azure@r1

CAUTION

Publisher claims: "The Azure MCP Server, bringing the power of Azure to your agents." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry Docker MCP CatalogPublisher microsoft · joined 4 days agoInstalls 74,185Last detonated 1 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.1sprocessscript backend runs setup only

Static findings

CRITICAL

Access to sensitive file pathseng/common/scripts/eval/build-eval-summary.ts:414 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathseng/common/TestResources/README.md:39 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathseng/common/scripts/eval/build-eval-summary.ts:365 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathseng/common/TestResources/README.md:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathseng/common/scripts/eval/build-eval-summary.ts:430 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

HTML comment carrying imperative instructions to the agentservers/Azure.Mcp.Server/README.md:76 · HTML comment carrying imperative instructions to the agent

AST01

CRITICAL

Access to sensitive file pathseng/tools/ToolDescriptionEvaluator/README.md:26 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

HTML comment carrying imperative instructions to the agentservers/Azure.Mcp.Server/README.md:100 · HTML comment carrying imperative instructions to the agent

AST01

CRITICAL

Access to sensitive file pathseng/tools/ToolDescriptionEvaluator/README.md:214 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsservers/Azure.Mcp.Server/README.md:829 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathseng/common/scripts/eval/lib/shard-results.ts:262 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsservers/Azure.Mcp.Server/README.md:819 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsservers/Azure.Mcp.Server/README.md:291 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathseng/tools/ToolDescriptionEvaluator/README.md:222 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathseng/common/scripts/eval/test/shard-results.test.ts:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathseng/tools/ToolDescriptionEvaluator/README.md:219 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

HTML comment carrying imperative instructions to the agentservers/Fabric.Mcp.Server/README.md:74 · HTML comment carrying imperative instructions to the agent

AST01

CRITICAL

Access to sensitive file pathsservers/Azure.Mcp.Server/vscode/src/extension.ts:74 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packageeng/README.md:158 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsservers/Fabric.Mcp.Server/vscode/src/extension.ts:137 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packageeng/README.md:168 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsservers/Azure.Mcp.Server/vscode/src/extension.ts:118 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Outbound HTTP to raw IP address.github/skills/harden-tool-url-inputs/SKILL.md:293 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Cross-server tool reference.github/agents/onboarding.agent.md:156 · Cross-server tool reference — agent may chain tools across untrusted MCP servers

AST04

HIGH

npx invocation of non-well-known package.github/agents/onboarding.agent.md:78 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsservers/Template.Mcp.Server/vscode/src/extension.ts:137 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsservers/Fabric.Mcp.Server/vscode/src/extension.ts:96 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsservers/Template.Mcp.Server/vscode/src/extension.ts:96 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsservers/Azure.Mcp.Server/README.md:841 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Outbound HTTP to raw IP address.github/skills/harden-tool-url-inputs/SKILL.md:287 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

npx invocation of non-well-known packageservers/Azure.Mcp.Server/README.md:234 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageeng/README.md:229 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Cross-server tool referenceeng/tools/ToolDescriptionEvaluator/README.md:63 · Cross-server tool reference — agent may chain tools across untrusted MCP servers

AST04

HIGH

URL with embedded credentialseng/common/scripts/eval/test/shard-results.test.ts:568 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

File permission modification commandeng/pypi/README.md:184 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

npx invocation of non-well-known packageeng/tools/CopilotCliTester/README.md:79 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

False authorization claimservers/Fabric.Mcp.Server/README.md:274 · False authorization claim — impersonating privileged role

AST01

HIGH

npx invocation of non-well-known packageservers/Fabric.Mcp.Server/README.md:152 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Coercive compliance languageservers/Fabric.Mcp.Server/README.md:855 · Coercive compliance language

AST01

HIGH

npx invocation of non-well-known packageservers/Azure.Mcp.Server/README.md:373 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageservers/Azure.Mcp.Server/README.md:374 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageservers/Azure.Mcp.Server/README.md:334 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

False authorization claimservers/Fabric.Mcp.Server/README.md:259 · False authorization claim — impersonating privileged role

AST01

HIGH

Authorization escalation languageservers/Fabric.Mcp.Server/README.md:668 · Authorization escalation language

AST01

HIGH

Authorization escalation languageservers/Fabric.Mcp.Server/README.md:430 · Authorization escalation language

AST01

HIGH

Coercive compliance languageservers/Azure.Mcp.Server/README.md:1572 · Coercive compliance language

AST01

HIGH

Authorization escalation languageservers/Fabric.Mcp.Server/README.md:419 · Authorization escalation language

AST01

HIGH

npx invocation of non-well-known packageservers/Azure.Mcp.Server/README.md:314 · npx invocation of non-well-known package — may execute untrusted code

AST06

MEDIUM

File type combined with upload actioneng/common/scripts/eval/lib/shard-results.ts:252 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

URL using raw IP address.github/skills/harden-tool-url-inputs/SKILL.md:293 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

File type combined with upload actioneng/common/scripts/eval/build-eval-summary.ts:415 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

URL using raw IP address.github/skills/harden-tool-url-inputs/SKILL.md:287 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

File type combined with upload actioneng/README.md:149 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

File type combined with upload actioneng/common/scripts/eval/build-eval-summary.ts:398 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)README.md:212 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

MEDIUM

MCP server using network transport (SSE/HTTP)README.md:85 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

MEDIUM

MCP server using network transport (SSE/HTTP)README.md:152 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

MEDIUM

File type combined with upload actioneng/common/TestResources/README.md:90 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)README.md:46 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

MEDIUM

File type combined with upload actioneng/README.md:142 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)README.md:148 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

MEDIUM

MCP server using network transport (SSE/HTTP)servers/Azure.Mcp.Server/README.md:900 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

MEDIUM

File type combined with upload actionservers/Fabric.Mcp.Server/README.md:191 · File type combined with upload action — agent may exfiltrate local data files

AST07

LOW

Unpinned dependencyservers/Azure.Mcp.Server/README.md:696 · Unpinned dependency

AST06

MEDIUM

MCP server using network transport (SSE/HTTP)servers/Azure.Mcp.Server/README.md:14 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

LOW

Unpinned dependencyservers/Azure.Mcp.Server/README.md:724 · Unpinned dependency

AST06

MEDIUM

MCP server using network transport (SSE/HTTP)servers/Fabric.Mcp.Server/README.md:10 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

LOW

Unpinned dependencyservers/Azure.Mcp.Server/README.md:377 · Unpinned dependency

AST06