Is aplaceforallmystuff/mcp-arr safe?
Yes. aplaceforallmystuff/mcp-arr is safe to install. Oathe's behavioral security audit gave the mcp-arr skill by aplaceforallmystuff a trust score of 94/100 with 3 findings, none critical or high.
https://github.com/aplaceforallmystuff/mcp-arr
Is aplaceforallmystuff/mcp-arr safe to install?
This is a legitimate MCP server for managing *arr media management applications (Sonarr, Radarr, Lidarr, Readarr, Prowlarr). The code is professionally written TypeScript with standard MCP SDK usage and no malicious behavior detected. Some sensitive file access occurred during installation but appears to be normal system behavior rather than skill-related exfiltration.
What security issues were found in aplaceforallmystuff/mcp-arr?
Category Scores
Findings (3)
LOW Sensitive file access during installation -10 ▶
The installation process accessed sensitive files like .env, SSH keys, and cloud credentials. However, this appears to be system-level access during normal installation procedures rather than malicious behavior by the skill itself.
INFO Media management complexity -10 ▶
This skill provides comprehensive access to *arr media management services which are powerful tools that can significantly impact a user's media library configuration. Users should ensure they understand the implications of the operations they request.
INFO Standard MCP server implementation -5 ▶
The skill is implemented as a standard MCP server using TypeScript with appropriate dependencies and no suspicious execution patterns detected.
Should I install aplaceforallmystuff/mcp-arr?
Oathe's verdict for aplaceforallmystuff/mcp-arr is SAFE with a trust score of 94/100. Recommendation: Install.