Is soumit-mcp@1.1.0 safe to install?

soumit-mcp@1.1.0

VERIFIED

Publisher claims: "Enables AI agents to search Moroccan public tenders, inspect consultation dossiers, check regulatory compliance under Décret n° 2-22-431, analyze competitor awards and market barometers, and audit submission checklists." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher vext-ma · publishing for 7 daysInstalls 0Last detonated 7d ago

$npx skills add soumit-mcp

Watch Report an issue

Coverage

Server started and answered tools/list.

Tested: MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested: what the tools do when called with real credentials

Before you give it your token

Code inventory arrives with this version's next honeypot run.

It will ask for: unknown until the next run
Where it talks to: unknown until the next run
What the honeypot saw: no credential files read · no network
What we could not test: what the tools do when called with real credentials

The run was clean; the code inventory is pending. Server started and answered tools/list. What the code asks for and which hosts it names arrive with the next run; until then, connect it under the guard with the network pinned to what the honeypot saw.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-07 and scored it 93/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.1sprocessexec /usr/bin/date

0.1sprocessexec /usr/bin/timeout

0.1sclaimed6 tools: search_tenders, get_tender_details, check_regulatory_compliance, search_competitor_awards, get_market_barometer, audit_submission_checklist

0.2sprocessscript backend runs setup only

0.2sprocessno install scripts to re-run

Static findings

No findings across 791 lines in 7 files.

Cost to the agent

Instructions loaded

≈34 tok

1 file · 7 in bundle

Tool list per prompt

≈827 tok

6 tools · 138 per tool

Handshake

130 ms

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 135

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.