mcp-toolbox-bin

MEDIUM

maintainer agony4001 0 votes scanned 2026-10-27 07:48:39.517725

View on AUR

Why flagged

Prebuilt binary downloaded from a Google Cloud Storage bucket (storage.googleapis.com) which, while plausibly official Google infrastructure for this project, is an object storage URL where the artifact could be silently replaced; the single checksum provides some protection but the binary is executed directly without further verification.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("mcp-toolbox-${pkgver}::https://storage.googleapis.com/mcp-toolbox-for-databases/v${pkgver}/linux/amd64/toolbox")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Prebuilt binary downloaded from a Google Cloud Storage bucket (storage.googleapis.com) which, while plausibly official Google infrastructure for this project, is an object storage URL where the artifact could be silently replaced; the single checksum provides some protection but the binary is executed directly without further verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: agony <27015 at riseup dot net>
    
      2
    
      3pkgname=mcp-toolbox-bin
    
      4pkgver=1.15.0
    
      5pkgrel=1
    
      6pkgdesc='MCP server for databases (prebuilt)'
    
      7arch=('x86_64')
    
      8url='https://github.com/googleapis/mcp-toolbox'
    
      9license=('Apache-2.0')
    
      10depends=('glibc')
    
      11provides=("mcp-toolbox=${pkgver}")
    
      12conflicts=('mcp-toolbox')
    
      13source=("mcp-toolbox-${pkgver}::https://storage.googleapis.com/mcp-toolbox-for-databases/v${pkgver}/linux/amd64/toolbox")
    
      14sha256sums=('f6fac005c39898a379523700727a2a3d0a2828f579bec22cc0efe74e0652062d')
    
      15
    
      16package() {
    
      17  install -Dm755 "mcp-toolbox-${pkgver}" "${pkgdir}/usr/bin/mcp-toolbox"
    
      18}
    
      19

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-27 07:48:39	Medium	3
2026-10-27 07:47:02	Medium	3