{ "SchemaVersion": "1", "Kind": "DirectoryEntry", "SubjectType": "mcp-server", "Slug": "codecalc", "Name": "codecalc", "Title": "codecalc MCP Server | Pod", "Description": "Code & logic calculator for AI agents: run 31 languages, symbolic math, SMT logic, complexity.", "CanonicalUrl": "https://askpod.ai/mcp/codecalc", "MarkdownUrl": "https://askpod.ai/mcp/codecalc.md", "JsonUrl": "https://askpod.ai/mcp/codecalc.json", "DatePublished": "2026-08-31T23:50:54.202Z", "DateModified": "2026-08-31T23:50:54.202Z", "RegistryName": "io.github.The-40-Thieves/codecalc", "RepositoryUrl": "https://github.com/The-40-Thieves/codecalc", "VerificationStatus": "unverified", "Identities": [], "Sources": [ { "Source": "github_issues", "LastSeenAt": "2026-08-31T23:50:54.202Z" }, { "Source": "official_mcp_registry", "ExternalId": "io.github.The-40-Thieves/codecalc", "LastSeenAt": "2026-08-31T23:50:54.202Z" } ], "Categories": [], "FirstParty": false, "Deployments": [ { "Kind": "package", "PackageRegistry": "pypi", "PackageIdentifier": "codecalc", "ConfigSnippet": "{\n \"mcpServers\": {\n \"codecalc\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"codecalc\"\n ]\n }\n }\n}" } ], "Tools": { "Claimed": [], "ClaimedCount": 0, "Observed": null, "ObservedCount": null, "Verified": false, "Mismatch": null }, "Measured": null, "Usage": null, "Issues": [ { "Title": "gap: matrices are unreachable — the RCE screen denies `[` at token level, so list literals fall with subscript access", "Excerpt": "**Environment:** codecalc 0.3.1 from PyPI, macOS arm64, `[full]` (sympy 1.14.0 present).\n\nNot a feature request — the capability is already reachable through the tools you ship, and one line of the RCE screen removes it as a side effect. Worth separating those two things.\n\n**Everything else in SymPy's surface works through `evaluate_expression`:**\n\n```\ndiff(x**2, x) -> 2*x\nintegrate(x**2, x) -> x**3/3\nseries(sin(x), x, 0, 5) -> x - x**3/6 + O(x**5)\nexpand((x+1)**3) ", "SourceUrl": "https://github.com/The-40-Thieves/codecalc/issues/223", "PublishedAt": "2026-08-21T01:55:23.000Z", "State": "closed", "Comments": 0, "Reporter": "External", "Rank": "recent", "Extractor": "github_issue" }, { "Title": "contract: workspace-guard refusals bypass the result contract (no ok/code/remedy), and pydantic errors echo caller arguments unredacted", "Excerpt": "**Environment:** codecalc 0.3.1 from PyPI, macOS arm64, contract 1.2.0.\n\nRefusals leave the server by two different doors, and only one of them is the contract the README documents.\n\n**Door 1 — the contract**, which is the good one:\n\n```json\n{\"ok\": false, \"error\": \"...\", \"code\": \"validation\",\n \"remedy\": \"fix the arguments and retry; the message names the field\",\n \"contract_version\": \"1.2.0\"}\n```\n\n**Door 2 — an MCP protocol error**, `isError: true`, no `ok`, no `code`, no `remedy`, no `contract_v", "SourceUrl": "https://github.com/The-40-Thieves/codecalc/issues/212", "PublishedAt": "2026-08-20T22:10:21.000Z", "State": "closed", "Comments": 0, "Reporter": "External", "Rank": "recent", "Extractor": "github_issue" }, { "Title": "security: serve-http's DNS-rebinding protection is inherited from an SDK default, and codecalc's own loopback allowlist is wider than the one that enables it", "Excerpt": "**Environment:** codecalc 0.3.1 from PyPI, `mcp` 2.0.0, macOS arm64.\n\nI went looking for a DNS-rebinding hole in `serve-http` and did **not** find one on the documented default. It is worth saying why, because the protection is not yours — it is inherited from an SDK default that your own bind policy can step outside of.