Skills/npm/ai-mcp-server

ai-mcp-server@8.2.1

VERIFIED

Publisher claims: "MCP server for 2kw.ai — EU-hosted AI platform: OpenAI-compatible LLM gateway, schema-driven document extraction, transcription, agents with a knowledge base, and cost observability. 199 tools for Claude Code, Cursor, and Windsurf." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server) · listed in the official MCP RegistryPublisher 2kw · publishing for 202 daysInstalls 10,515Last detonated 20 h ago
$claude mcp add ai-mcp-server -- npx -y @2kw/ai-mcp-server
WatchReport an issue

Coverage

Started with a decoy AI_2KW_API_KEY, BACKBONE_API_KEY; tool list observed. Tool calls with a real credential not tested.
Tested
server startup with a tagged decoy in AI_2KW_API_KEY, BACKBONE_API_KEY · MCP initialize and tools/list · every tool description, for hidden instructions · where the decoy credential went · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with a real credential
Needs
AI_2KW_API_KEY, BACKBONE_API_KEY — give it to the server where it runs, through vet-skills run --secrets, so the value never enters the server's environment. Never paste a credential into a chat, a ticket or a report.

Before you give it your token

It will ask for
no credential variables read in the code; at startup it asked for AI_2KW_API_KEY, BACKBONE_API_KEY
Where it talks to
2kw.ai (its own)
What the honeypot saw
no credential files read · no network
What we could not test
what the tools do when called with a real credential

Reasonable to connect. No credential asked for, no third-party host named, Started with a decoy AI_2KW_API_KEY, BACKBONE_API_KEY; tool list observed. Tool calls with a real credential not tested.

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-13 and scored it 86/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 48 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
7.7sprocessdependency install exit 0
28sprocessrelaunched with a decoy AI_2KW_API_KEY, BACKBONE_API_KEY (tagged; nothing real)
48sclaimed200 tools with a decoy AI_2KW_API_KEY, BACKBONE_API_KEY: 2kw_chat, 2kw_create_response, 2kw_get_response, 2kw_cancel_response, 2kw_list_models, 2kw_list_agents, 2kw_list_agent_catalog, 2kw_get_agent, 2kw_create_agent, 2kw_update_agent, 2kw_delete_agent, 2kw_list_agent_versions, 2kw_create_agent_version, 2kw_get_latest_agent_version, 2kw_list_agent_skills, 2kw_get_agent_version, 2kw_get_agent_version_policy, 2kw_deactivate_agent_version, 2kw_activate_agent_version, 2kw_list_agent_labels, 2kw_create_agent_label, 2kw_update_agent_label, 2kw_delete_agent_label, 2kw_list_agent_approvals, 2kw_decide_agent_approvals
48stoolsb26f7ff91bc41417
48stoolsce751f820eb28d85
48stoolsdf954ea0dd245ae7
48stools5c46714e43f447c0
48stools0fca4d28ac2ae94f
48stools1df44bab6ec84e33
48stools594bf719528dda2c
48stools9e83bc2cacda2dd7
48stools5e3b22bcb73837b4
48stools370f97fd8cad5048
48stools27798c877cca5d11
48stoolsa41841e6bb813f38
48stools3768870975f2c841
48stools8b04b9382fc218db
48stools52621cb85d110c71
48stools39b2fdda30bdd7d3
48stoolsb1f2b4e684ab958e
48stools608081f2fbb0d8b6
48stools5062035a67e14424
48stools6a1595a3091a510d
48stools7a1f7b827d8bc842
48stools219ba05482602512
48stools18c966cbabd90d37
48stoolsdd4805585ffcfff6
48stools9e19d86bd4b6544a
48stools20bedca042bb90e1
48stools13996c24236e9b78
48stools99450f09f71c604d
48stools7a3cd5edf5a1a591
48stools1919dde39f177afd
48stoolsf98d29f7ad20ac54
48stoolse75d13120a03a5b5
48stools8d8dda7454e1105e
48stools7c8df73b098de3c4
48stools04689e2996c6a12e
48stoolse3b72defcba62b2e
48stools1bbde522f3191ea1
48stoolsb04b381d398e95ec
48stools2a667caf5f5d01ab
48stools527aa10141ee92a0
48stools9610451cb245f9b4
48stoolse24702fc44aca225
48stools49166339618d389d
48stoolsb89d147b75ec4577
48stools49857cd5897af1e0
48stools241596b7a24ed7a4
48stools909f5bb9934eabc8
48stoolsd40e1d4b1a9317e0
48stools6c2d30299b12b17c
48stoolsa89aa78afccc5b3a
48stoolsde2e2045fa07d63c
48stools9de7f44a92a8b5c3
48stools639a88ed6a16d2d2
48stools402eff8af77f1306
48stools99dded6daec4534a
48stoolsd21647313abc06a5
48stoolsea6e4ad2bf0a3415
48stoolsdc86d5bf0dc0df0c
48stools8d645002d082219b
48stoolsd4148720f88c06d1
48stools9640c74753744f82
48stools701ee634723111da
48stoolse574b1379341241e
48stools5a02c70f424f8ef0
48stools6f630868f00d1201
48stools868c499c34ce7171
48stoolsa77d48cb2ef3adeb
48stoolsf72d85aa9d45cdb4
48stools7c12fd2c0983ca1f
48stools0ff4ea33744def2f
48stoolsfcd4d4c4063f624c
48stools021ec4dca3e43fa8
48stoolsdc4263be88e40f36
48stools5fd18d4522bc2593
48stools9eaa344910e2286b
48stools8103f0d898c8b60a
48stoolse04145004a412ff9
48stoolsaba83da5a9ca405a
48stoolsa895b16207570bc8
48stools17a1b1ab6e22035f
48sprocessscript backend runs setup only
48sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathspackage.json:37 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"generate:spec": "tsx --env-file=.env openapi/scripts/fetch-spec.ts",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationdist/tools/agents.js:272 · Auto-update or dynamic fetch configuration — agent may load new code at runtime… server.tool("2kw_create_agent_version", "Create a new version of an agent. Auto-updates the 'latest' label. Give its model as `model` (one model) or `models` (an ordered list whose first entry is the default); one of the two is required."…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Tool description instructs the agent: section addressed to the agentmcp:tools/2kw_create_agent_version:2 · Instruction aimed at the agent: section addressed to the agent},"instructions":{"description":"System instructions for the agent","type":"string"},"options":{"description":"Model and run oFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathspackage.json:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"check:spec": "tsx --env-file=.env openapi/scripts/check-drift.ts",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Tool description instructs the agent: section addressed to the agentmcp:tools/2kw_update_agent:2 · Instruction aimed at the agent: section addressed to the agent},"instructions":{"description":"System instructions for the agent","type":"string"},"options":{"description":"Model and run oFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Tool description instructs the agent: section addressed to the agentmcp:tools/2kw_create_agent:2 · Instruction aimed at the agent: section addressed to the agent},"instructions":{"description":"System instructions for the agent","type":"string"},"options":{"description":"Model and run oFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈95 tok
1 file · 78 in bundle
Tool list per prompt
≈28,988 tok
200 tools · 145 per tool
Handshake
4656 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 150

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @2kw/ai-mcp-server@8.2.1 as of 20 h ago. This is the package itself, not its dependencies.