Skills/Docker MCP Catalog/mapbox

mapbox@0.18.0

VERIFIED· install only

Publisher claims: "Transform any AI agent into a geospatially-aware system with Mapbox APIs. Provides geocoding, POI search, routing, travel time matrices, isochrones, and static map generation." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry Docker MCP CatalogPublisher mapbox · publishing for 520 daysInstalls 36,508Last detonated 46 h ago
$docker run -i --rm mcp/mapbox
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
MAPBOX_ACCESS_TOKENMAPBOX_PUBLIC_TOKENConfiguration, not credentials: CLIENT_NEEDS_RESOURCE_FALLBACK, MAPBOX_API_ENDPOINT, OTEL_EXPORTER_CONSOLE_ENABLED, OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_HEADERS, OTEL_LOG_LEVEL, OTEL_SERVICE_NAME, OTEL_TRACING_ENABLED, VITEST
Where it talks to
mapbox.com (its own)
What the honeypot saw
no credential files read · no network
What we could not test
use of the skill by an agent

Connect it with a scoped credential, under the guard. It asks for MAPBOX_ACCESS_TOKEN, MAPBOX_PUBLIC_TOKEN and talks to mapbox.com. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --secrets MAPBOX_ACCESS_TOKEN=mapbox.com,MAPBOX_PUBLIC_TOKEN=mapbox.com -- docker run -i --rm mcp/mapbox

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 82/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.1sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only
0.2sprocesssecond launch, clock +45 days, CI unset

Static findings

HIGH
Access to sensitive file pathssrc/index.ts:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Load environment variables from .env file if presentFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/index.ts:233 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Record .env loading as a span (retrospectively since it happened before tracing init)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/index.ts:37 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Load .env from current working directory (where npm run is executed)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathspackage.json:31 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…y": "node -e \"console.log('🔍 Verifying tracing setup with Jaeger...\\n1. Copy .env.example to .env and add your MAPBOX_ACCESS_TOKEN\\n2. Start Jaeger: npm run tra…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/index.ts:39 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst envPath = join(process.cwd(), '.env');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Tunneling service URLscripts/dev-http-server.ts:23 · Tunneling service URL — may route traffic to attacker infrastructure* # then add https://<ngrok-id>.ngrok.app/mcp as a ChatGPT developer-modeFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
npx invocation of non-well-known packagepackage.json:20 · npx invocation of non-well-known package — may execute untrusted code"dev:http": "npx -y tsx scripts/dev-http-server.ts",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagepackage.json:19 · npx invocation of non-well-known package — may execute untrusted code"inspect:dev": "npx @modelcontextprotocol/inspector -e MAPBOX_ACCESS_TOKEN=\"$MAPBOX_ACCESS_TOKEN\" npx -y tsx src/index.ts",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathssrc/index.ts:45 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Read and parse .env file using Node.js built-in parseEnvFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈32 tok
1 file · 81 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.