jmap-mcp@r1

VERIFIED· install only

Publisher claims: "Gives AI assistants OAuth-based access to mailboxes on any JMAP server, requiring only an email address and a sign-in on the mail server's own page. Enables searching, reading, threading, organizing, drafting, sending, and managing vacation replies and Sieve filters across one or more accounts." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher kolapsis · publishing for 0 daysInstalls 0Last detonated 3 h ago

$npx skills add jmap-mcp

Watch Report an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.

Tested: every file read, file written and host contacted by what ran
Not tested: use of the skill by an agent

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: no credential variables read in the code
Where it talks to: no vendor host named in the codeAlso evil.example, ok.example, other.example, client.example, example.net, example.org, bridge.example — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: use of the skill by an agent

Connect it under the guard. Nothing executable in the bundle ran; the trace covers the install step only. The code names no credential variable; the guard pins the network to what the honeypot saw and logs every call.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is jmap-mcp@r1 safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-15 and scored it 80/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

0.0sprocessno install scripts to re-run

Static findings

MEDIUM

File permission modification commandDockerfile:3 · File permission modification command — agent changes file ownership/permissionsRUN mkdir -p /data && chown 65532:65532 /data && chmod 700 /dataFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

MEDIUM

File type combined with upload actioninternal/httpd/server.go:119 · File type combined with upload action — agent may exfiltrate local data filess.log.Info("listening", "addr", s.cfg.Listen, "public_url", s.cfg.PublicURL, "send_enabled", s.cfg.EnableSend)Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

HIGH

URL with embedded credentialsinternal/netguard/netguard_test.go:27 · URL with embedded credentials — may be phishing or credential leaking

for _, u := range []string{"http://example.com/", "ftp://example.com", "https://user:[email protected]", "javascript:alert(1)", "https:///nohost"} {

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

npx invocation of non-well-known package.github/workflows/ci.yml:81 · npx invocation of non-well-known package — may execute untrusted code- run: npx -y @anthropic-ai/[email protected] validate mcpb/manifest.jsonFix: Pin versions and sources; vendor anything fetched at install time.

AST06

HIGH

Access to sensitive file pathsinternal/stdio/stdio_test.go:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"../../etc/passwd": "passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

File permission modification commandscripts/build-mcpb.sh:12 · File permission modification command — agent changes file ownership/permissionschmod 755 "$work/server/jmap-mcp"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

Cost to the agent

Instructions loaded

≈33 tok

1 file · 81 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.