Skills/Glama/mpesa-daraja-mcp

mpesa-daraja-mcp@r1

CAUTION· install only

Publisher claims: "Enables AI agents to call Safaricom's M-Pesa Daraja API directly, sending STK push prompts, checking balances, looking up or reversing transactions, and receiving results as SUCCESS, FAILED, or UNKNOWN. Requests are sent once per idempotency key with sandbox-by-default operation, so agents can operate and test payments without risking double charges or real money." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher mr-macharia · publishing for 25 daysInstalls 0Last detonated 30 h ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
DARAJA_CALLBACK_TOKENDARAJA_CONSUMER_SECRETDARAJA_FORWARD_SECRETDARAJA_INITIATOR_PASSWORDDARAJA_MCP_TOKENConfiguration, not credentials: DARAJA_ALLOWED_RECIPIENTS, DARAJA_APPROVAL_THRESHOLD, DARAJA_CALLBACK_BASE_URL, DARAJA_CALLBACK_LISTEN, DARAJA_CONFIG_DIR, DARAJA_CONSUMER_KEY, DARAJA_DOTENV, DARAJA_ENV, DARAJA_FORWARD_URL, DARAJA_OUTPUT_DIR, DARAJA_READ_ONLY, DARAJA_STATE_DB, DARAJA_TOOLSETS, MPESA_SALES_LOG
Where it talks to
no vendor host named in the codeAlso safaricom.co.ke — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
use of the skill by an agent

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names safaricom.co.ke as well as its own vendor. The guard injects DARAJA_CALLBACK_TOKEN, DARAJA_CONSUMER_SECRET, DARAJA_FORWARD_SECRET, DARAJA_INITIATOR_PASSWORD, DARAJA_MCP_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is mpesa-daraja-mcp@r1 safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-13 and scored it 62/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Rule modification attempt; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

