MCPretentious MCP Server
by oetikerA powerful Model Context Protocol (MCP) server that puppeteers iTerm2 terminals.
MCPretentious is an open-source mcp server by oetiker, written mainly in JavaScript, with 22 GitHub stars and the MIT license. Its code was last updated Feb 14, 2026.
Scan summary: scanned Nov 5, 2026 at commit e958b29. Seen able to run shell commands, control a web browser. Scan policy
ScannedScanned. The automated checks below ran on the commit shown. Read each line for what was and was not covered.
Full scan at
e958b29 · Nov 5, 2026 ScannedStatic, secrets and dependency checks completed with no critical findings. BuildsIt installed from a fresh machine. BootsIt started, and MCP servers answered the protocol handshake. No undeclared egressWhile running it only contacted the domains it declared. ReproducibleEarned in this scan.
Warning. This check found something worth reading in the findings below. It is not proof of a problem.Static code scanwarnWarning. This check found something worth reading in the findings below. It is not proof of a problem.
Flagged. This check found an issue. See the findings below.Secrets scanfailFlagged. This check found an issue. See the findings below.
Flagged. This check found an issue. See the findings below.Dependency audit117 known vulnerabilitiesfailFlagged. This check found an issue. See the findings below.
Warning. This check found something worth reading in the findings below. It is not proof of a problem.ManifestnonewarnWarning. This check found something worth reading in the findings below. It is not proof of a problem.
Passed. This check ran and found nothing it flags.BuildpassPassed. This check ran and found nothing it flags.
Passed. This check ran and found nothing it flags.Boot & handshake9 toolspassPassed. This check ran and found nothing it flags.
Passed. This check ran and found nothing it flags.Network egresspassPassed. This check ran and found nothing it flags.
Passed. This check ran and found nothing it flags.Reproducible (×3)passPassed. This check ran and found nothing it flags.
Findings (43)
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
lib/focus-manager.js:20 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
lib/focus-manager.js:21 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
lib/focus-manager.js:46 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
lib/focus-manager.js:65 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
lib/focus-manager.js:121 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
lib/focus-manager.js:128 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
lib/focus-manager.js:133 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
lib/focus-manager.js:136 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
lib/iterm2-backend.js:35 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
lib/iterm2-client.js:121 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
lib/tmux-backend.js:29 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
lib/tmux-client-simple.js:33 - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@grpc/grpc-js@1.13.4: 4 known vulnerabilitiesGHSA-5375-pq7m-f5r2, GHSA-99f4-grh7-6pcq, GHSA-f596-whhp-79r4, GHSA-m9gg-hp2v-232j
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@modelcontextprotocol/sdk@1.17.4: 8 known vulnerabilitiesGHSA-345p-7cg4-v4c7, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-8r9q-7v3j-jr4g +3 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@opentelemetry/propagator-jaeger@1.25.1: 1 known vulnerabilityGHSA-45rx-2jwx-cxfr
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.body-parser@2.2.0: 3 known vulnerabilitiesGHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6, GHSA-wqch-xfxh-vrr4
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@2.0.2: 7 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +2 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.fast-uri@3.1.0: 12 known vulnerabilitiesGHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-hrr3-gc8f-f4qj +7 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.glob@10.4.5: 2 known vulnerabilitiesGHSA-3g3m-2fjr-6pw4, GHSA-5j98-mcp5-4vw2
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.jws@4.0.0: 1 known vulnerabilityGHSA-869p-cjfg-cm3x
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.minimatch@9.0.5: 4 known vulnerabilitiesGHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-g3hv-75wg-m249
