Skills/Docker MCP Catalog/keboola-mcp

keboola-mcp@1.119.0

CAUTION· not started

Publisher claims: "Keboola MCP Server is an open-source bridge between your Keboola project and modern AI tools." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry Docker MCP CatalogPublisher keboola · publishing for 134 daysInstalls 14,524Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
KBC_KUBERNETES_TOKEN_PATHKEBOOLA_MCP_SERVER_OAUTH_LOG_ALL or --storage-token / --show-tokenConfiguration, not credentials: APP_ENV, APP_VERSION, GITHUB_SHA, HOSTNAME_SUFFIX, KBC_PKCE_CLIENT_ID, KBC_STORAGE_API_URL, LOG_CONFIG
Where it talks to
no vendor host named in the codeAlso keboola.com, gofastmcp.com, claude.ai, chatgpt.com, cursor.com, evil.example — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names keboola.com, gofastmcp.com, claude.ai, chatgpt.com, cursor.com, evil.example as well as its own vendor. The guard injects KBC_KUBERNETES_TOKEN_PATH, KEBOOLA_MCP_SERVER_OAUTH_LOG_ALL only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- docker run -i --rm mcp/keboola-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-11 and scored it 78/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Privileged sudo command; Privileged sudo command; URL with embedded credentials. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

HIGH
Privileged sudo commandsrc/keboola_mcp_server/auth_login.py:323 · Privileged sudo command — agent may execute with elevated privileges"""Leases a PAT: introspect (or use the caller's explicit ``project_ids``) → sudo (MFA) →Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/keboola_mcp_server/authorization.py:29 · MCP server using network transport (SSE/HTTP) — data sent over networkfrom keboola_mcp_server.mcp import get_http_request_or_none, is_read_only_tool, is_strict_workspace_scopeFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Process kill commandsrc/keboola_mcp_server/workspace.py:343 · Process kill command — agent can terminate processes# Best-effort: a failed progress notification must not kill the running query.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/keboola_mcp_server/cli.py:324 · MCP server using network transport (SSE/HTTP) — data sent over networkhttp_app: StarletteWithLifespan = mcp_server.http_app(Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)src/keboola_mcp_server/tools/sql.py:30 · MCP server using network transport (SSE/HTTP) — data sent over networkfrom keboola_mcp_server.mcp import get_http_request_or_noneFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Privileged sudo commandsrc/keboola_mcp_server/cli.py:476 · Privileged sudo command — agent may execute with elevated privileges(sudo with the MFA code → create PAT) and prints it.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
URL with embedded credentialssrc/keboola_mcp_server/tools/data_apps.py:741 · URL with embedded credentials — may be phishing or credential leaking'`https://kai:<secret>@<host>/<path>.git`). Pass directly to `git clone`.'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Privileged sudo commandsrc/keboola_mcp_server/cli.py:141 · Privileged sudo command — agent may execute with elevated privilegeshelp='TOTP MFA code for the sudo elevation (--pat). Visible in shell history/`ps` for the 'Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/keboola_mcp_server/oauth.py:1301 · MCP server using network transport (SSE/HTTP) — data sent over networkself._own_resources = [urljoin(mcp_server_url, own_path + path) for path in ('', _MCP_PATH, '/sse')]Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)src/keboola_mcp_server/errors.py:30 · MCP server using network transport (SSE/HTTP) — data sent over networkfrom keboola_mcp_server.mcp import CONVERSATION_ID, AggregateError, ServerState, get_http_request_or_noneFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)src/keboola_mcp_server/cli.py:753 · MCP server using network transport (SSE/HTTP) — data sent over networkmcp_server, app = create_http_app(config, stateless_http=parsed_args.stateless_http)Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)src/keboola_mcp_server/cli.py:259 · MCP server using network transport (SSE/HTTP) — data sent over networkdef create_anonymous_app(mcp_server: FastMCP, *, config: Config, stateless_http: bool) -> StarletteWithLifespan | None:Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)src/keboola_mcp_server/cli.py:366 · MCP server using network transport (SSE/HTTP) — data sent over networkanonymous_app=create_anonymous_app(mcp_server, config=config, stateless_http=stateless_http),Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)src/keboola_mcp_server/server.py:43 · MCP server using network transport (SSE/HTTP) — data sent over networkfrom keboola_mcp_server.session_store.repository import PostgresSessionStoreFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Privileged sudo commandsrc/keboola_mcp_server/cli.py:147 · Privileged sudo command — agent may execute with elevated privilegeshelp='Recovery MFA code for the sudo elevation (--pat); alternative to --totp. Single-use and 'Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈6,725 tok
6 files · 79 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

2 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim keboola: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
  5. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to Docker MCP Catalog, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim keboolaPropose a patch to the maintainer