opik@r5

VERIFIED· not started

Publisher claims: "Configure the connection to Opik" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry Docker MCP CatalogPublisher comet-ml · publishing for 407 daysInstalls 17,564Last detonated 4d ago

$docker run -i --rm mcp/opik

Watch Report an issue

Coverage

Not started: dependency install failed; the server itself was not observed.

Tested: the dependency install step · every file read, file written and host contacted by what ran
Not tested: server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: GH_TOKENOPENAI_API_KEYOPIK_API_KEYSLACK_WEBHOOK_URLConfiguration, not credentials: COMET_URL_OVERRIDE, GITHUB_ACTIONS, OPIK_MCP_ANALYTICS_ENABLED, OPIK_MCP_ANALYTICS_SOURCE, OPIK_MCP_ANALYTICS_URL, OPIK_URL, OPIK_WORKSPACE, PYTEST_CURRENT_TEST, VERSION
Where it talks to: no vendor host named in the codeAlso comet.com — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names comet.com as well as its own vendor. The guard injects GH_TOKEN, OPENAI_API_KEY, OPIK_API_KEY, SLACK_WEBHOOK_URL only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- docker run -i --rm mcp/opik

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is opik@r5 safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-10 and scored it 84/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.1sprocessdependency install exit 1 ·

0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed

0.1sprocessscript backend runs setup only

0.1sprocessno install scripts to re-run

Static findings

MEDIUM

npx invocation of non-well-known packagesrc/opik_mcp/command_line.py:97 · npx invocation of non-well-known package — may execute untrusted code# src/cli.ts). A config migrated from `npx opik-mcp` keeps them, and the serverFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagescripts/build_skills_pack.py:4 · npx invocation of non-well-known package — may execute untrusted codepublic pack that `npx skills add comet-ml/opik-skills` resolves to — a string hardcodedFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Access to sensitive file pathstests/skills/test_catalog.py:255 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"/etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

npx invocation of non-well-known packagedocs/skills/design-doc.md:194 · npx invocation of non-well-known package — may execute untrusted code- `npx skills add` run against this repo resolves `.claude/skills/` andFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Python subprocess execution detectedscripts/dev/install_branch.py:55 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Access to sensitive file pathstests/skills/test_catalog.py:372 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"opik/../../../etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Python subprocess execution detectedscripts/dev/install_branch.py:141 · Python subprocess execution detectedresult = subprocess.run(command, cwd=cwd, capture_output=True, text=True, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

npx invocation of non-well-known package.claude/hooks/protect_paths.py:15 · npx invocation of non-well-known package — may execute untrusted code"a skill here is resolved by `npx skills add` and ships to users. "Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Access to sensitive file pathstests/skills/test_catalog.py:257 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"opik://skills/../../../etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsplugins/opik/skills/opik-instrument/SKILL.md:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

- Only add project-local `.env` vars if the project **already** uses that pattern. Never introduce a second config mechanism; never copy secret values between mechanisms.

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Python subprocess execution detected.claude/hooks/format_python.py:31 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Access to sensitive file pathstests/skills/test_catalog.py:253 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"opik/../../../etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Python subprocess execution detectedscripts/dev/install_branch.py:287 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

npx invocation of non-well-known package.claude/hooks/protect_paths.py:20 · npx invocation of non-well-known package — may execute untrusted code"a skill here is resolved by `npx skills add` and ships to users. "Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Access to sensitive file pathstests/skills/test_catalog.py:256 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"../../../../etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

npx invocation of non-well-known packageplugins/opik/skills/opik-instrument/SKILL.md:36 · npx invocation of non-well-known package — may execute untrusted code- Otherwise run the official flow: `opik configure` (Python) / `npx opik-ts configure` (TypeScript).Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagesrc/opik_mcp/command_line.py:59 · npx invocation of non-well-known package — may execute untrusted codenpx skills add comet-ml/opik-skills -g --all. The installer replaces anFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagedocs/skills/design-doc.md:7 · npx invocation of non-well-known package — may execute untrusted codepack that `npx skills add comet-ml/opik-skills` installs, and the Claude CodeFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Python subprocess execution detectedscripts/dev/install_branch.py:164 · Python subprocess execution detectedsubprocess.run(["claude", "mcp", "get", server], cwd=root, capture_output=True).returncodeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

Cost to the agent

Instructions loaded

≈28,982 tok

11 files · 80 in bundle

Tool list per prompt

≈0 tok

0 tools · 0 per tool

Handshake

no reply

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.