\n\n**Verified holding on `--host 127.0.0.1`** (live, no token set):\n\n```\nPOST /mcp Origin: https://evil.example -> 403 Invalid Origin header\nPOST /mcp Host: attacke", "SourceUrl": "https://github.com/The-40-Thieves/codecalc/issues/211", "PublishedAt": "2026-08-20T22:10:01.000Z", "State": "closed", "Comments": 0, "Reporter": "External", "Rank": "recent", "Extractor": "github_issue" }, { "Title": "security (low): session_files stats through symlinks that session_read_file refuses, leaking size/existence of paths outside the workspace", "Excerpt": "**Environment:** codecalc 0.3.1 from PyPI, macOS arm64, contract 1.2.0. Low severity — an existence/size oracle, not a read.\n\n`session_read_file` and the `codecalc://session//files/` resource both resolve symlinks before deciding, and both correctly refuse one that points outside the workspace. `session_files` does not: it stats through the link and publishes the target's size.\n\n```python\nsession_start(language=\"python\")\nsession_write_file(path=\"mk.py\", content='import os; os.symlink(\"", "SourceUrl": "https://github.com/The-40-Thieves/codecalc/issues/208", "PublishedAt": "2026-08-20T22:01:30.000Z", "State": "closed", "Comments": 0, "Reporter": "External", "Rank": "top", "Extractor": "github_issue" }, { "Title": "UX: `codecalc --help` and `--version` print nothing and exit 0 (they start the MCP server instead)", "Excerpt": "**Environment:** codecalc 0.3.1 from PyPI, macOS arm64, Python 3.14.0.\n\n```\n$ codecalc --help I suggest splitting these into separate PRs, but a few of them can be grouped.\n> - **Installation UX & Onboarding: It", "SourceUrl": "https://github.com/The-40-Thieves/codecalc/issues/88", "PublishedAt": "2026-08-09T16:23:04.000Z", "State": "closed", "Comments": 3, "Reporter": "External", "Rank": "top", "Extractor": "github_issue" }, { "Title": "security: extend the guarded-evaluation bound to the remaining SymPy entry points", "Excerpt": "Follow-up to #78, which put `evaluate_expression` behind a killable child. Filed explicitly rather than left in a commit message, because the remainder is most of the surface.\n\n## What is guarded, and what is not\n\n| function | file | guarded? |\n|---|---|---|\n| `evaluate_expression` | logic.py | **yes** (#78) |\n| `solve_linear` | logic.py | no |\n| `simplify_expression` | exact.py | no |\n| `solve_expression` | exact.py | no |\n| `limit_expression` | exact.py | no |\n| `algebraic_equiv` | exact.py | ", "SourceUrl": "https://github.com/The-40-Thieves/codecalc/issues/84", "PublishedAt": "2026-08-09T14:50:54.000Z", "State": "closed", "Comments": 0, "Reporter": "Contributor", "Rank": "recent", "Extractor": "github_issue" }, { "Title": "security: run SymPy where it can be killed, rather than trusting a pre-screen", "Excerpt": "The remaining piece of #67. Filed late — the #76 commit body said this was \"filed separately\" when it was not; that is corrected here rather than left to read as done.\n\n## Why a screen is not the end state\n\n#76 bounds the shapes **known** to explode (power towers, symbolic exponents, oversized arguments to heavy functions) and #77 documents that `safe_expr.py` screens for reach. Both are denylists, and a denylist is a bet that the list is complete.