ai-mcp-server@8.0.3
CAUTIONPublisher claims: "EU-hosted AI platform: OpenAI-compatible LLM gateway, document extraction, transcription, agents." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server) · listed in the official MCP RegistryPublisher 2kw · joined 0 days agoInstalls 0Last detonated 3 h ago
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-10-26 and scored it 76/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Auto-update or dynamic fetch configuration. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 1 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.5sprocessdependency install exit 1
0.6sprocessexec /usr/bin/timeout
0.6sprocessexited 1: Node.js v22.23.4
0.6sclaimedno tools/list reply (exit 1)
0.6sprocessscript backend runs setup only
Static findings
HIGH
Access to sensitive file pathspackage.json:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05HIGH
Access to sensitive file pathspackage.json:37 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05HIGH
Auto-update or dynamic fetch configurationdist/tools/agents.js:266 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06HIGH
npx invocation of non-well-known packageREADME.md:12 · npx invocation of non-well-known package — may execute untrusted code
AST06