Skills/Docker MCP Catalog/next-devtools-mcp

next-devtools-mcp@0.2.1

CAUTION

Publisher claims: "next-devtools-mcp is a Model Context Protocol (MCP) server that provides Next.js development tools and utilities for AI coding assistants." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry Docker MCP CatalogPublisher kgprs · joined 0 days agoInstalls 55,748Last detonated 1 h ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-26 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Rule modification attempt; Rule modification attempt; Rule modification attempt. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

CRITICAL
Rule modification attemptsrc/mcp-prompts/nextjs-16.md:2437 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
CRITICAL
Rule modification attemptsrc/mcp-resources/nextjs-16-knowledge/04-runtime-prefetching.md:130 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
CRITICAL
Rule modification attemptsrc/mcp-resources/nextjs-16-knowledge/12-reference.md:101 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
CRITICAL
Rule modification attemptsrc/mcp-resources/nextjs-16-knowledge/04-runtime-prefetching.md:119 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
CRITICAL
Rule modification attemptsrc/mcp-prompts/nextjs-16.md:665 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
CRITICAL
Rule modification attemptsrc/mcp-prompts/nextjs-16.md:714 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
CRITICAL
Rule modification attemptsrc/mcp-prompts/nextjs-16.md:696 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
CRITICAL
Rule modification attemptsrc/mcp-resources/nextjs-16-knowledge/12-reference.md:59 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
CRITICAL
Rule modification attemptsrc/mcp-resources/nextjs-16-knowledge/12-reference.md:69 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
npx invocation of non-well-known packageREADME.md:48 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
CRITICAL
Rule modification attemptsrc/mcp-resources/nextjs-16-knowledge/12-reference.md:129 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
CRITICAL
Rule modification attemptsrc/mcp-resources/nextjs-16-knowledge/04-runtime-prefetching.md:150 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
CRITICAL
Rule modification attemptsrc/mcp-resources/nextjs-16-knowledge/04-runtime-prefetching.md:168 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
CRITICAL
Rule modification attemptsrc/mcp-resources/nextjs-16-knowledge/12-reference.md:119 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
CRITICAL
Rule modification attemptsrc/mcp-prompts/nextjs-16.md:676 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
npx invocation of non-well-known packagesrc/mcp-prompts/enable-cache-components-prompt.md:228 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
npx invocation of non-well-known packageREADME.md:63 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
npx invocation of non-well-known packageREADME.md:76 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiontest/e2e/upgrade.test.ts:82 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
npx invocation of non-well-known packagesrc/mcp-resources/nextjs-16-migration-examples.md:347 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathssrc/mcp-resources/nextjs-16-migration-examples.md:116 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp-resources/nextjs-16-migration-examples.md:918 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/lib/mcp-client.ts:36 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp-resources/nextjs-16-migration-examples.md:117 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp-resources/nextjs-16-migration-examples.md:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
npx invocation of non-well-known packageREADME.md:116 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Unpinned dependencysrc/lib/browser-eval-manager.ts:28 · Unpinned dependencyFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST06
HIGH
npx invocation of non-well-known packagesrc/lib/browser-eval-manager.ts:85 · npx invocation of non-well-known package — may execute untrusted codeFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST06
HIGH
npx invocation of non-well-known packagesrc/mcp-prompts/upgrade-nextjs-16-prompt.md:71 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathstest/e2e/upgrade.test.ts:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp-prompts/upgrade-nextjs-16-prompt.md:241 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
npx invocation of non-well-known packagesrc/mcp-resources/nextjs-16-migration-examples.md:829 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
npx invocation of non-well-known packageREADME.md:121 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim kgprs: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. npx invocation of non-well-known package≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  5. Unpinned dependencies≈ +1 on the totalPin exact versions (and ideally hashes) in package.json, requirements or the install script so the bundle cannot change under you.
  6. Unpinned dependency≈ +1 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
Publish a new version to Docker MCP Catalog, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim kgprs