agenthub-multiagent-mcp@1.78.1
VERIFIED· not startedPublisher claims: "MCP server for AgentHub multi-agent communication" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
AGENTHUB_API_KEYAGENTHUB_FASTPATH_API_KEYAGENTHUB_USER_API_KEYConfiguration, not credentials: AGENTHUB_AGENT_ID, AGENTHUB_ATTACHMENT_DIR, AGENTHUB_AUTO_ACTIVITY, AGENTHUB_AUTO_INBOX, AGENTHUB_AUTO_RECONNECT, AGENTHUB_BRAIN_BACKEND, AGENTHUB_BRAIN_MIGRATE_ATTEMPTS, AGENTHUB_DISABLE_WEBSOCKET, AGENTHUB_EMPLOYEE_RUNTIME_ENTRY, AGENTHUB_FASTPATH_BASE_URL, AGENTHUB_FASTPATH_ENABLED, AGENTHUB_FASTPATH_EXPERT_GROUNDING, AGENTHUB_FASTPATH_GROUNDING_K, AGENTHUB_FASTPATH_MODEL, AGENTHUB_FASTPATH_TIMEOUT_MS, AGENTHUB_HEADLESS, AGENTHUB_INTEGRATION_TESTS, AGENTHUB_MODEL, AGENTHUB_PROJECT, AGENTHUB_REQUEST_TIMEOUT_MS, AGENTHUB_SKILLS_AUTOINSTALL, AGENTHUB_URL- Where it talks to
- no vendor host named in the codeAlso contetial.com, hub.test, proxy.local, agenthub.test, apple.com — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names contetial.com, hub.test, proxy.local, agenthub.test, apple.com as well as its own vendor. The guard injects AGENTHUB_API_KEY, AGENTHUB_FASTPATH_API_KEY, AGENTHUB_USER_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 89/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 8 s · 2 scenarios · 0 deviationsStatic findings
// Timeout: kill if running too longFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.// Force kill if still aliveFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.// `npx agenthub-channel` resolves to a different package entirely.Fix: Pin versions and sources; vendor anything fetched at install time.* claude mcp add --scope user goshti-channel -- npx -y -p agenthub-multiagent-mcp@latest goshti-channelFix: Pin versions and sources; vendor anything fetched at install time.* package so the next `npx …@latest` upgrade can run.Fix: Pin versions and sources; vendor anything fetched at install time.* echo '{"tool_name":"ExitPlanMode","tool_input":{"plan":"..."}}' | npx agenthub-hook plan-reviewFix: Pin versions and sources; vendor anything fetched at install time.// launched from `npx -y agenthub-multiagent-mcp@latest` (unpacked in a cache)Fix: Pin versions and sources; vendor anything fetched at install time.* echo '{"tool_name":"ExitPlanMode","tool_input":{"plan":"..."}}' | npx agenthub-hook plan-reviewFix: Pin versions and sources; vendor anything fetched at install time.…d path — the target must be on the deployment's file-delivery allowlist and the kill switch enabled, else the call is rejected (target_not_allowed / file_delivery_di…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.print(" Floating this pin has caused EBUSY on a shared npx cache while");Fix: Pin versions and sources; vendor anything fetched at install time.* floating that pin has caused `EBUSY` on a shared npx cache while anotherFix: Pin versions and sources; vendor anything fetched at install time.// `npx …@latest` upgrade does not die with EBUSY on WindowsFix: Pin versions and sources; vendor anything fetched at install time.* floating that pin has caused `EBUSY` on a shared npx cache while anotherFix: Pin versions and sources; vendor anything fetched at install time.describe("§4.8 kill switch", () => {Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.* package so the next `npx …@latest` upgrade can run.Fix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for agenthub-multiagent-mcp@1.78.1 as of 20 h ago. This is the package itself, not its dependencies.