Is stronghold-mcp@0.1.0 safe to install?

stronghold-mcp@0.1.0

VERIFIED

Publisher claims: "Enables AI agents to play Arknights: Stronghold Protocol like a player over MCP by observing game state, querying game data, sending protocol actions, and running the game's client-side battle simulation. It bridges agents to a compatible game server through a read-only plugin and supports both direct MCP and Python SDK usage." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher yuzelingsha · publishing for 2 daysInstalls 0Last detonated 2d ago

$npx skills add stronghold-mcp

Watch Report an issue

Coverage

Server started and answered tools/list.

Tested: MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested: what the tools do when called with real credentials

Before you give it your token

It will ask for: MCP_HTTP_PASSWORDSP_AUTH_PASSWORDSP_AUTH_USERSTRONGHOLD_AUTH_COOKIESTRONGHOLD_AUTH_PASSWORDSTRONGHOLD_AUTH_USERConfiguration, not credentials: DRIVER_HOST, DRIVER_LOG, DRIVER_MCP, DRIVER_PORT, DRIVER_TIMEOUT, MCP_HTTP_HOST, MCP_HTTP_IDLE_SECONDS, MCP_HTTP_PORT, MCP_HTTP_USER, MCP_TRANSPORT, STRONGHOLD_BATTLE_MODE, STRONGHOLD_DATA_DIR, STRONGHOLD_FIELD_REGION, STRONGHOLD_HTTP_URL, STRONGHOLD_LOCAL_BATTLE, STRONGHOLD_MCP_TOOLS, STRONGHOLD_NAME, STRONGHOLD_RECORD_DIR, STRONGHOLD_SIM_AUTODISCOVER, STRONGHOLD_SIM_CACHE, STRONGHOLD_SIM_ROOT, STRONGHOLD_SIM_SPEC, STRONGHOLD_WS_URL
Where it talks to: no vendor host named in the code
What the honeypot saw: no credential files read · no network
What we could not test: what the tools do when called with real credentials

Connect it with a scoped credential, under the guard. It asks for MCP_HTTP_PASSWORD, SP_AUTH_PASSWORD, SP_AUTH_USER, STRONGHOLD_AUTH_COOKIE, STRONGHOLD_AUTH_PASSWORD, STRONGHOLD_AUTH_USER and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-12 and scored it 86/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 23 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

2.6sprocessdependency install exit 0

23sclaimed10 tools: stronghold_connect, stronghold_observe, stronghold_lookup, stronghold_guide, stronghold_review, stronghold_state, stronghold_wait_event, stronghold_protocol, stronghold_action, stronghold_disconnect

23sprocessscript backend runs setup only

23sprocessno install scripts to re-run

Static findings

MEDIUM

Access to sensitive file pathstest/config.test.mjs:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesit('loads .env without overriding the environment', () => {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdriver/drive-daemon.mjs:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* The repository's `.env` is loaded first (variables already in the environment win). Everything theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstest/sim.test.mjs:85 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert.throws(() => diskRelFor('/sim/../../../etc/passwd'), /escapes the root/);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstest/config.test.mjs:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst file = join(mkdtempSync(join(tmpdir(), 'stronghold-env-')), '.env');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsmcp/index.js:15 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* Environment (the repository's `.env` is loaded first; variables already set win)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdriver/drive-daemon.mjs:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// the environment and `.env` both override them.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstest/config.test.mjs:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesit('reads DRIVER_TIMEOUT in seconds, as .env.example and the Python SDK do', () => {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstest/config.test.mjs:25 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert.equal(loadDotEnv(join(tmpdir(), 'no-such-dir', '.env')), null, 'a missing .env is not an error');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdriver/config.mjs:5 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* one value in `.env` means the same thing on both sides of the socket.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdriver/config.mjs:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* DRIVER_TIMEOUT is in **seconds**, the same unit the Python SDK, the README and `.env.example` use, soFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsmcp/env.js:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* Load the repository's `.env`, so the documented `cp .env.example .env` actually configures theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstest/plugin.test.mjs:105 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert.equal(call('/x/stronghold-agent/file', '?path=/etc/passwd').ok, false);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdriver/start-daemon.sh:5 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# repository's .env). If they are not already there, one of these can supply them WITHOUT ever writingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsmcp/env.js:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesexport const DEFAULT_ENV_FILE = resolve(dirname(fileURLToPath(import.meta.url)), '..', '.env');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

Cost to the agent

Instructions loaded

≈39 tok

1 file · 75 in bundle

Tool list per prompt

≈1,753 tok

10 tools · 175 per tool

Handshake

859 ms

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 310

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.