\n\nUpstream has already made and lost that bet. S", "SourceUrl": "https://github.com/The-40-Thieves/codecalc/issues/78", "PublishedAt": "2026-08-09T11:46:28.000Z", "State": "closed", "Comments": 0, "Reporter": "Contributor", "Rank": "recent", "Extractor": "github_issue" }, { "Title": "security: `update_runtimes(apply=True)` invokes sudo with no operator confirmation gate", "Excerpt": "## what is reachable\n\n`update_runtimes` is an `@mcp.tool()` (server.py:394), so any model connected to\nthe server can call it. With `apply=True` the manager commands run as a\nsubprocess from the server process, runtimes.py:436:\n\n```python\nrun = _run(cmd, timeout=timeout)\n```\n\nOne of those commands is elevated, runtimes.py:298:\n\n```python\nUPDATE_COMMANDS: dict[str, list[str]] = {\n \"mise\": [\"mise\", \"up\"],\n \"rustup\": [\"rustup\", \"update\"],\n \"swiftly\": [\"swiftly\", \"update\"],\n \"apt\": [\"sud", "SourceUrl": "https://github.com/The-40-Thieves/codecalc/issues/63", "PublishedAt": "2026-08-09T07:45:52.000Z", "State": "closed", "Comments": 0, "Reporter": "External", "Rank": "top", "Extractor": "github_issue" }, { "Title": "security: `execute_code_stream` cannot apply the memory or CPU ceilings `execute_code` declares", "Excerpt": "## what differs\n\n`execute_code` (server.py:102) takes four ceilings and forwards all of them:\n\n```python\ndef execute_code(language, code, stdin=\"\", timeout=10, session_id=None,\n max_memory_mb=0, max_output_kb=0, max_cpu=0, no_net=False,\n compact=False):\n timeout = min(timeout, 120)\n```\n\n`execute_code_stream` (server.py:212) takes two:\n\n```python\nasync def execute_code_stream(language, code, stdin=\"\", timeout=30,\n max_output_kb=0, no", "SourceUrl": "https://github.com/The-40-Thieves/codecalc/issues/61", "PublishedAt": "2026-08-09T07:43:55.000Z", "State": "closed", "Comments": 0, "Reporter": "External", "Rank": "top", "Extractor": "github_issue" }, { "Title": "bug: non-finite and deeply nested inputs escape as unhandled exceptions", "Excerpt": "## Problem\n\nSeveral tools convert incoming numbers with `Fraction()` or `int()` without screening for non-finite values, so a `nan` or `inf` in the input raises out of the tool instead of returning `{\"ok\": False, \"error\": ...}`.\n\nPer [codecalc/mcp_middleware.py#L98-L102](https://github.com/The-40-Thieves/codecalc/blob/e26fa15ba403f3d7599938bdca42ad163294895a/codecalc/mcp_middleware.py#L98-L102), any exception other than `MCPError` is flattened by the dispatcher to \"Internal server error\" with no", "SourceUrl": "https://github.com/The-40-Thieves/codecalc/issues/36", "PublishedAt": "2026-08-09T03:39:09.000Z", "State": "closed", "Comments": 0, "Reporter": "External", "Rank": "top", "Extractor": "github_issue" }, { "Title": "bug: calc_exact has no bound on exponentiation and leaks ValueError to the caller", "Excerpt": "## Problem\n\n`calc_exact` evaluates `**` with no bound on the operand or result size, and is not covered by the response-deadline table.\n\nRelevant code:\n- [codecalc/exact.py#L72-L91](https://github.com/The-40-Thieves/codecalc/blob/e26fa15ba403f3d7599938bdca42ad163294895a/codecalc/exact.py#L72-L91) - `_int_op` handles `**` with no magnitude guard\n- [codecalc/exact.py#L156](https://github.com/The-40-Thieves/codecalc/blob/e26fa15ba403f3d7599938bdca42ad163294895a/codecalc/exact.py#L156) - `eval_exact", "SourceUrl": "https://github.com/The-40-Thieves/codecalc/issues/32", "PublishedAt": "2026-08-09T03:38:58.000Z", "State": "closed", "Comments": 0, "Reporter": "External", "Rank": "top", "Extractor": "github_issue" }, { "Title": "security: sandbox package installation before exposing install_package", "Excerpt": "## Problem\n\n`install_package` launches package managers directly from the MCP server process. The working directory is scoped to a session, but the installer process itself is not confined.