mapbox-devkit@0.10.0
VERIFIED· install onlyPublisher claims: "Direct access to Mapbox developer APIs for AI assistants. Enables style management, token management, GeoJSON preview, and other developer tools for building Mapbox applications." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry Docker MCP CatalogPublisher mapbox · publishing for 520 daysInstalls 15,170Last detonated 46 h ago
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
MAPBOX_ACCESS_TOKENConfiguration, not credentials: ENABLE_MCP_UI, MAPBOX_API_ENDPOINT, OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_HEADERS, OTEL_LOG_LEVEL, OTEL_SERVICE_NAME, OTEL_TRACING_ENABLED, VITEST- Where it talks to
- mapbox.com (its own)Also geojson.io — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- use of the skill by an agent
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names geojson.io as well as its own vendor. The guard injects MAPBOX_ACCESS_TOKEN only into requests to mapbox.com (and its subdomains) and refuses the rest.
$vet-skills run --secrets MAPBOX_ACCESS_TOKEN=mapbox.com -- docker run -i --rm mcp/mapbox-devkit
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 83/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.1sprocesssecond launch, clock +45 days, CI unset
Static findings
HIGH
Access to sensitive file pathspackage.json:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…y": "node -e \"console.log('🔍 Verifying tracing setup with Jaeger...\\n1. Copy .env.example to .env and add your MAPBOX_ACCESS_TOKEN\\n2. Start Jaeger: npm run tra…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/index.ts:36 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// Read and parse .env file using Node.js built-in parseEnvFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packageskills/README.md:13 · npx invocation of non-well-known package — may execute untrusted code
AST06npx add-skill mapbox/mapbox-agent-skillsFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageskills/README.md:16 · npx invocation of non-well-known package — may execute untrusted code
AST06npx add-skill mapbox/mapbox-agent-skills --skill mapbox-web-performance-patternsFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathssrc/index.ts:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// Load .env from current working directory (where npm run is executed)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/prompts/SetupMapboxProjectPrompt.ts:248 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST051. Store in environment variables (.env file)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/prompts/SetupMapboxProjectPrompt.ts:249 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST052. Add .env to .gitignoreFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/index.ts:134 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// Record .env loading as a span (retrospectively since it happened before tracing init)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagepackage.json:20 · npx invocation of non-well-known package — may execute untrusted code
AST06"inspect:dev": "npx @modelcontextprotocol/inspector -e MAPBOX_ACCESS_TOKEN=\"$MAPBOX_ACCESS_TOKEN\" npx -y tsx src/index.ts",Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathssrc/index.ts:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const envPath = join(process.cwd(), '.env');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/index.ts:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// Load environment variables from .env file if presentFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packageskills/README.md:17 · npx invocation of non-well-known package — may execute untrusted code
AST06npx add-skill mapbox/mapbox-agent-skills --skill mapbox-token-securityFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Unicode escape sequence detectedsrc/constants/mapboxStreetsV8Fields.ts:2452 · Unicode escape sequence detected — may contain obfuscated payloads
AST07'\u653f\u5e9c\u529e\u516c\u5927\u697c',Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
npx invocation of non-well-known packageskills/README.md:18 · npx invocation of non-well-known package — may execute untrusted code
AST06npx add-skill mapbox/mapbox-agent-skills --skill mapbox-cartographyFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Unicode escape sequence detectedsrc/constants/mapboxStreetsV8Fields.ts:2463 · Unicode escape sequence detected — may contain obfuscated payloads
AST07'\u793e\u4f1a\u670d\u52a1\u8bbe\u65bd',Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
npx invocation of non-well-known packageskills/README.md:78 · npx invocation of non-well-known package — may execute untrusted code
AST06- ✅ **Better discoverability**: Easier to find and install via `npx add-skill`Fix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Instructions loaded
≈37 tok
1 file · 81 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.