Announcing Beacon: Self-improving memory for coding agents
← All MCP servers
MCP server

TopicForge

mcp:yaniswav/topicforge

Read-only MCP server for ROS2 and DDS: topics, participants, QoS mismatches, bags.

Verdict
No issues found

No suspicious or malicious behavior was found.

Analyzed Oct 26, 2026, 13:31 UTC at a2a2011

Dispute security verdict

If you believe this verdict is incorrect, submit a dispute and we'll review it.

0
findings
—
highest severity
0
threat classes
443
files scanned
2,378/2,378
checks satisfied
0
package advisories

Why this verdict

mcp-server . No issues found
  • benign: 2135 checks satisfied, no findings for mcp-server:.
plugin plugin No issues found
  • benign: 189 checks satisfied, no findings for plugin:plugin
skill plugin/skills/diagnose-dds-bus No issues found
  • benign: 23 checks satisfied, no findings for skill:plugin/skills/diagnose-dds-bus
skill plugin/skills/diagnose-nav2 No issues found
  • benign: 14 checks satisfied, no findings for skill:plugin/skills/diagnose-nav2
skill plugin/skills/inspect-ros2-robot No issues found
  • benign: 17 checks satisfied, no findings for skill:plugin/skills/inspect-ros2-robot

Security findings 0

No security findings

No suspicious or malicious behavior was found; 1 candidate finding was refuted on review.

Execution chain 71

What it calls, runs, installs, reads and writes, with the line that does it.

GitHub repositories 21

eclipse-cyclonedds/cyclonedds-python
eprosima/fast-dds-python
yaniswav/topicforge
yaniswav/topicforge
yaniswav/topicforge
yaniswav/topicforge
yaniswav/topicforge
yaniswav/topicforge
yaniswav/topicforge
yaniswav/topicforge
yaniswav/topicforge
yaniswav/topicforge

Packages 3

pypi:topicforge
pypi:topicforge[dds]
pypi:topicforge@0.8.1
server.json:15 · launch:server.json

URLs 31

http://www.eprosima.com/XMLSchemas/fastRTPS_Profiles
https://cyclonedds.io/docs/cyclonedds/latest/config/config_file_reference.html
https://design.ros2.org/articles/qos_configurability.html
https://fast-dds.docs.eprosima.com/en/latest/fastdds/xml_configuration/
https://github.com/eclipse-cyclonedds/cyclonedds-python
https://github.com/eProsima/Fast-DDS-docs/blob/2.14.x/code/XMLTesterExample.xml
https://github.com/eProsima/Fast-DDS-python
https://github.com/eProsima/Fast-DDS/blob/2.14.x/resources/xsd/fastRTPS_profiles.xsd
https://github.com/eProsima/Fast-DDS/blob/2.6.x/src/cpp/rtps/xmlparser/XMLElementParser.cpp
https://github.com/ros2/rclcpp/blob/jazzy/rclcpp/include/rclcpp/detail/qos_parameters.hpp
https://github.com/ros2/rclcpp/blob/jazzy/rclcpp/src/rclcpp/qos_overriding_options.cpp
https://github.com/ros2/rclpy/blob/jazzy/rclpy/rclpy/qos_overriding_options.py
https://github.com/ros2/rmw_fastrtps/blob/jazzy/README.md
https://github.com/ros2/rmw_fastrtps/blob/jazzy/rmw_fastrtps_shared_cpp/src/qos.cpp
https://github.com/ros2/rmw/blob/jazzy/rmw/src/qos_string_conversions.c
https://github.com/yaniswav/TopicForge
https://github.com/yaniswav/TopicForge
https://github.com/yaniswav/TopicForge
https://github.com/yaniswav/TopicForge
https://github.com/yaniswav/TopicForge/blob/main/CHANGELOG.md
https://github.com/yaniswav/TopicForge/issues
https://github.com/yaniswav/TopicForge/issues
https://github.com/yaniswav/TopicForge/issues
https://github.com/yaniswav/TopicForge#readme
https://github.com/yaniswav/TopicForge#readme
https://glama.ai/mcp/schemas/server.json
https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json
https://topicforge.horizonvista.xyz
https://topicforge.horizonvista.xyz
https://topicforge.horizonvista.xyz

Linked repositories 8

GitHub repositories it links to or installs from, and whether their names can be taken over.

eprosima/fast-dds
url · not tracked
eprosima/fast-dds-docs
url · not tracked
eprosima/fast-dds-python
url · not tracked
ros2/rclcpp
url · not tracked
ros2/rclpy
url · not tracked
ros2/rmw
url · not tracked
ros2/rmw_fastrtps
url · not tracked
Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Reconnaissance

lowRefutedlow confidence

The get_node_info params_file argument is only checked for a .yaml/.yml suffix, so the server reads any such file on the host and returns a comparison against the node's parameters; this is a limited arbitrary-YAML read, but it is the tool's documented purpose and has no network sink.

with target.open("rb") as handle:
Why it was refuted

Reading a user-supplied YAML parameter file to compare it with a node's parameters is the documented purpose of get_node_info(params_file=...). It is openly declared as the tool's only file access, read-only, capped at 1 MiB, and restricted to .yaml/.yml. There is no network sink or concealed behavior, so this falls under the declared core capability.

Coverage gaps 1

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary binary content is only byte-scanned
tests/fixtures/bags/omnisim_humble/omnisim_husky_topicforge_20261002_190546_0.db3