\n\nRelevant code:\n- [codecalc/packages.py#L33-L36](https://github.com/The-40-Thieves/codecalc/blob/e26fa15ba403f3d7599938bdca42ad163294895a/codecalc/packages.py#L33-L36)\n- [codecalc/packages.py#L115-L123](https://github.com/The-40-Thieves/codecalc/blob/e26fa15ba403f3d7599938bdca42ad163294895a/codecalc/packages.", "SourceUrl": "https://github.com/The-40-Thieves/codecalc/issues/23", "PublishedAt": "2026-08-09T03:14:16.000Z", "State": "closed", "Comments": 2, "Reporter": "Contributor", "Rank": "top", "Extractor": "github_issue" } ], "Observations": [], "ObservationCount": 0, "Related": [], "Indexable": true, "ContentMarkdown": "# codecalc MCP Server\n\nCode & logic calculator for AI agents: run 31 languages, symbolic math, SMT logic, complexity.\n\n**Publisher claimed.** No tool list reported, and Pod has not connected to this server.\n\n## Status\n\nPod has not dialled codecalc yet, so everything on this page is what its publisher reported rather than what we observed. Registries describe servers; they do not connect to them. Until a check runs, treat the tool list below as a claim.\n\n## Connect\n\nPublished as `codecalc` on pypi. Runs locally.\n\n## Known issues\n\n**14 problems reported by people outside the maintainer team.** Issues filed by the project's own owners, members and collaborators are excluded — those are release checklists and internal refactors, not things that will go wrong for you. Showing 11.\n\n### Most discussed\n\n### security (low): session_files stats through symlinks that session_read_file refuses, leaking size/existence of paths outside the workspace\n\n**Environment:** codecalc 0.3.1 from PyPI, macOS arm64, contract 1.2.0. Low severity — an existence/size oracle, not a read.\n\n`session_read_file` and the `codecalc://session//files/` resource both resolve symlinks before deciding, and both correctly refuse one that points outside the workspace. `session_files` does not: it stats through the link and publishes the target's size.\n\n```python\nsession_start(language=\"python\")\nsession_write_file(path=\"mk.py\", content='import os; os.symlink(\"\n\n[Read the thread](https://github.com/The-40-Thieves/codecalc/issues/208) · 2026-08-20 · closed · external user · 0 comments\n\n### bug: argument rejections across 7 tools return code `internal` and tell the caller to report a defect\n\n**Environment:** codecalc 0.3.1 from PyPI (`uv tool install 'codecalc[full]'`), macOS arm64, Python 3.14.0, backend `rust`, contract 1.2.0.\n\nEvery one of these is a **rejected argument**, and every one of them comes back telling the caller that codecalc is broken and to report it verbatim:\n\n| call | `error` | `code` |\n|---|---|---|\n| `percentage(part=\"50\", total=\"0\")` | `total is zero` | `internal` |\n| `percentiles(nums=[])` | `need at least 1 number` | `internal` |\n| `calc_stats(nums=[5])` | `n\n\n[Read the thread](https://github.com/The-40-Thieves/codecalc/issues/196) · 2026-08-20 · closed · external user · 1 comment\n\n### enhancement: Improved Installation UX\n\n# Installation UX - assessment and suggestions\n\nThis enhancement is more of a nice-to-have than a need, primarily taking into account average user experience with a forward-looking perspective - when the project is noticed and gains in popularity a smoother install/setup experience makes life a tad bit easier for maintainers as well as end users.\n\n## High-Leverage Improvements\n\n> I suggest splitting these into separate PRs, but a few of them can be grouped.