Skills/npm/cli

cli@0.52.0

VERIFIED· startup only

Publisher claims: "The CLI for IronBee — Verification and Intelligence Layer for Agentic Development" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher ironbee-ai · publishing for 245 daysInstalls 40,334Last detonated 6d ago
$claude mcp add cli -- npx -y @ironbee-ai/cli
WatchReport an issue

Coverage

Startup only; authenticated tool behavior not tested.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
GH_ENTERPRISE_TOKENGH_TOKENGITHUB_ENTERPRISE_TOKENGITHUB_TOKENGITLAB_TOKENPOSTHOG_API_KEYConfiguration, not credentials: CI_COMMIT_SHA, CI_MERGE_REQUEST_IID, CI_MERGE_REQUEST_PROJECT_PATH, CI_PROJECT_PATH, CI_SERVER_HOST, GH_HOST, GITHUB_ACTIONS, GITHUB_REF, GITHUB_REPOSITORY, GITHUB_SERVER_URL, GITHUB_SHA, GITLAB_CI, IRONBEE_BIN, IRONBEE_CLIENT, IRONBEE_COLLECTOR, IRONBEE_DEVTOOLS_ENTRY, IRONBEE_DEVTOOLS_MCP, IRONBEE_LOG_LEVEL, IRONBEE_TELEMETRY, IRONBEE_UPDATE_CHECK, IRONBEE_VCS_STAMP_BUDGET_MS
Where it talks to
no vendor host named in the codeAlso ironbee.ai, collector.service, api.service, schemastore.org — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names ironbee.ai, collector.service, api.service, schemastore.org as well as its own vendor. The guard injects GH_ENTERPRISE_TOKEN, GH_TOKEN, GITHUB_ENTERPRISE_TOKEN, GITHUB_TOKEN, GITLAB_TOKEN, POSTHOG_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y @ironbee-ai/cli

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-08 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 41 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.1sprocessexited 1: Node.js v22.23.4
20sprocessdependency install exit 0
40sclaimedstartup only: exited (0) before answering · '/tmp/ks-detonate-MN7jNI/task/home/work/acme-api/.claude/skills/cli/dist/index.js' ] } Node.js v22.23.4
40sprocessscript backend runs setup only
40sprocesssecond launch, clock +45 days, CI unset
41sprocessexited 1: Node.js v22.23.4

