Is warriorgpt-mcp@1.0.0 safe to install?

warriorgpt-mcp@1.0.0

VERIFIED

Publisher claims: "Exposes a single ask_warriorgpt tool that lets Claude Code delegate self-contained code generation prompts to Wayne State's hosted model API, passing files to and from disk so the content never counts against the Claude plan. It validates multi-file edits before writing and logs per-session token usage, keeping design and debugging work with Claude." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher chrispelzer · publishing for 1 daysInstalls 0Last detonated 19 h ago

$npx skills add warriorgpt-mcp

Watch Report an issue

Coverage

Server started and answered tools/list.

Tested: MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested: what the tools do when called with real credentials

Before you give it your token

It will ask for: LANE_MAX_TOKENSWARRIORGPT_API_KEY or --max-tokens / --loop-max-tokensConfiguration, not credentials: CLAUDE_CODE_SESSION_ID, OPENCODE_CONFIG_CONTENT, PATHEXT, VIRTUAL_ENV, WARRIORGPT_MAX_CONCURRENCY, WARRIORGPT_MAX_JOBS, WARRIORGPT_MODEL, WARRIORGPT_OPENCODE, WARRIORGPT_VERIFY_MS
Where it talks to: no vendor host named in the codeAlso wayne.edu, opencode.ai — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names wayne.edu, opencode.ai as well as its own vendor. The guard injects LANE_MAX_TOKENS, WARRIORGPT_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-13 and scored it 82/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 20 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

20sclaimed5 tools: ask_warriorgpt, start_warriorgpt_job, get_warriorgpt_job_status, get_warriorgpt_job_result, cancel_warriorgpt_job

20stoolsc43743b812f6be8c

20stools89aa998b610f9576

20stools2399da86a265244b

20stools7ad9226d102209c0

20stools118a03c9adbfc3ae

20sprocessscript backend runs setup only

20sprocessno install scripts to re-run

Static findings

HIGH

Access to sensitive file pathsworkspace.mjs:209 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst childEnv = { ...process.env, ...env };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstest/retry.test.mjs:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesWARRIORGPT_RETRY_BASE_MS: '1', ...env },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstest/server.test.mjs:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv = { MOCK_REPLIES: join(dir, 'replies.json'), MOCK_REQUEST_LOG: join(dir, 'requests.jsonl'), ...env };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Privileged sudo commanddelegate/opencode/agents/delegate-worker.md:25 · Privileged sudo command — agent may execute with elevated privileges"sudo *": denyFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

File type combined with upload actiontest/loop.test.mjs:81 · File type combined with upload action — agent may exfiltrate local data filesassert.match(reqs[1].messages[1].content, /one\.txt is NOT GOOD: bad/, 'the loop starts from the check output');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

LOW

Instructs the agent to modify its persistent memory or instruction filesdocs/opencode-subagent.md:239 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileAdd a rule like this to your `CLAUDE.md` (global `~/.claude/CLAUDE.md`, or a project's):Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

MEDIUM

Access to sensitive file pathstest/retry.test.mjs:207 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

const { text, isError } = call({ prompt: 'hi', log_file: log }, { env: { ...env, MOCK_FAIL_FIRST: JSON.stringify(['hang', 'stall']) } });

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstest/server.test.mjs:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesMOCK_REQUEST: join(dir, 'request.json'), WARRIORGPT_RETRY_BASE_MS: '1', ...env },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

File type combined with upload actiontest/loop.test.mjs:824 · File type combined with upload action — agent may exfiltrate local data files

assert.match(refused, /^error: helper\.txt is not a file you may change; it is read-only\. Allowed: .*f\.txt\. Put the change in one of those files instead\./);

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

Access to sensitive file pathstest/cli.test.mjs:26 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesMOCK_REQUEST: join(dir, 'request.json'), WARRIORGPT_RETRY_BASE_MS: '1', ...env },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

LOW

Instructs the agent to modify its persistent memory or instruction filesdocs/agent-setup.md:28 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file- Every session: add the README's example rule to `~/.claude/CLAUDE.md`, unless a similar rule is there already.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

MEDIUM

Access to sensitive file pathstest/delegate.test.mjs:45 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesWARRIORGPT_OPENCODE: FAKE, FAKE_OC_LOG: join(dir, 'oc.json'), ...GIT_ENV, ...env },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstest/jobs.test.mjs:153 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesWARRIORGPT_RETRY_BASE_MS: '1', ...env },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

Cost to the agent

Instructions loaded

≈42 tok

1 file · 39 in bundle

Tool list per prompt

≈3,371 tok

5 tools · 674 per tool

Handshake

496 ms

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 667

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.