Zabbix MCP Server

Detected

• Talks to external services6 places

  Makes outbound requests. The hosts are listed so you can see where data goes.

  api.anthropic.com, api.github.com, api.groq.com, api.mistral.ai, api.openai.com

• Runs shell commands6 places

  Spawns processes on your machine. Expected for command, browser and build tools.

• Loads code at runtime2 places

  Uses eval, dynamic imports or encoded payloads, which static review cannot fully follow.

• Uses elevated privileges55 places

  sudo, the Docker socket or a privileged container appear in shipped code.

• Installs itself to run later43 places

  Writes startup entries, cron jobs or state files that outlive the session.

• Passes model output on without checks1 places

  Model output reaches HTML, SQL or a shell without validation.

• Fetches user-supplied URLs1 places

  Requests arbitrary URLs, including internal addresses, based on input.

Not detected: reads environment variables in bulk, sends conversation content outward, reads or writes other agents' configuration, accesses credential files, matches a known malicious pattern.

Dependencies with known advisories

None found in the lockfiles and manifests checked against OSV.dev.

Left out of the profile

98 pattern matches in documentation, configuration or CI files were recorded but are not part of the profile, because they do not run when the server does. The owner dashboard lists them.