motherduckdb/mcp-server-motherduck

Review signals: 1 connection review, 21 known vulnerability, 1 outside write.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 46 distinct locations. 18 attributed processes.

OSV reports a known vulnerability in this dependency version. 5 distinct locations. 21 findings.

Repository processes attempted these writes outside documented output/cache paths. 4 distinct locations. 1 attributed processes.

PID 4965: <guest-path> · mcp-server-motherduck

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• execute_query runs a DuckDB SQL query and returns the result: Real input produced the expected result: duck-probe-7319

  Source: Execute SQL query (DuckDB dialect)

  Input: {"tool": "execute_query", "arguments": {"sql": "SELECT 'duck-probe-7319' AS marker"}}

  Expected: the query result containing duck-probe-7319

  Command: <guest-path> --directory <guest-path> run mcp-server-motherduck --db-path :memory: --read-write tools/call {"tool": "execute_query", "arguments": {"sql": "SELECT 'duck-probe-7319' AS marker"}}

  Observed: duck-probe-7319\"\n ]\n ],\n \"rowCount\": 1\n}", "type": "text"}], "isError": false, "structuredContent": {"result": "{\n \"success\": true,\n \"columns\": [\n \"marker\"\n ],\n \"columnTypes\": [\n \"VARCHAR\"\n ],\n \"rows\": [\n [\n \"duck-probe-7319\"\n ]\n ],\n \"rowCount\": 1\n}"}}

Examples

• Local in-memory DuckDB tests pass (documented e2e suite, memory DB file): command completed successfully

  Source: makefile test-e2e target / tests/e2e/test_memory_duckdb.py

  Input: tests/e2e/test_memory_duckdb.py

  Expected: pytest exits 0

  Command: <guest-path> run --directory <guest-path> pytest tests/e2e/test_memory_duckdb.py -q

  Observed: ........ [100%] =============================== warnings summary =============================== tests/e2e/test_memory_duckdb.py::test_simple_select <guest-path> FastMCPDeprecationWarning: Accessing `CallToolResult.isError` is deprecated; MCP SDK v2 renamed this field to `is_error`. Update your code to read `.is_error` instead. assert result.isError is False -- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html 8 passed, 1 warning in 30.11s

• make test-unit target: makefile runs tests/unit/ but that directory does not exist in this snapshot (only tests/e2e/); not runnable. Ran make test-e2e instead: 91 passed, 56 skipped, 2 failed (S3 tests need s3://md-test-bucket-user-1 credentials not available in this guest).

  Source: makefile test-unit target

  Expected: documented command completes successfully

  Observed: makefile runs tests/unit/ but that directory does not exist in this snapshot (only tests/e2e/); not runnable. Ran make test-e2e instead: 91 passed, 56 skipped, 2 failed (S3 tests need s3://md-test-bucket-user-1 credentials not available in this guest).

Local or hosted: both

Run the MCP server (stdio) from source and call execute_query to run a DuckDB SQL query in an in-memory database

