Skills/Glama/starmux

starmux@0.17.0

CAUTION· startup only

Publisher claims: "An all-in-one self-hosted remote MCP server and gateway that lets AI clients access filesystem, terminal, background processes, and computer-use tools, and multiplex local stdio MCP servers over Streamable HTTP on Linux, Jetson, macOS, and Windows. It bundles revocable API keys, OAuth 2.0, and a read-only/coding safety switch so cloud and desktop assistants can safely drive remote machines." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher cookyecat · publishing for 5 daysInstalls 0Last detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
STARMUX_INTERNAL_SETUP_TOKENSTARMUX_TOKEN or --token-authConfiguration, not credentials: GLAMA_VERSION, STARMUX_ACCESS_FILE, STARMUX_ALLOW_LAN, STARMUX_DC_ACCESS_MODE, STARMUX_DC_WRITE_SCOPE, STARMUX_DENY_FILE, STARMUX_DEV_COMMANDS, STARMUX_GIT_MODE, STARMUX_GRANTS_FILE, STARMUX_INSTANCE_ID, STARMUX_INSTANCE_NAME, STARMUX_INTERNAL_SETUP_OWNER_PID, STARMUX_INTERNAL_SETUP_RUN_ID, STARMUX_PERMISSION_MODE, STARMUX_PRIVATE_ACTIVITY_OBSERVER, STARMUX_PROJECT_PORT, STARMUX_PROJECT_ROOT, STARMUX_UPSTREAMS_FILE, STARMUX_WORKSPACE_MODE, STARMUX_WORKTREE_MODE
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard. It asks for STARMUX_INTERNAL_SETUP_TOKEN, STARMUX_TOKEN and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-09 and scored it 74/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 39 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
18sprocessdependency install exit 0
38sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-hvSCpd/task/home/work/acme-api/.claude/skills/starmux/dist/src/cli/starmux.js' } Node.js v22.23.4
38sprocessscript backend runs setup only
38sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathssrc/managed-workspace-policy.ts:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".npmrc",".netrc",".env","secrets","credentials","keychains",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/managed-workspace-policy.ts:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif(parts.some(x=>blocked.has(x.toLowerCase())||/^\.env(\.|$)/i.test(x)||Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/configured-mcp-upstreams.ts:69 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn {...env,...additions};Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/project-workspace-policy.ts:15 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst deniedParts=new Set([".git",".env",".ssh",".aws",".config","node_modules",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionsrc/dashboard-manager.ts:104 · File type combined with upload action — agent may exfiltrate local data files…tate.port)try{const response=await fetch(`http://127.0.0.1:${state.port}/catalog.json`,{signal:AbortSignal.timeout(2000)});const catalog=await response.json() as {instanceId:string;tools:unknown[]};if(catalog.instanceId===i.id)tools=catalo…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathssrc/project-workspace-policy.ts:62 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/^\.env(\.|$)/i.test(x)||/\.(pem|key|p12|pfx)$/i.test(x)))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationsrc/tool-dispatch.ts:70 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeremoteConfigMutation:"owner-only",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionsrc/dashboard-manager.ts:97 · File type combined with upload action — agent may exfiltrate local data files…e:false});return;}const result=await fetch(`http://127.0.0.1:${s.port}/dashboard.json`,{signal:AbortSignal.timeout(2000)});const snapshot=await result.json() as {instance?:{id:string}};if(snapshot.instance?.id!==i.id)throw Error('INSTANCE_…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)src/dashboard-browser.ts:49 · MCP server using network transport (SSE/HTTP) — data sent over network…tp://127.0.0.1:${state.port}/mcp`;const data=a==='copy-url'?url:JSON.stringify({mcpServers:{starmux:{type:'streamable-http',url,...(access?.mode==='api-key'?{headers:{Authorization:'Bearer <YOUR_API_KEY…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedapp/scripts/build_ui.py:23 · Python subprocess execution detectedreturn subprocess.run(cmd,check=True,capture_output=True,text=True,timeout=timeout)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionsrc/dashboard-manager.ts:99 · File type combined with upload action — agent may exfiltrate local data files…r'].includes(kind))throw Error('INVALID_LOG');const file=path.join(p.logs,kind+'.log');if(!await store.exists(file)){send(200,{text:'',cursor:null});return;} // Verify identity before opening, and …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/vendor-desktop-commander.mjs:29 · File type combined with upload action — agent may exfiltrate local data files// 2. Write a clean, minimal package.json (no postinstall, no telemetry-contract)Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Unpinned dependencypackage.json:70 · Unpinned dependency"sync:upstream": "npm install --save-dev --save-exact @wonderwhy-er/desktop-commander@latest --ignore-scripts && npm run build"Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06

Cost to the agent

Instructions loaded
≈32 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

6 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim cookyecat: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  4. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  5. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
  6. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim cookyecatPropose a patch to the maintainer