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.path-to-regexp@8.2.0: 2 known vulnerabilitiesGHSA-27v5-c462-wpq7, GHSA-j3q9-mxjg-w52f
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.picomatch@2.3.1: 2 known vulnerabilitiesGHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.picomatch@4.0.3: 2 known vulnerabilitiesGHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.undici@7.15.0: 31 known vulnerabilitiesGHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-2mjp-6q6p-2qxm, GHSA-35p6-xmwp-9g52 +26 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.uuid@11.1.0: 1 known vulnerabilityGHSA-w5hq-g745-h8pq
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.uuid@9.0.1: 1 known vulnerabilityGHSA-w5hq-g745-h8pq
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.ws@8.18.3: 2 known vulnerabilitiesGHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.zod@3.25.76: 1 known vulnerabilityGHSA-mrhx-c7xc-m3w5
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@opentelemetry/core@1.25.1: 1 known vulnerabilityGHSA-8988-4f7v-96qf
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@protobufjs/utf8@1.1.0: 1 known vulnerabilityGHSA-q6x5-8v7m-xcrf
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.ajv@6.12.6: 1 known vulnerabilityGHSA-2g4f-4pwh-qvx6
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.ajv@8.17.1: 1 known vulnerabilityGHSA-2g4f-4pwh-qvx6
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.deepmerge@4.3.1: 1 known vulnerabilityGHSA-gcqx-w48m-w2h4
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.diff@7.0.0: 1 known vulnerabilityGHSA-73rr-hh4g-fpgx
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.qs@6.14.0: 5 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-6rw7-vpxm-498p, GHSA-q8mj-m7cp-5q26, GHSA-w7fw-mjwx-w883
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.No manifest declaring network access and environment variables (agent.json)
Network activity
During install
registry.npmjs.org
While running
No connections
Tools exposed (9)
mcpretentious-openOpens a new terminal window and creates a tracked terminal session. Returns a terminal ID that can be used with other commands.
mcpretentious-readReads text output from a terminal session. Returns the current screen contents. Use mcpretentious-screenshot for rich terminal info including colors, cursor position, and styles.
mcpretentious-screenshotTakes a token-optimized screenshot of the terminal screen using a layered format that reduces token usage by 85-98%. Returns only the data layers you need (text, cursor, colors, styles). Supports viewport limiting to show just a region or area around cursor. Essential for inspecting TUI applications
mcpretentious-closeCloses the terminal window associated with the specified terminal ID.
mcpretentious-listLists all currently open terminal sessions with their IDs.
mcpretentious-typeSend text and keystrokes to a terminal. Always pass as array. Examples: ["ls -la"], ["cd /path", {"key": "enter"}], ["Hello", 32, "World"], [{"key": "ctrl-c"}] Supported keys: tab, shift-tab, enter, return, escape, esc, backspace, delete, up, down, right, left, home, end, pageup, pagedown, ctrl-a,
mcpretentious-infoGets terminal metadata including dimensions (columns × rows) and session information.
mcpretentious-resizeResizes a terminal to the specified dimensions in columns × rows.
mcpretentious-mouseSend mouse events to a terminal using SGR mouse protocol. This tool provides direct control over mouse events following the terminal's SGR (Select Graphic Rendition) mouse protocol. EVENTS: - 'press': Mouse button press event - 'release': Mouse button release event -
Automated result for the commit shown. See our scan policy. View the scan log
Maintainers can claim the listing to rescan, or dispute a result.
MCPretentious alternatives
View more →Similar mcp servers in Coding Agents, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.
| Name | Stars | Licence | Last updated | Scan |
|---|---|---|---|---|
| MCPretentious (this page) oetiker | 22 | MIT | Feb 14, 2026 | Scanned, no flagged issues |
| Context Mode mksglu | 33k | None found | Nov 1, 2026 | Not scanned yet |
| Serena oraios | 31k | None found | Oct 28, 2026 | Not scanned yet |
| Fastmcp PrefectHQ | 28k | Apache-2.0 | Nov 1, 2026 | Scanned, no flagged issues |
| Nuclear nukeop | 19k | AGPL-3.0 | Nov 1, 2026 | Scanned, no flagged issues |
| MCP For Beginners microsoft | 18k | MIT | Oct 30, 2026 | Scanned, no flagged issues |