cd <guest-path> && pwd && ls -la && id -u && python3 --version && cat README.md | head -200; ls <guest-path> /inputs 2>&1
cd <guest-path> && sed -n 200,400p README.md; cat .python-version; cat makefile; ls -la .coldpass; git status 2>&1 | head -2; which uv uvx; uv --version 2>&1
cd <guest-path> && python3 -m venv <guest-path> && <guest-path> install -q uv 2>&1 | tail -3; <guest-path> --version; cd <guest-path> && git init -q && git remote add origin https://github.com/motherduckdb/mcp-server-motherduck && git fetch --depth 1 origin 41acb581d9bc04e427655ba5178b2c5c01f68cd2 2>&1 | tail -3 && git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1
sudo -n apt-get update -qq 2>&1 | tail -2; sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq python3.12-venv 2>&1 | tail -3; rm -rf <guest-path>; python3 -m venv <guest-path> && <guest-path> install -q uv 2>&1 | tail -3; <guest-path> --version
cd <guest-path> && export PATH=<guest-path> && make install 2>&1 | tail -15; echo "rc=$?"; ls .venv/bin | grep -i motherduck
sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq make 2>&1 | tail -2; cd <guest-path> && export PATH=<guest-path> && make install 2>&1 | tail -15; ls .venv/bin | grep -i motherduck
cd <guest-path> && export PATH=<guest-path> && timeout 600 make test-unit 2>&1 | tail -8; echo; timeout 600 make test-e2e 2>&1 | tail -8
cd <guest-path> && ls tests tests/*; export PATH=<guest-path> && timeout 300 uv run pytest tests/e2e/test_s3_duckdb.py -x -q 2>&1 | grep -iE "error|assert|Exception|s3|http" | head -30
cd <guest-path> && grep -rniE "cron|schedul|while True|webhook|--once|--now|interval" src/ | head; ls src/mcp_server_motherduck; grep -n "def execute_query\<email>\|async def \|def execute" -r src/mcp_server_motherduck/*.py | head -30
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["<guest-path>","--directory","<guest-path>","run","mcp-server-motherduck","--db-path",":memory:","--read-write"],"cwd":"<guest-path>","tool":"execute_query","arguments":{"sql":"SELECT 'duck-probe-7319' AS marker"},"expected_text":"duck-probe-7319"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"execute_query runs a DuckDB SQL query and returns the result","source":"Execute SQL query (DuckDB dialect)","input":"SELECT 'duck-probe-7319' AS marker","expected":"the query result containing duck-probe-7319","probe_kind":"mcp","argv":["<guest-path>","--directory","<guest-path>","run","mcp-server-motherduck","--db-path",":memory:","--read-write"],"tool":"execute_query","arguments":{"sql":"SELECT 'duck-probe-7319' AS marker"},"expected_text":"duck-probe-7319","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Local in-memory DuckDB tests pass (documented e2e suite, memory DB file)","source":"makefile test-e2e target / tests/e2e/test_memory_duckdb.py","input":"tests/e2e/test_memory_duckdb.py","expected":"pytest exits 0","argv":["<guest-path>","run","--directory","<guest-path>","pytest","tests/e2e/test_memory_duckdb.py","-q"],"cwd":"<guest-path>","env":{},"expected_text":"passed"},
{"kind":"example","claim":"make test-unit target","source":"makefile test-unit target","reason":"makefile runs tests/unit/ but that directory does not exist in this snapshot (only tests/e2e/); not runnable. Ran make test-e2e instead: 91 passed, 56 skipped, 2 failed (S3 tests need s3://md-test-bucket-user-1 credentials not available in this guest)."}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected (src/mcp_server_motherduck/server.py, __init__.py, database.py) and grep for cron/schedule/loop/webhook/--once/--now found nothing. The product is a request-driven stdio/streamable-HTTP MCP server with no product scheduler or loop; no cycle was triggered.","checks":[]}
EOF
export PATH=<guest-path>; timeout 600 uv run pytest tests/e2e/test_memory_duckdb.py -q 2>&1 | tail -2; <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -40
