A workshop for building AI agents using the Model Context Protocol (MCP) in Python. This project demonstrates how to create MCP servers, implement custom tools, and configure intelligent agents for code analysis.
Config is the same across clients — only the file and path differ.
{
"mcpServers": {
"python-mcp-agent-workshop": {
"args": [
"-y",
"@qodo/command"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
A workshop for building AI agents using the Model Context Protocol (MCP) in Python. This project walks through implementing MCP server fundamentals (JSON-RPC framing, tool discovery, and tool execution) and ships two fully working tools:
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
npx -y '@qodo/command' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Five weighted categories — click any category to see the underlying evidence.
Poetry has Path Traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4
### Summary The `extractall()` function in `src/poetry/utils/helpers.py:410-426` extracts sdist tarballs without path traversal protection on Python versions where `tarfile.data_filter` is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4. ### Impact Arbitrary file write (path traversal) from untrusted sdist content. **In practice, the impact is low** because an attacker who exploits this vulnerability can as wel
Poetry Has Wheel Path Traversal Which Can Lead to Arbitrary File Write
### Summary A crafted wheel can contain ../ paths that Poetry writes to disk without containment checks, allowing arbitrary file write with the privileges of the Poetry process. ### Impact Arbitrary file write (path traversal) from untrusted wheel content. Impacts users/CI/CD systems installing malicious or compromised packages. ### Patches Versions 2.3.3 and newer of Poetry resolve the target paths and ensure that they are inside the target directory. Otherwise, installation is aborted. ##
PYSEC-2022-43179
Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. `git config`. These commands are being executed using the executable’s name and not its absolute path. This can lead to the execution of untrusted code due to the way Windows resolves executable names to paths. Unlike Linux-based operating systems, Windows searches for the executable in the current directory first and looks in the paths that are defined in the
PYSEC-2022-266
Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as `git clone`. These commands are constructed using user input (e.g. the repository URL). When building the commands, Poetry correctly avoids Command Injection vulnerabilities by passing an array of arguments instead of a command string. However, there is the possibility that a user input starts with a dash (`-`) and is therefore treated
PYSEC-2022-234
Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
Click any tool to inspect its schema.
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Others in education / ai-ml
Persistent memory using a knowledge graph
Dynamic problem-solving through sequential thought chains
Workspace template + MCP server for Claude Code, Codex CLI, Cursor & Windsurf. Multi-agent knowledge engine (ag-refresh / ag-ask) that turns any codebase into a queryable AI assistant.
Privacy-first. MCP is the protocol for tool access. We're the virtualization layer for context.
MCP Security Weekly
Get CVE alerts and security updates for Python Mcp Agent Workshop and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
A workshop for building AI agents using the Model Context Protocol (MCP) in Python. This project walks through implementing MCP server fundamentals (JSON-RPC framing, tool discovery, and tool execution) and ships two fully working tools:
The performance profiler uses Astroid for semantic AST analysis, detecting:
Unlike general linters (Pylint, Flake8), the performance profiler uses Astroid for semantic analysis:
# Clone and install
git clone <repository-url>
cd python-mcp-agent-workshop
poetry install
# Verify setup
python verification.py
# Start the MCP server
poetry run workshop-mcp-server
# Run tests (102 tests)
poetry run pytest
# Use the performance profiler agent (requires Qodo)
qodo performance_analysis --set file_path="path/to/code.py"
# Use the keyword search agent (requires Qodo)
qodo keyword_analysis --set keyword="{KEYWORD_HERE}"
# Start the server and send a JSON-RPC request
echo '{"jsonrpc":"2.0","id":1,"method":"call_tool","params":{"name":"performance_check","arguments":{"file_path":"src/workshop_mcp/server.py"}}}' | poetry run python -m workshop_mcp.server
Start with the protocol fundamentals and build up the server step by step:
Before starting the workshop, ensure you have the following installed:
Python 3.11+
python --versionPoetry (Python dependency management)
curl -sSL https://install.python-poetry.org | python3 -pip install poetrypoetry --versionThe project uses these core libraries (installed via poetry install):