Palinode

Security signals

• mediumMatched in: manifest

  Executes inline Python code, which can hide malicious behavior in a compact payload.

  python -c 'Dispute this flag?

Automated signals from install metadata and a bounded skill body — not a full code security audit and not a recursive source or dependency review.

{
  "_meta": {
    "io.modelcontextprotocol.registry/official": {
      "status": "active",
      "isLatest": true,
      "updatedAt": "2026-10-14T03:01:41.642624Z",
      "publishedAt": "2026-10-14T03:01:41.642624Z",
      "statusChangedAt": "2026-10-14T03:01:41.642624Z"
    }
  },
  "server": {
    "name": "io.github.phasespace-labs/palinode",
    "_meta": {
      "io.modelcontextprotocol.registry/publisher-provided": {
        "tool": "mcp-publisher",
        "release": "v0.23.0",
        "release_notes_url": "https://github.com/phasespace-labs/palinode/releases/tag/v0.23.0"
      }
    },
    "title": "Palinode",
    "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
    "version": "0.23.0",
    "packages": [
      {
        "version": "0.23.0",
        "transport": {
          "type": "stdio"
        },
        "identifier": "palinode",
        "runtimeHint": "uvx",
        "registryType": "pypi",
        "registryBaseUrl": "https://pypi.org",
        "packageArguments": [
          {
            "name": "--from",
            "type": "named",
            "value": "palinode",
            "description": "Select the palinode distribution from PyPI"
          },
          {
            "type": "positional",
            "value": "palinode-mcp",
            "valueHint": "stdio entry point",
            "description": "Console script for the stdio MCP server"
          }
        ],
        "environmentVariables": [
          {
            "name": "PALINODE_DIR",
            "isRequired": true,
            "description": "Path to the markdown-memory directory (e.g. ~/.palinode). Created if missing."
          },
          {
            "name": "PALINODE_API_HOST",
            "default": "127.0.0.1",
            "description": "Host where the back-end palinode-api process is reachable"
          },
          {
            "name": "PALINODE_API_PORT",
            "default": "6340",
            "description": "Port for palinode-api"
          },
          {
            "name": "PALINODE_API_TOKEN",
            "isSecret": true,
            "description": "Optional bearer token enforced on every palinode-api request other than /health. Required when PALINODE_API_BIND_INTENT=public. Generate with: python -c 'import secrets; print(secrets.token_urlsafe(32))'."
          },
          {
            "name": "PALINODE_API_TOKEN_FILE",
            "isSecret": true,
            "description": "Path to a file containing the bearer token (alternative to PALINODE_API_TOKEN; for docker-secrets style deployments)"
          }
        ]
      },
      {
        "version": "0.23.0",
        "transport": {
          "url": "http://127.0.0.1:6341/mcp/",
          "type": "streamable-http"
        },
        "identifier": "palinode",
        "runtimeHint": "uvx",
        "registryType": "pypi",
        "registryBaseUrl": "https://pypi.org",
        "packageArguments": [
          {
            "name": "--from",
            "type": "named",
            "value": "palinode",
            "description": "Select the palinode distribution from PyPI"
          },
          {
            "type": "positional",
            "value": "palinode-mcp-http",
            "valueHint": "streamable-http entry point",
            "description": "Console script for the long-running streamable-HTTP MCP server"
          }
        ],
        "environmentVariables": [
          {
            "name": "PALINODE_DIR",
            "isRequired": true,
            "description": "Path to the markdown-memory directory"
          },
          {
            "name": "PALINODE_MCP_HTTP_HOST",
            "default": "127.0.0.1",
            "description": "Bind host for the MCP HTTP server. Defaults to loopback; set to 0.0.0.0 only with intentional network exposure (paired with PALINODE_API_BIND_INTENT=public on the back-end)."
          },
          {
            "name": "PALINODE_MCP_HTTP_PORT",
            "default": "6341",
            "description": "Port for the MCP HTTP server"
          },
          {
            "name": "PALINODE_API_HOST",
            "default": "127.0.0.1",
            "description": "Host where the back-end palinode-api is reachable"
          },
          {
            "name": "PALINODE_API_PORT",
            "default": "6340",
            "description": "Port for palinode-api"
          },
          {
            "name": "PALINODE_API_TOKEN",
            "isSecret": true,
            "description": "Bearer token enforced by palinode-api. Required when binding non-loopback. Generate with: python -c 'import secrets; print(secrets.token_urlsafe(32))'."
          },
          {
            "name": "PALINODE_API_TOKEN_FILE",
            "isSecret": true,
            "description": "Path to a file containing the bearer token (alternative to PALINODE_API_TOKEN)"
          }
        ]
      }
    ],
    "repository": {
      "url": "https://github.com/phasespace-labs/palinode",
      "source": "github"
    },
    "websiteUrl": "https://github.com/phasespace-labs/palinode",
    "description": "Inspectable, correctable project memory in git-versioned Markdown for AI agents."
  }
}