Is apm-terminals@0.1.0 safe to install?

apm-terminals@0.1.0

VERIFIED

Publisher claims: "Enables querying terminal-operator container and vessel data, including import container status and holds, export booking status, empty-return status, vessel schedules, and full container event histories." Observed in sandbox: calls gateway.pipeworx.io only, touches nothing outside the project, writes no memory.

Registry GlamaPublisher pipeworx-io · publishing for 7 daysInstalls 0Last detonated 5d ago

$npx skills add apm-terminals

Watch Report an issue

Coverage

Server started and answered tools/list.

Tested: MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested: what the tools do when called with real credentials

Before you give it your token

It will ask for: PIPEWORX_API_KEYConfiguration, not credentials: PIPEWORX_GATEWAY_URL, PIPEWORX_META_TOOLS, PIPEWORX_TIMEOUT_MS
Where it talks to: pipeworx.io (its own)
What the honeypot saw: no credential files read · reached only gateway.pipeworx.io (its own)
What we could not test: what the tools do when called with real credentials

Connect it with a scoped credential, under the guard. It asks for PIPEWORX_API_KEY and talks to pipeworx.io. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind.

$vet-skills run --secrets PIPEWORX_API_KEY=pipeworx.io -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-09 and scored it 85/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: calls gateway.pipeworx.io only, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 20 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

20snetworkCONNECT tcp://gateway.pipeworx.io:443

20sclaimed5 tools: import_availability, export_booking_enquiry, empty_container_returns, terminal_vessel_schedule, container_event_history

20sprocessscript backend runs setup only

20sprocessno install scripts to re-run

Static findings

MEDIUM

Privileged sudo command.github/workflows/publish.yml:334 · Privileged sudo command — agent may execute with elevated privilegessudo mv mcp-publisher /usr/local/bin/mcp-publisherFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

LOW

Unpinned dependency.github/workflows/publish.yml:65 · Unpinned dependencynpm install -g npm@latestFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.

AST06

MEDIUM

npx invocation of non-well-known packagebin/cli.js:2 · npx invocation of non-well-known package — may execute untrusted code// Entry point for `npx @pipeworx/mcp-<slug>` in gateway mode (bin/cli.js).Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

Cost to the agent

Instructions loaded

≈40 tok

1 file · 9 in bundle

Tool list per prompt

≈2,329 tok

5 tools · 466 per tool

Handshake

1859 ms

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 389

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.