CRITICAL
Rule modification attemptskills/mpesa-daraja/SKILL.md:14 · Rule modification attempt — overwriting existing instructions**Rule #1: never mark money as moved based on the synchronous response.** Only the callback, `stk_query` or `transaction_status` can confirm it.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedshared/scripts/security_credential.py:50 · Python subprocess execution detectedencrypted = subprocess.run(Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedshared/scripts/security_credential.py:43 · Python subprocess execution detectedpem = subprocess.run(["openssl", "x509", "-inform", fmt, "-in", cert_path],Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp-server/src/mpesa_mcp/settings.py:5 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files2. A project `.env` in the directory the client starts the server inFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedmcp-server/src/mpesa_mcp/cli.py:147 · Python subprocess execution detectedres = subprocess.run(cmd, capture_output=True, text=True, timeout=60)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsskills/daraja-sandbox-setup/SKILL.md:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesAdd `.env` to `.gitignore`, and commit a `.env.example` with no values. The same variables configure the repo's MCP server.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsskills/daraja-credentials-security/SKILL.md:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…e initiator password with Safaricom's sandbox or production certificate. Covers .env files versus secret managers, fail-fast config, log masking, rotation and leak …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Tunneling service URLmcp-server/src/mpesa_mcp/commands.py:339 · Tunneling service URL — may route traffic to attacker infrastructurepattern = re.compile(r"https://[a-z0-9-]+\.trycloudflare\.com")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathsmcp-server/src/mpesa_mcp/commands.py:496 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = directory / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp-server/src/mpesa_mcp/settings.py:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn Path(os.environ["DARAJA_DOTENV"]) if os.environ.get("DARAJA_DOTENV") else Path.cwd() / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandskills/daraja-credentials-security/SKILL.md:21 · File permission modification command — agent changes file ownership/permissions2. **Development**: a `.env` file plus `python-dotenv`/`dotenv`. The file is in `.gitignore`, has `chmod 600`, and a `.env.example` without values is committed.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedmcp-server/src/mpesa_mcp/commands.py:345 · Python subprocess execution detectedproc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsskills/daraja-sandbox-setup/SKILL.md:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files3. Copy the **Consumer Key** and **Consumer Secret** into `.env`.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp-server/src/mpesa_mcp/commands.py:490 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesdirectory: Annotated[Path, typer.Option("--dir", help="Where to write docker-compose.yml and .env.")] = Path("mpesa-server"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packageskills/README.md:26 · npx invocation of non-well-known package — may execute untrusted code…t (Codex, Cursor, Copilot, Gemini CLI, Claude Code, Windsurf, Cline, …)**: run `npx skills add Mr-Macharia/mpesa-daraja-skills-and-mcp`. Add `-a <agent>` to target one ag…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsskills/daraja-checkout/SKILL.md:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files2. **Configuration:** `DARAJA_*` in `.env`. With the MCP server connected, call `mpesa_setup_status`, which shows what is missing without showing values.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Collapsed <details> block carrying instructionsREADME.md:274 · Collapsed <details> block carrying instructions<summary><b>My agent says "Connection closed".</b></summary> <br> Run <code>uvx mpesa-daraja-mcp status</code>. It lists missing settings and re-tests your keysFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsmcp-server/src/mpesa_mcp/commands.py:494 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Self-host with Docker: writes a compose file and .env from your config, then starts it."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Collapsed <details> block carrying instructionsREADME.md:167 · Collapsed <details> block carrying instructions<summary><b>Add the server to one agent by hand</b></summary> <br> No keys go in these commands; the server reads them from its config file. | Agent | Command |Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedmcp-server/src/mpesa_mcp/commands.py:518 · Python subprocess execution detectedres = subprocess.run(["docker", "compose", "up", "-d"], cwd=directory)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsskills/daraja-sandbox-setup/SKILL.md:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…ing test credentials (shortcodes, passkey, initiator, certificate), writing the .env file, exposing callbacks through a tunnel, smoke testing each API, and running …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsskills/daraja-payouts/SKILL.md:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- `mpesa_setup_status` (MCP) or `.env`: are `DARAJA_INITIATOR_NAME` and `DARAJA_SECURITY_CREDENTIAL` set?Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp-server/src/mpesa_mcp/commands.py:458 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file: .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedshared/scripts/security_credential.py:45 · Python subprocess execution detectedpub = subprocess.run(["openssl", "x509", "-pubkey", "-noout"], input=pem,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Host or code assembled from base64 fragmentsskills/daraja-auth/SKILL.md:66 · Host or code assembled from base64 fragmentsNode.js uses the same idea: `Buffer.from(`${key}:${secret}`).toString("base64")`, then `fetch(url, { headers: { Authorization: `Basic ${auth}` } })`.Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathsskills/daraja-credentials-security/SKILL.md:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files2. **Development**: a `.env` file plus `python-dotenv`/`dotenv`. The file is in `.gitignore`, has `chmod 600`, and a `.env.example` without values is committed.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsskills/daraja-sandbox-setup/SKILL.md:27 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files## 3. `.env` templateFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedmcp-server/src/mpesa_mcp/commands.py:785 · Python subprocess execution detectedraise typer.Exit(subprocess.run(cmd).returncode)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsmcp-server/src/mpesa_mcp/settings.py:99 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"(or a project .env), then restart the MCP server."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedmcp-server/src/mpesa_mcp/cli.py:163 · Python subprocess execution detectedsubprocess.run(cmd, capture_output=True, text=True, timeout=60)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsskills/daraja-checkout/SKILL.md:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files| Keys and passkey | `.env` / secret store, never in code |Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈22,524 tok
22 files · 80 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

18 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim mr-macharia: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  3. Obfuscated code≈ +5 on the totalRemove base64-assembled strings, eval of decoded text and minified blobs. Reviewers and scanners both treat unreadable code as hostile.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Tunneling service URL≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  6. Host or code assembled from base64 fragments≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim mr-machariaPropose a patch to the maintainer