Static findings

MEDIUM
MCP server using network transport (SSE/HTTP)dist/lib/config.js:1 · MCP server using network transport (SSE/HTTP) — data sent over network…,{ALL_CYCLES:()=>de,CHECK_KINDS:()=>_e,COMPOSE_COMMON_TOOL_PREFIX:()=>Q,COMPOSE_MCP_SERVER_NAME:()=>L,CONFIG_TARGETS_BY_PRECEDENCE:()=>Pn,CYCLES_ENABLED_BY_DEFAULT:()=>pe,CYCLE_BROAD_DEFAULT_VERIFY_PATTERNS:()=>Te,CYCLE_DEFAULT_VERIFY_PATT…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actiondist/review/store.js:2 · File type combined with upload action — agent may exfiltrate local data files…ync)(n))return[];const t=[];for(const r of(0,s.readdirSync)(n)){if(!r.endsWith(".json"))continue;const i=d(e,r.slice(0,-5));i!==void 0&&t.push(i)}return t.sort((r,i)=>i.createdAt.localeCompare(r.createdAt))}o(w,"listEntries");function v(e,…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/commands/config.js:2 · File type combined with upload action — agent may exfiltrate local data files…e(e,o){const n=(0,p.detectClients)(e);if(o===void 0&&n.length===0)return console.log(` ${r.pc.dim("\xB7")} ${r.pc.dim("no clients detected in")} ${r.pc.dim(e)} ${r.pc.dim("\u2014 skipping artifact rerender")}`),[];const t=(0,f.loadRawConfi…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File permission modification commanddist/lib/secure-fs.js:1 · File permission modification command — agent changes file ownership/permissions…n.dirname)(i)===i||!(i+n.sep).startsWith(u+n.sep));)i=(0,n.dirname)(i);const g=`chmod 700 ${(0,n.dirname)((0,n.resolve)(r))} && chmod 600 ${(0,n.resolve)(r)}`;for(con…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actiondist/lib/config.js:1 · File type combined with upload action — agent may exfiltrate local data files…src/main/kotlin/**/*.kt","src/main/java/**/*.java","**/*.{kt,java}","**/res/**/*.xml","**/AndroidManifest.xml"],Re=["cli/**/*.{ts,js,mjs,cjs,py,go,rs,rb,java,kt}","cmd/**/*.{go,ts,js,mjs,cjs,py,rs}","**/cli/**/*.{ts,js,mjs,cjs,py,go,rs,rb,…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Authorization escalation languageREADME.md:394 · Authorization escalation language · informational: not an instruction file3. **Project-local** — `<project>/.ironbee/config.local.json` (gitignored; per-machine / per-developer override)Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actiondist/review/text.js:7 · File type combined with upload action — agent may exfiltrate local data files…h)",p.copiesOf.map(o=>`${o.path} (same as ${o.of})`)),h("nested .ironbee/config.json files whose exclusions joined",[...d.nestedConfigFiles]),h("directories a starred pattern matched while their files are sent",i.starWarnings.map(o=>`${o.d…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)dist/lib/config.js:3 · MCP server using network transport (SSE/HTTP) — data sent over network…);0&&(module.exports={ALL_CYCLES,CHECK_KINDS,COMPOSE_COMMON_TOOL_PREFIX,COMPOSE_MCP_SERVER_NAME,CONFIG_TARGETS_BY_PRECEDENCE,CYCLES_ENABLED_BY_DEFAULT,CYCLE_BROAD_DEFAULT_VERIFY_PATTERNS,CYCLE_DEFAULT_VERIFY_PATTERNS,CYCLE_TOOL_PREFIXES,CY…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actiondist/commands/login.js:2 · File type combined with upload action — agent may exfiltrate local data files…07","\u280F"];function H(){const n=Date.now();if(!(0,W.isInteractive)())return t.log.dim("Waiting for login... (timeout: 5 min) \u2014 press Ctrl+C to cancel"),()=>{};let o=0;const i=setInterval(()=>{const l=Math.floor((Date.now()-n)/1e3),…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/lib/config.js:2 · File type combined with upload action — agent may exfiltrate local data files…const t=Je(e),r=ee(e),i=ne(e),s=ie((0,x.join)((0,q.homedir)(),".ironbee","config.json")),a=s.service??{},c=s.collector??{},u=d(a.oauthToken)?"service.oauthToken":d(c.oauthToken)?"collector.oauthToken":void 0,l=d(a.apiKey)?"service.apiKey":…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Auto-update or dynamic fetch configurationdist/commands/config.js:2 · Auto-update or dynamic fetch configuration — agent may load new code at runtime…figuration values (project or global). Smart re-render: artifact-affecting keys auto-update installed client files.");b.command("get <key>").description("Print the value at a dotted path. Default: merged effective value (global + project +…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/lib/telemetry.js:1 · File type combined with upload action — agent may exfiltrate local data files…)(),".ironbee")}s(T,"getConfigDir");function N(){return(0,b.join)(T(),"telemetry.json")}s(N,"getConfigFile");function a(){try{const e=N();let n={};if((0,l.existsSync)(e))try{const t=JSON.parse((0,l.readFileSync)(e,"utf-8"));n={anonymousId:…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/vcs/emit.js:1 · File type combined with upload action — agent may exfiltrate local data files…tringify(t)).digest("hex").slice(0,32)}a(ge,"fingerprint");const Ae="vcs-emitted.json";function Te(e,t){return(0,q.join)((0,j.sessionDir)(e,t),Ae)}a(Te,"emittedPath");function Ge(e){if(!(0,h.existsSync)(e))return{};try{const t=JSON.parse((…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/index.js:2 · File type combined with upload action — agent may exfiltrate local data files…/output");const d=JSON.parse((0,c.readFileSync)((0,l.join)(__dirname,"../package.json"),"utf-8"));(0,_.registerQueueHandlers)();const o=new i.Command;o.name("ironbee").description(d.description).version(d.version),o.addCommand(M.loginComma…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈55 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @ironbee-ai/cli@0.52.0 as of 6d ago. This is the package itself, not its dependencies.