Free · no account · the package name is all we need

Before you give that MCP your token.

You are about to connect an agent to GitHub, a database, a deployment tool. The server will want a credential. Bring the MCP you want to use, not your credentials: this page says what it will ask for, where it sends it, what it actually did when we ran it with a decoy, and what we could not test.

server-github@2025.4.8

71 · Cautionnpm · modelcontextprotocol · full verdict

Before you give it your token

Code inventory arrives with this version's next honeypot run.
It will ask for
unknown until the next run
Where it talks to
unknown until the next run
What the honeypot saw
nothing has run yet
What we could not test
everything: the server has not run yet

Run it before you trust it. Nothing has run yet: the code was read, the server was not. `vet-skills try` runs this exact version in the honeypot in about a minute.

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Static findings, the full behavior trace, the tool list and its cost to the agent are on the verdict page. To check a version you have not published yet, or a private server: npx -y vet-skills try ./path.

Where the answers come from"It will ask for" and "where it talks to" are read from the code: every environment variable, flag and hard-coded host. "What the honeypot saw" is the run: the server launched with planted decoy credentials and a recording proxy, and relaunched with a decoy in the variable it asked for. "What we could not test" is the gap between the two.
What never happens hereWe never ask for your credential and never need it. When a server needs one, the recommendation gives it to the guard on your machine, which injects it only into requests to the host you bind and refuses the rest. Nothing of yours is uploaded.
Then keep it that wayThe same check runs on every install your agent makes, automatically: npx -y vet-skills hook install. Updates that add a host, a credential or a tool are the next thing we are building; tell us if you want it first.