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run the MCP server (stdio) from source and call execute_query to run a DuckDB SQL query in an in-memory database","operation_scope":"Local stdio MCP server, in-memory DuckDB (:memory:), read-write. Requires uv (installed via pip into a venv) and python3.12 (venv module installed via apt). S3 e2e tests need S3 credentials/bucket and were not run successfully.","steps":["git init; git remote add origin https://github.com/motherduckdb/mcp-server-motherduck; git fetch --depth 1 origin 41acb581d9bc04e427655ba5178b2c5c01f68cd2; git reset --mixed FETCH_HEAD","pip install uv (README Quick Start prerequisite), installed in <guest-path>","make install (uv sync --all-extras)","make test-e2e (documented test target)","uv --directory <guest-path> run mcp-server-motherduck --db-path :memory: --read-write (README Development section, stdio MCP)","MCP tools/call execute_query with sql SELECT 'duck-probe-7319' AS marker"],"deviations":["python3-venv was missing; installed with sudo apt-get install python3.12-venv, then created venv for uv.","make was missing; installed with sudo apt-get install make.","make test-unit fails: makefile target points at tests/unit/, which does not exist in this snapshot (only tests/e2e/). Recorded as an example with reason; ran make test-e2e instead.","make test-e2e: 91 passed, 56 skipped, 2 failed. Both failures are tests/e2e/test_s3_duckdb.py (test_s3_simple_select, test_s3_show_tables), which need the s3://md-test-bucket-user-1 bucket and credentials not present in this guest. Prerequisite gap, not run successfully.","Used absolute uv path <guest-path> instead of uvx because the README's uvx entry was not in PATH and the source-run form was used.","Cycle: no product scheduler, loop, webhook or --once/--now found; detected=false."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"Fix makefile test-unit target (tests/unit/ does not exist). For full e2e, provide S3 test bucket credentials to run the two S3 tests."}
EOF
python3 -c "import json;json.load(open('.coldpass/report.json'));print('ok')"; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -c "import sys,json; t=sys.stdin.read(); d=json.loads(t[:t.index('\n')] if t.startswith('{') and '\n' in t else t); print(d.get('valid'), d.get('problems'), d.get('replay',{}).get('status'))" 2>&1 | tail -3; ps aux | grep -c "[m]cp-server-motherduck"
ps -eo pid,ppid,etime,cmd | grep "[m]cp-server-motherduck" | cut -c1-200
cd <guest-path> && export PATH=<guest-path> && timeout 600 uv run pytest tests/e2e/test_memory_duckdb.py -q 2>&1 | tail -4
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; python3 -c "
import json,sys
t=open('<guest-path>').read()
i=t.find('{'); d=json.loads(t[i:])
print('valid=',d.get('valid'),'problems=',d.get('problems'),'replay=',d.get('replay',{}).get('status'))
"; ps -eo cmd | grep -c "[m]cp-server-motherduck"
cd <guest-path> && grep -n "uv\|command\|StdioTransport\|env\|HOME" tests/e2e/conftest.py | head -30; export PATH=<guest-path>; timeout 300 env -i HOME=/tmp PATH=/usr/bin:/bin <guest-path> run --directory <guest-path> pytest tests/e2e/test_memory_duckdb.py -q -x 2>&1 | grep -E "RuntimeError|Error|passed|failed" | head -8
sudo -n ln -sf <guest-path> /usr/local/bin/uv && cd <guest-path> && env -i HOME=<host-path> PATH=/usr/local/bin:/usr/bin:/bin <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; python3 -c "
import json
t=open('<guest-path>').read()
i=t.find('{'); d=json.loads(t[i:])
print('valid=',d.get('valid'),'problems=',d.get('problems'),'replay=',d.get('replay',{}).get('status'))
"; ps -eo cmd | grep -c "[m]cp-server-motherduck"
cd <guest-path> && python3 - <<'EOF'
import json
p='.coldpass/report.json'
r=json.load(open(p))
r['deviations'].append("The e2e fixtures launch a bare 'uv' command (tests/e2e/conftest.py), so uv had to be on PATH for the checker's replay; created symlink sudo ln -sf <guest-path> /usr/local/bin/uv. Before this the replayed memory-DB example failed with FileNotFoundError: 'uv'.")
json.dump(r,open(p,'w'),indent=1)
EOF
<env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo rc=$?; python3 -c "
import json
t=open('<guest-path>').read(); d=json.loads(t[t.find('{'):])
print('valid=',d.get('valid'),'problems=',d.get('problems'),'replay=',d.get('replay',{}).get('status'))"; ls -la .coldpass