Case file No.110 · pypi · stdio

Ouroboros

io.github.Q00/ouroboros · v0.51.5

Pins an acceptance spec; the verify command and expected output never enter the success contract.

Package ↗GitHub ↗

Security score

94/100

Strong

Normalized over 100 points of available evidence.

Score breakdown

Known advisories34/40

0 affecting current version, 3 historical

Maintenance20/20

last push 0 days ago

Source transparency15/15

public repo, license MIT

Metadata stability15/15

0 risky metadata change(s) without a version bump

Adoption10/10

26134 weekly downloads

Known advisories

source: OSV.dev

GHSA-jv2h-4p9v-wf5wHIGHfixed / historical

ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys

CVE-2026-66065 · published Jun 19, 2026

GHSA-c4m7-2gwp-vw76HIGHfixed / historical

ouroboros-ai Vulnerable to Remote Code Execution via Untrusted Project-Directory .env

CVE-2026-47211 · PYSEC-2026-2857 · published May 29, 2026

Metadata change timeline

rug-pull detection

First snapshot (v0.51.5)Oct 16, 2026

No changes observed yet across 1 snapshot(s).

Tool lists: not published by the registry — unknown.

FAQ

auto-generated from the data above

Is Ouroboros safe?

MCPWatch gives Ouroboros a heuristic security score of 94/100 (strong), based on 100 points of available evidence. This is an automated heuristic, not an audit.

Does Ouroboros have known CVEs or vulnerabilities?

OSV.dev lists 2 unique advisories for ouroboros-ai (CVE-2026-66065, CVE-2026-47211). 0 affect the current version 0.51.5.

When was Ouroboros last updated?

The latest registry version is 0.51.5, published Aug 14, 2026. The last push to Q00/ouroboros was on Oct 20, 2026. MCPWatch last checked it on Oct 20, 2026.

What license does Ouroboros use?

GitHub reports the license of Q00/ouroboros as MIT.

Related servers

same publisher / similar score