\n> - **Installation UX & Onboarding: It\n\n[Read the thread](https://github.com/The-40-Thieves/codecalc/issues/88) · 2026-08-09 · closed · external user · 3 comments\n\n### security: `update_runtimes(apply=True)` invokes sudo with no operator confirmation gate\n\n## what is reachable\n\n`update_runtimes` is an `@mcp.tool()` (server.py:394), so any model connected to\nthe server can call it. With `apply=True` the manager commands run as a\nsubprocess from the server process, runtimes.py:436:\n\n```python\nrun = _run(cmd, timeout=timeout)\n```\n\nOne of those commands is elevated, runtimes.py:298:\n\n```python\nUPDATE_COMMANDS: dict[str, list[str]] = {\n \"mise\": [\"mise\", \"up\"],\n \"rustup\": [\"rustup\", \"update\"],\n \"swiftly\": [\"swiftly\", \"update\"],\n \"apt\": [\"sud\n\n[Read the thread](https://github.com/The-40-Thieves/codecalc/issues/63) · 2026-08-09 · closed · external user · 0 comments\n\n### security: `execute_code_stream` cannot apply the memory or CPU ceilings `execute_code` declares\n\n## what differs\n\n`execute_code` (server.py:102) takes four ceilings and forwards all of them:\n\n```python\ndef execute_code(language, code, stdin=\"\", timeout=10, session_id=None,\n max_memory_mb=0, max_output_kb=0, max_cpu=0, no_net=False,\n compact=False):\n timeout = min(timeout, 120)\n```\n\n`execute_code_stream` (server.py:212) takes two:\n\n```python\nasync def execute_code_stream(language, code, stdin=\"\", timeout=30,\n max_output_kb=0, no\n\n[Read the thread](https://github.com/The-40-Thieves/codecalc/issues/61) · 2026-08-09 · closed · external user · 0 comments\n\n### Most recent\n\n### gap: matrices are unreachable — the RCE screen denies `[` at token level, so list literals fall with subscript access\n\n**Environment:** codecalc 0.3.1 from PyPI, macOS arm64, `[full]` (sympy 1.14.0 present).\n\nNot a feature request — the capability is already reachable through the tools you ship, and one line of the RCE screen removes it as a side effect. Worth separating those two things.\n\n**Everything else in SymPy's surface works through `evaluate_expression`:**\n\n```\ndiff(x**2, x) -> 2*x\nintegrate(x**2, x) -> x**3/3\nseries(sin(x), x, 0, 5) -> x - x**3/6 + O(x**5)\nexpand((x+1)**3) \n\n[Read the thread](https://github.com/The-40-Thieves/codecalc/issues/223) · 2026-08-21 · closed · external user · 0 comments\n\n### contract: workspace-guard refusals bypass the result contract (no ok/code/remedy), and pydantic errors echo caller arguments unredacted\n\n**Environment:** codecalc 0.3.1 from PyPI, macOS arm64, contract 1.2.0.\n\nRefusals leave the server by two different doors, and only one of them is the contract the README documents.\n\n**Door 1 — the contract**, which is the good one:\n\n```json\n{\"ok\": false, \"error\": \"...\", \"code\": \"validation\",\n \"remedy\": \"fix the arguments and retry; the message names the field\",\n \"contract_version\": \"1.2.0\"}\n```\n\n**Door 2 — an MCP protocol error**, `isError: true`, no `ok`, no `code`, no `remedy`, no `contract_v\n\n[Read the thread](https://github.com/The-40-Thieves/codecalc/issues/212) · 2026-08-20 · closed · external user · 0 comments\n\n### security: serve-http's DNS-rebinding protection is inherited from an SDK default, and codecalc's own loopback allowlist is wider than the one that enables it\n\n**Environment:** codecalc 0.3.1 from PyPI, `mcp` 2.0.0, macOS arm64.\n\nI went looking for a DNS-rebinding hole in `serve-http` and did **not** find one on the documented default. It is worth saying why, because the protection is not yours — it is inherited from an SDK default that your own bind policy can step outside of.\n\n**Verified holding on `--host 127.0.0.1`** (live, no token set):\n\n```\nPOST /mcp Origin: https://evil.example -> 403 Invalid Origin header\nPOST /mcp Host: attacke\n\n[Read the thread](https://github.com/The-40-Thieves/codecalc/issues/211) · 2026-08-20 · closed · external user · 0 comments\n\n### UX: `codecalc --help` and `--version` print nothing and exit 0 (they start the MCP server instead)\n\n**Environment:** codecalc 0.3.1 from PyPI, macOS arm64, Python 3.14.0.\n\n```\n$ codecalc --help