Skills/Glama/web2mcp

web2mcp@0.2.0

VERIFIED

Publisher claims: "Enables any AI agent to call websites and REST APIs as MCP tools through a config-driven, zero-dependency Cloudflare Workers gateway. Connectors map HTTP endpoints into type-checked tools with token-friendly responses, server-side secrets, and optional bearer auth." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher charleswei118 · publishing for 3 daysInstalls 0Last detonated 3d ago
$npx skills add web2mcp
WatchReport an issue

Coverage

Server started and answered tools/list.
Tested
MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with real credentials

Before you give it your token

It will ask for
AUTH_TOKENMCP_TOKENConfiguration, not credentials: CONNECTORS_JSON, ENABLED_CONNECTORS, MAX_OUTPUT_CHARS, MCP_URL, NAME, TOOL_MODE
Where it talks to
no vendor host named in the codeAlso open-meteo.com, arxiv.org, baidu.com, bilibili.com, crossref.org, frankfurter.dev, algolia.com, jsdelivr.net, nager.at, openlibrary.org, jina.ai, jinrishici.com, api.host, workers.dev — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names open-meteo.com, arxiv.org, baidu.com, bilibili.com, crossref.org, frankfurter.dev, algolia.com, jsdelivr.net, nager.at, openlibrary.org, jina.ai, jinrishici.com, api.host, workers.dev as well as its own vendor. The guard injects AUTH_TOKEN, MCP_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-11 and scored it 85/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 20 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
20sclaimed21 tools: wikipedia_search, wikipedia_summary, hackernews_front_page, hackernews_search, geocode_search, weather_forecast, currency_latest, github_search_repos, github_repo, reader_read, npm_package, npmstats_downloads, arxiv_search, holidaycn_year, baiduhot_realtime, shici_random, bilibili_popular, bilibili_ranking, holidays_list, crossref_search, openlibrary_search
20sprocessscript backend runs setup only
20sprocessno install scripts to re-run

Static findings

MEDIUM
URL with embedded credentialstest/urlguard.test.js:12 · URL with embedded credentials — may be phishing or credential leaking"http://user:[email protected]/", "ftp://example.com/", "file:///etc/passwd", "http://example.com:22/",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
URL using a raw public IP addresstest/urlguard.test.js:10 · URL using a raw public IP address — may bypass domain-based filtering"http://100.64.0.1/", "http://0.0.0.0/", "http://[::1]/", "http://[fd00::1]/", "http://[fe80::1]/",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
npx invocation of non-well-known packagebin/web2mcp.js:2 · npx invocation of non-well-known package — may execute untrusted code// Local stdio MCP server: `node bin/web2mcp.js` or `npx github:charleswei118/web2mcp`.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstest/urlguard.test.js:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"http://user:[email protected]/", "ftp://example.com/", "file:///etc/passwd", "http://example.com:22/",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagepackage.json:12 · npx invocation of non-well-known package — may execute untrusted code"deploy": "npx wrangler deploy",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Hex-encoded URLtest/urlguard.test.js:8 · Hex-encoded URL — attempt to bypass URL filtering"http://localhost/", "http://127.0.0.1/", "http://2130706433/", "http://0x7f000001/",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
npx invocation of non-well-known packagewrangler.toml:13 · npx invocation of non-well-known package — may execute untrusted code# Secrets (set with `npx wrangler secret put NAME`):Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagepackage.json:11 · npx invocation of non-well-known package — may execute untrusted code"dev": "npx wrangler dev",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
URL to a private-network addresstest/urlguard.test.js:9 · URL to a private-network address — a LAN or development target"http://10.0.0.5/x", "http://172.16.1.1/", "http://192.168.1.1/", "http://169.254.169.254/latest/meta-data",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
HTTP URL with a raw public IP addresstest/urlguard.test.js:10 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot name"http://100.64.0.1/", "http://0.0.0.0/", "http://[::1]/", "http://[fd00::1]/", "http://[fe80::1]/",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL to the cloud instance metadata addresstest/urlguard.test.js:9 · URL to the cloud instance metadata address — reads the VM's credentials"http://10.0.0.5/x", "http://172.16.1.1/", "http://192.168.1.1/", "http://169.254.169.254/latest/meta-data",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Access to sensitive file pathstest/web2mcp.test.js:59 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert.throws(() => buildRequest(rd.connector, rd.tool, { url: "file:///etc/passwd" }), /must match/);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈34 tok
1 file · 51 in bundle
Tool list per prompt
≈3,062 tok
21 tools · 146 per tool
Handshake
293 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 269

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.