 9.0 PPA per README; README asks for 9.0+.",
    "Created venv <guest-path> with --system-site-packages and installed requirements.txt and requirements-dev.txt (PEP 668 blocked plain pip3).",
    "npm install and npm run build succeeded (dist/index.js produced).",
    "Started server with node dist/index.js; initialize and tools/list succeeded (serverInfo kicad-mcp-server 2.8.2).",
    "Manual create_project calls succeeded once the Python worker was ready: Created project: timing3 with .kicad_pro/.kicad_pcb/.kicad_sch/.kicad_prl written.",
    "Timing test: tools/call sent after 0 s and 1 s delay failed with 'Python process for KiCAD scripting is not running'; 3 s delay succeeded.",
    "Checker replay: probe and claim both returned 'Python process for KiCAD scripting is not running' (isError true), because the checker calls tools/call immediately after initialize."
  ],
  "deviations": [
    "Used a venv with --system-site-packages instead of the README's bare pip3 install, because Ubuntu PEP 668 blocks system pip.",
    "Probe and claim arguments use name+path, matching the registered create_project schema, not projectName.",
    "npm test:ts/pytest suite: 5 pytest failures tied to kicad-cli behavior on KiCad 9.0.9 vs. the KiCad 10 behavior the tests expect (not fixed; prerequisite mismatch)."
  ],
  "stuck_step": "Checker MCP replay of create_project (probe.json and claims.json): tools/call issued immediately after initialize returns 'Python process for KiCAD scripting is not running'.",
  "main_blocker": "src/server.ts and src/kicad-server.ts callKicadScript reject calls while the Python worker is still starting (about 1.6 to 3 s after launch) instead of waiting or queueing. A call issued with no delay therefore fails.",
  "plain_failure": "The checker's replay of the saved MCP probe and README claim fails. The product works when a call arrives after the worker is READY (manual test with a 3 s delay created files), but the checker validation still reports problems.",
  "suggested_fix": "Make callKicadScript wait for the Python worker READY signal (or queue calls) instead of rejecting during startup, or have the server not answer tools/list until the worker is ready. No checker or probe change has been made to hide this."
}
EOF
python3 -m json.tool .coldpass/report.json >/dev/null && echo report_ok; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -c 600; echo; ls <guest-path>
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; grep -o '"valid": [a-z]*' <guest-path>; grep -o 'probe replay failed[^"]\{0,80\}' <guest-path> | head -2; grep -o 'claims: [^\\]\{0,120\}' <guest-path> | head -1; ls <guest-path>; pgrep -fa 'dist/index.js' | grep -v pgrep | head -3