opik@r4

VERIFIED· not started

Publisher claims: "Configure the connection to Opik" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry Docker MCP CatalogPublisher comet-ml · publishing for 407 daysInstalls 17,564Last detonated 8d ago

$docker run -i --rm mcp/opik

Watch Report an issue

Coverage

Not started: dependency install failed; the server itself was not observed.

Tested: the dependency install step · every file read, file written and host contacted by what ran
Not tested: server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

Code inventory arrives with this version's next honeypot run.

It will ask for: unknown until the next run
Where it talks to: unknown until the next run
What the honeypot saw: no credential files read · no network
What we could not test: server startup · the tool list · tool behavior

Not enough was observed to say yet. Not started: dependency install failed; the server itself was not observed. This version's code has not been inventoried for credentials and hosts either; both arrive with its next honeypot run (popular servers first). `vet-skills try opik` runs it now and prints the full answer.

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is opik@r4 safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-06 and scored it 84/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.1sprocessdependency install exit 1

0.2sprocessexec /usr/bin/date

0.2sprocessexec /usr/bin/timeout

0.2sprocessexec .venv/bin/opik-mcp

0.2sclaimedno tools/list reply (exit 0)

0.2sprocessscript backend runs setup only

0.2sprocessno install scripts to re-run

Static findings

MEDIUM

npx invocation of non-well-known package.claude/hooks/protect_paths.py:20 · npx invocation of non-well-known package — may execute untrusted code"a skill here is resolved by `npx skills add` and ships to users. "Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagesrc/opik_mcp/command_line.py:97 · npx invocation of non-well-known package — may execute untrusted code# src/cli.ts). A config migrated from `npx opik-mcp` keeps them, and the serverFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagedocs/skills/design-doc.md:194 · npx invocation of non-well-known package — may execute untrusted code- `npx skills add` run against this repo resolves `.claude/skills/` andFix: Pin versions and sources; vendor anything fetched at install time.

AST06

HIGH

Access to sensitive file pathsplugins/opik/skills/opik-instrument/SKILL.md:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

- Only add project-local `.env` vars if the project **already** uses that pattern. Never introduce a second config mechanism; never copy secret values between mechanisms.

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Python subprocess execution detectedscripts/dev/install_branch.py:55 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

npx invocation of non-well-known packageplugins/opik/skills/opik-instrument/SKILL.md:36 · npx invocation of non-well-known package — may execute untrusted code- Otherwise run the official flow: `opik configure` (Python) / `npx opik-ts configure` (TypeScript).Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Access to sensitive file pathstests/skills/test_catalog.py:253 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"opik/../../../etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Python subprocess execution detectedscripts/dev/install_branch.py:287 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

npx invocation of non-well-known packagesrc/opik_mcp/command_line.py:59 · npx invocation of non-well-known package — may execute untrusted codenpx skills add comet-ml/opik-skills -g --all. The installer replaces anFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagescripts/build_skills_pack.py:4 · npx invocation of non-well-known package — may execute untrusted codepublic pack that `npx skills add comet-ml/opik-skills` resolves to — a string hardcodedFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known package.claude/hooks/protect_paths.py:15 · npx invocation of non-well-known package — may execute untrusted code"a skill here is resolved by `npx skills add` and ships to users. "Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Python subprocess execution detectedscripts/dev/install_branch.py:164 · Python subprocess execution detectedsubprocess.run(["claude", "mcp", "get", server], cwd=root, capture_output=True).returncodeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

npx invocation of non-well-known packagedocs/skills/design-doc.md:7 · npx invocation of non-well-known package — may execute untrusted codepack that `npx skills add comet-ml/opik-skills` installs, and the Claude CodeFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Python subprocess execution detectedscripts/dev/install_branch.py:141 · Python subprocess execution detectedresult = subprocess.run(command, cwd=cwd, capture_output=True, text=True, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detected.claude/hooks/format_python.py:31 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Access to sensitive file pathstests/skills/test_catalog.py:372 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"opik/../../../etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstests/skills/test_catalog.py:255 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"/etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstests/skills/test_catalog.py:257 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"opik://skills/../../../etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstests/skills/test_catalog.py:256 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"../../../../etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

Cost to the agent

Instructions loaded

≈28,982 tok

11 files · 79 in bundle

Tool list per prompt

≈0 tok

0 tools · 0 per tool

Handshake

no reply

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.