Is frigate-mcp@1.5.1 safe to install?

frigate-mcp@1.5.1

VERIFIED· install only

Publisher claims: "Provides read-only MCP tools for checking NVR system health, listing permitted cameras and capabilities, and investigating object events with managed login, camera scoping, retries, and bounded pagination." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher punissuer · publishing for 3 daysInstalls 0Last detonated 3d ago

$npx skills add frigate-mcp

Watch Report an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.

Tested: every file read, file written and host contacted by what ran
Not tested: use of the skill by an agent

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: FRIGATE_AUTH_COOKIE_NAMEFRIGATE_BEARER_TOKENFRIGATE_MCP_HTTP_SECRETFRIGATE_PASSWORDFRIGATE_TRUSTED_UNAUTHENTICATEDConfiguration, not credentials: FRIGATE_ALLOW_INSECURE_HTTP, FRIGATE_API_ROOT, FRIGATE_ARTIFACT_DIR, FRIGATE_CA_CERT_FILE, FRIGATE_CAMERAS, FRIGATE_MCP_HTTP_ALLOW_NON_LOOPBACK, FRIGATE_MCP_HTTP_ALLOWED_ORIGINS, FRIGATE_MCP_HTTP_HOST, FRIGATE_MCP_HTTP_MAX_SESSIONS, FRIGATE_MCP_HTTP_PATH, FRIGATE_MCP_HTTP_PORT, FRIGATE_MCP_HTTP_SESSION_TTL_MS, FRIGATE_MCP_TRANSPORT, FRIGATE_TLS_PIN_CERT_FILE, FRIGATE_USERNAME
Where it talks to: no vendor host named in the code
What the honeypot saw: no credential files read · no network
What we could not test: use of the skill by an agent

Connect it with a scoped credential, under the guard. It asks for FRIGATE_AUTH_COOKIE_NAME, FRIGATE_BEARER_TOKEN, FRIGATE_MCP_HTTP_SECRET, FRIGATE_PASSWORD, FRIGATE_TRUSTED_UNAUTHENTICATED and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-11 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

0.0sprocessno install scripts to re-run

Static findings

MEDIUM

Process kill commandtest/recovery.test.ts:68 · Process kill command — agent can terminate processes// Wait until the configuration read is in flight, then kill the process.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Access to sensitive file pathstest/lifecycle.test.ts:74 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files{ apiRoot: 'file:///etc/passwd' },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstest/discovery.test.ts:325 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files{ apiRoot: 'https://localhost/api', cameras: ['../etc/passwd'] },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

URL with embedded credentialstest/lifecycle.test.ts:58 · URL with embedded credentials — may be phishing or credential leakingenv: { FRIGATE_API_ROOT: 'https://user:SECRET@localhost/api' },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

Access to sensitive file pathstest/clips.test.ts:105 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

for (const uri of ['frigate://artifact/00000000000000000000000000000000', 'frigate://artifact/../secrets', 'file:///etc/passwd']) {

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Hex-encoded string detectedtest/preview-gif.test.ts:164 · Hex-encoded string detected — may contain obfuscated payloadsconst gif87a = Buffer.from('GIF87a\x01\x00\x01\x00\x00\x00\x00;', 'binary');Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.

AST07

MEDIUM

Access to sensitive file pathstest/helpers/durable.ts:14 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { FRIGATE_API_ROOT: apiRoot, FRIGATE_ALLOW_INSECURE_HTTP: 'true', ...env },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Hex-encoded string detectedtest/helpers/fixture.ts:44 · Hex-encoded string detected — may contain obfuscated payloads

export const gifBytes = Buffer.from('GIF89a\x01\x00\x01\x00\x00\x00\x00,\x00\x00\x00\x00\x01\x00\x01\x00\x00\x02\x01D\x00;', 'binary');

Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.

AST07

LOW

Authorization escalation languagedocs/spec.md:99 · Authorization escalation language · informational: not an instruction file

- Omit storage-usage and raw logs from v1; the documented storage endpoint requires admin privileges. Basic health and permitted statistics must work without requiring an administrator account.

Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

Cost to the agent

Instructions loaded

≈35 tok

1 file · 46 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.