Skills/npm/ai-mcp-server

ai-mcp-server@8.3.0

VERIFIED

Publisher claims: "MCP server for 2kw.ai — EU-hosted AI platform: OpenAI-compatible LLM gateway, schema-driven document extraction, transcription, agents with a knowledge base, and cost observability. 199 tools for Claude Code, Cursor, and Windsurf." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server) · listed in the official MCP RegistryPublisher 2kw · publishing for 203 daysInstalls 10,738Last detonated 59 min ago
$claude mcp add ai-mcp-server -- npx -y @2kw/ai-mcp-server
WatchReport an issue

Coverage

Started with a decoy AI_2KW_API_KEY, BACKBONE_API_KEY; tool list observed. Tool calls with a real credential not tested.
Tested
server startup with a tagged decoy in AI_2KW_API_KEY, BACKBONE_API_KEY · MCP initialize and tools/list · every tool description, for hidden instructions · where the decoy credential went · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with a real credential
Needs
AI_2KW_API_KEY, BACKBONE_API_KEY — give it to the server where it runs, through vet-skills run --secrets, so the value never enters the server's environment. Never paste a credential into a chat, a ticket or a report.

Before you give it your token

It will ask for
no credential variables read in the code; at startup it asked for AI_2KW_API_KEY, BACKBONE_API_KEY
Where it talks to
2kw.ai (its own)
What the honeypot saw
no credential files read · no network
What we could not test
what the tools do when called with a real credential

Reasonable to connect. No credential asked for, no third-party host named, Started with a decoy AI_2KW_API_KEY, BACKBONE_API_KEY; tool list observed. Tool calls with a real credential not tested.

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-15 and scored it 85/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 49 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
8.8sprocessdependency install exit 0
29sprocessrelaunched with a decoy AI_2KW_API_KEY, BACKBONE_API_KEY (tagged; nothing real)
49sclaimed207 tools with a decoy AI_2KW_API_KEY, BACKBONE_API_KEY: 2kw_chat, 2kw_create_response, 2kw_get_response, 2kw_cancel_response, 2kw_list_models, 2kw_list_agents, 2kw_list_agent_catalog, 2kw_get_agent, 2kw_create_agent, 2kw_update_agent, 2kw_delete_agent, 2kw_get_agent_access, 2kw_set_agent_access, 2kw_list_agent_versions, 2kw_create_agent_version, 2kw_get_latest_agent_version, 2kw_list_agent_skills, 2kw_get_agent_version, 2kw_get_agent_version_policy, 2kw_deactivate_agent_version, 2kw_activate_agent_version, 2kw_list_agent_labels, 2kw_create_agent_label, 2kw_update_agent_label, 2kw_delete_agent_label
49stoolsb26f7ff91bc41417
49stoolsce751f820eb28d85
49stoolsdf954ea0dd245ae7
49stools5c46714e43f447c0
49stools0fca4d28ac2ae94f
49stools1df44bab6ec84e33
49stools2cba8f7f4433177a
49stools9e83bc2cacda2dd7
49stools461fd186013d394a
49stools370f97fd8cad5048
49stools27798c877cca5d11
49stoolse50e7007086518ee
49stoolsacb7610b10e47a08
49stoolsa41841e6bb813f38
49stools3768870975f2c841
49stools8b04b9382fc218db
49stools71c3f59d5d763250
49stools39b2fdda30bdd7d3
49stoolsb1f2b4e684ab958e
49stools608081f2fbb0d8b6
49stools5062035a67e14424
49stools6a1595a3091a510d
49stools7a1f7b827d8bc842
49stools219ba05482602512
49stools18c966cbabd90d37
49stoolsdd4805585ffcfff6
49stools9e19d86bd4b6544a
49stools20bedca042bb90e1
49stools13996c24236e9b78
49stools99450f09f71c604d
49stools7a3cd5edf5a1a591
49stools1919dde39f177afd
49stoolsf98d29f7ad20ac54
49stoolse75d13120a03a5b5
49stools8d8dda7454e1105e
49stools7c8df73b098de3c4
49stools440be43215920b19
49stools0da0449859c17897
49stools4978822c02c32e90
49stools615362e824c8f8fb
49stools7d8283f0dc569de3
49stools04689e2996c6a12e
49stoolse3b72defcba62b2e
49stools1bbde522f3191ea1
49stoolsb04b381d398e95ec
49stools2a667caf5f5d01ab
49stools527aa10141ee92a0
49stools9610451cb245f9b4
49stoolse24702fc44aca225
49stools49166339618d389d
49stoolsb89d147b75ec4577
49stools49857cd5897af1e0
49stools241596b7a24ed7a4
49stools909f5bb9934eabc8
49stoolsd40e1d4b1a9317e0
49stools6c2d30299b12b17c
49stoolsa89aa78afccc5b3a
49stoolsde2e2045fa07d63c
49stools9de7f44a92a8b5c3
49stools639a88ed6a16d2d2
49stools402eff8af77f1306
49stools99dded6daec4534a
49stoolsd21647313abc06a5
49stoolsea6e4ad2bf0a3415
49stoolsdc86d5bf0dc0df0c
49stools8d645002d082219b
49stoolsd4148720f88c06d1
49stools9640c74753744f82
49stools701ee634723111da
49stoolse574b1379341241e
49stools5a02c70f424f8ef0
49stools6f630868f00d1201
49stools868c499c34ce7171
49stoolsa77d48cb2ef3adeb
49stoolsf72d85aa9d45cdb4
49stools7c12fd2c0983ca1f
49stools0ff4ea33744def2f
49stoolsfcd4d4c4063f624c
49stools021ec4dca3e43fa8
49stoolsdc4263be88e40f36
49sprocessscript backend runs setup only
49sprocessno install scripts to re-run

Static findings

MEDIUM
File type combined with upload actiondist/tools/batches.js:68 · File type combined with upload action — agent may exfiltrate local data files…as one ZIP and save it to a local path: a folder per succeeded item and a report.csv listing every item with its status, reason and outputs. While the batch runs, the ZIP holds the items finished so far.", { ba…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Tool description instructs the agent: section addressed to the agentmcp:tools/2kw_create_agent:2 · Instruction aimed at the agent: section addressed to the agent},"instructions":{"description":"System instructions for the agent","type":"string"},"options":{"description":"Model and run oFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Tool description instructs the agent: section addressed to the agentmcp:tools/2kw_update_agent:2 · Instruction aimed at the agent: section addressed to the agent},"instructions":{"description":"System instructions for the agent","type":"string"},"options":{"description":"Model and run oFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Auto-update or dynamic fetch configurationdist/tools/agents.js:313 · Auto-update or dynamic fetch configuration — agent may load new code at runtime… server.tool("2kw_create_agent_version", "Create a new version of an agent. Auto-updates the 'latest' label. Give its model as `model` (one model) or `models` (an ordered list whose first entry is the default); one of the two is required."…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathspackage.json:37 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"generate:spec": "tsx --env-file=.env openapi/scripts/fetch-spec.ts",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathspackage.json:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"check:spec": "tsx --env-file=.env openapi/scripts/check-drift.ts",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Tool description instructs the agent: section addressed to the agentmcp:tools/2kw_create_agent_version:2 · Instruction aimed at the agent: section addressed to the agent},"instructions":{"description":"System instructions for the agent","type":"string"},"options":{"description":"Model and run oFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈95 tok
1 file · 80 in bundle
Tool list per prompt
≈30,354 tok
207 tools · 147 per tool
Handshake
4948 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 152

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @2kw/ai-mcp-server@8.3.0 as of 25 min ago. This is the package itself, not its dependencies.