Skills/Glama/tplink-mcp

tplink-mcp@1.0.0

CAUTION· startup only

Publisher claims: "Enables AI copilots and autonomous agents to inspect, diagnose, and safely manage TP-Link 4G/LTE gateways and broadband routers through typed MCP tools for status, signal, clients, Wi-Fi, DNS, SMS/USSD, and guarded mutations. It provides session leasing and confirmation safeguards to avoid locking out admins or disconnecting active sessions." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher dulithdivisekara · publishing for 2 daysInstalls 0Last detonated 45 h ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
TPLINK_PASSWORDConfiguration, not credentials: PYTHON_BIN, PYTHONPATH, TPLINK_COOKIE, TPLINK_ENV, TPLINK_EXPECTED_SSID, TPLINK_ROUTER_IP, TPLINK_SESSION_COOKIE, TPLINK_USERNAME
Where it talks to
no vendor host named in the codeAlso gstatic.com, tailwindcss.com, dulith.me — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names gstatic.com, tailwindcss.com, dulith.me as well as its own vendor. The guard injects TPLINK_PASSWORD only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-12 and scored it 73/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; URL with embedded credentials; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 20 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
20sclaimedstartup only: exited (0) before answering · File "<frozen runpy>", line 88, in _run_code File "/tmp/ks-detonate-XqMYGe/task/home/work/acme-api/.claude/skills/tplink-mcp/tplink_mcp/server.py", line 10, in <module> from mcp.server.mcpserver import MCPServer ModuleNotFoundError: No module named 'mcp'
20sprocessscript backend runs setup only
20sprocessno install scripts to re-run

Static findings

LOW
URL to a private-network addresssmithery.yaml:10 · URL to a private-network address — a LAN or development targetdescription: Router IP address or URL (default http://192.168.1.1)Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtplink_mcp/core/network_guard.py:25 · Python subprocess execution detectedout = subprocess.check_output(["ip", "route", "show", "default"], stderr=subprocess.DEVNULL, timeout=2).decode()Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathstplink_mcp/core/config.py:80 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = Path(os.environ.get("TPLINK_ENV", ".env"))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtplink_mcp/core/network_guard.py:60 · Python subprocess execution detectedout = subprocess.check_output(["iw", "dev"], stderr=subprocess.DEVNULL, timeout=2).decode()Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
URL with embedded credentialstplink_mcp/calibration/dashboard.py:33 · URL with embedded credentials — may be phishing or credential leaking<link href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;500;600;700&family=Plus+Jakarta+Sans:wght@400;500;600;700;800&display=swap" rel="stylesheet">Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Access to sensitive file pathstplink_mcp/core/config.py:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Reads simple KEY=VALUE pairs from an .env file."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtplink_mcp/core/network_guard.py:31 · Python subprocess execution detectedout = subprocess.check_output(["route", "-n", "get", "default"], stderr=subprocess.DEVNULL, timeout=2).decode()Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathstplink_mcp/core/config.py:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files3. Local project .env or $TPLINK_ENVFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtplink_mcp/core/network_guard.py:36 · Python subprocess execution detectedout = subprocess.check_output(["route", "print", "0.0.0.0"], stderr=subprocess.DEVNULL, timeout=2).decode()Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathstplink_mcp/core/config.py:79 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 3. Project .env or custom env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandtplink_mcp/calibration/agy_agent.py:144 · Privileged sudo command — agent may execute with elevated privilegesf"3. **Enable Linux TCP BBR**: `sudo ./scripts/optimize-network.sh enable` for bufferbloat mitigation.",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtplink_mcp/calibration/engine.py:209 · Python subprocess execution detectedres = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout_sec)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Privileged sudo commandtplink_mcp/calibration/agy_agent.py:161 · Privileged sudo command — agent may execute with elevated privileges"sudo ./scripts/optimize-network.sh enable"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
URL to a private-network addresssmithery.yaml:11 · URL to a private-network address — a LAN or development targetdefault: "http://192.168.1.1"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtplink_mcp/core/network_guard.py:52 · Python subprocess execution detectedout = subprocess.check_output(["nmcli", "-t", "-f", "active,ssid", "dev", "wifi"], stderr=subprocess.DEVNULL, timeout=2).decode()Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
HTML that renders invisible but is read by the agentweb/index.html:175 · HTML that renders invisible but is read by the agent · informational: not an instruction file<p class="text-xs text-zinc-500 mb-2">// Standalone zero-install container from GitHub Packages ($0 cost)</p> <pre class="text-emerald-400">docker run -i --rm -Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
URL to a private-network addresstests/test_factory.py:34 · URL to a private-network address — a LAN or development targetclient_broad = RouterClientFactory.get_client("http://192.168.0.1", "secret", force_family="broadband")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstplink_mcp/core/config.py:12 · URL to a private-network address — a LAN or development targetDEFAULT_HOST = "http://192.168.1.1"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstests/test_network_guard.py:13 · URL to a private-network address — a LAN or development targetis_safe, msg = NetworkGuard.check_safety("http://192.168.1.1", expected_ssid="dulith.connect")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstests/test_calibration.py:14 · URL to a private-network address — a LAN or development targethost="http://192.168.1.1",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstests/test_calibration.py:95 · URL to a private-network address — a LAN or development targethost="http://192.168.1.1",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstests/test_network_guard.py:33 · URL to a private-network address — a LAN or development targetis_safe, msg = NetworkGuard.check_safety("http://192.168.1.1", force=True)Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstests/test_factory.py:18 · URL to a private-network address — a LAN or development targetfamily = RouterClientFactory.detect_model_family("http://192.168.1.1")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstplink_mcp/server.py:443 · URL to a private-network address — a LAN or development targethost=cfg.get("host", "http://192.168.1.1"),Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstests/test_network_guard.py:27 · URL to a private-network address — a LAN or development targetis_safe, msg = NetworkGuard.check_safety("http://192.168.1.1")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstplink_mcp/calibration/engine.py:80 · URL to a private-network address — a LAN or development targethost: str = "http://192.168.1.1",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstests/test_calibration.py:102 · URL to a private-network address — a LAN or development targethost="http://192.168.1.1",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstests/test_factory.py:31 · URL to a private-network address — a LAN or development targetclient_mr = RouterClientFactory.get_client("http://192.168.1.1", "secret", force_family="mr")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstests/test_advanced_features.py:12 · URL to a private-network address — a LAN or development targetself.client = TPLinkMRClient("http://192.168.1.1", "secret")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstests/test_network_guard.py:20 · URL to a private-network address — a LAN or development targetis_safe, msg = NetworkGuard.check_safety("http://192.168.1.1", expected_ssid="dulith.connect")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstests/test_factory.py:27 · URL to a private-network address — a LAN or development targetfamily = RouterClientFactory.detect_model_family("http://192.168.0.1")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07

Cost to the agent

Instructions loaded
≈38 tok
1 file · 35 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

7 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim dulithdivisekara: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. URL to a private-network address≈ +1 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim dulithdivisekaraPropose a patch to the maintainer