cli@5.1.0
CAUTION· not startedPublisher claims: "Prebuilt CLI, development server, and build pipeline for mcp-use" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher mcp-use · publishing for 505 daysInstalls 140KLast detonated 2d ago
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
- no credential variables read in the code
- Where it talks to
- mcp-use.run (its own)Also manufact.com, githubusercontent.com, posthog.com — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it under the guard. Not started: dependency install failed; the server itself was not observed. The code names no credential variable and talks to mcp-use.run, its own; the guard pins the network to what the honeypot saw and logs every call.
$vet-skills run --net declared -- npx -y @mcp-use/cli
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-12 and scored it 72/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 13 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
13sprocessdependency install exit 1 · (Use `node --trace-warnings ...` to show where the warning was created) npm error Cannot read properties of null (reading 'edgesOut') npm error A complete log of this run can be found in: /tmp/ks-detonate-ZBK72P/task/home/.npm/_logs/2026-11-12T10_26_55_431Z-debug-0.log
13sclaimednot started: dependency install failed (exit 1); the server itself was not observed
13sprocessscript backend runs setup only
13sprocessno install scripts to re-run
Static findings
HIGH
Access to sensitive file pathsdist/agent-skills/openapi-to-mcp/SKILL.md:152 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…four common schemes and how each becomes a header. Required env vars belong in `.env.example` — that's the contract for whoever runs the server later. ### 8. Wire …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/commands/deploy.js:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.manufact/project.json. Uploads omit local credentials, .env files, dependencies,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/agent-skills/openapi-to-mcp/SKILL.md:287 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…, `src/auth.ts`, `src/operations.ts`, `src/schema.ts`, `scripts/load-spec.ts`, `.env.example`, and `tsconfig.json`. Each is annotated. - `references/auth.md` — The …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/chunk-YIDA3FUN.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…||n.devDependencies?.next!==void 0}catch{return!1}}function g(e,n){let t=r(e)?[`.env.${n}.local`,".env.local",`.env.${n}`,".env"]:[".env"];for(let o of t){let s=a(e…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/chunk-BBSCRGEB.js:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…iables from a dotenv file.",args:"<file>",options:v,examples:["mcp-use env push .env.production --environment production"]},rm:{summary:"Remove an environment varia…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/commands/deploy.js:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…"";return n===".DS_Store"||n==="Thumbs.db"||n==="desktop.ini"?!1:!n.startsWith(".env")}async function we(t,e){let n={},o=Pe(e.path);if((o===void 0||!q(e.path))&&(n.…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/agent-skills/openapi-to-mcp/SKILL.md:107 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05├── .env.example # Document required env vars (API_KEY, BASE_URL, etc.)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/agent-skills/openapi-to-mcp/SKILL.md:275 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05- `.env.example` lists every required env var with a short comment.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actiondist/commands/logout.js:15 · File type combined with upload action — agent may exfiltrate local data files
AST07…boolean"}},positionals:0,usage:m});if(!await p("Log out?",{yes:y.yes===!0,json:n.json}))return;let s=await a(),o=[],i=!1;if(s.apiKey!==void 0&&s.keyId!==void 0){try{i=(await l(s.apiKey)(c({apiKey:s.apiKey}).POST("/api/auth/api-key/delete",…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/commands/login.js:28 · File type combined with upload action — agent may exfiltrate local data files
AST07…de ${t.user_code}. `),i["no-open"]!==!0&&E(w),o=await p("Waiting for approval",n.json,async()=>K(await v(t.device_code,{intervalSeconds:t.interval,expiresInSeconds:t.expires_in})))}let u=await p("Signing in",n.json,()=>J(o,a,c));n.result(u…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Base64 encoding combined with network calldist/dist-TRMPOPRZ.js:19 · Base64 encoding combined with network call — potential data exfiltration
AST07…try:de(this,ua)})),Se(this,Me,this.CONNECTING),Se(this,Hr,3e3),Se(this,Hs,(s=r?.fetch)!=null?s:globalThis.fetch),Se(this,Vs,(o=r?.withCredentials)!=null?o:!1),et(this,Je,na).call(this)}get readyState(){return de(this,Me)}get url(){return d…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
File type combined with upload actiondist/chunk-BQFLKCUB.js:1 · File type combined with upload action — agent may exfiltrate local data files
AST07…{setTimeout(i,s)})}function P(s){process.env.MCP_USE_TUNNEL_DEBUG==="1"&&console.log(`[mcp-use] ${s}`)}function A(s){return typeof s=="string"&&/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(s)}function F(s,i…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/commands/build.js:3 · File type combined with upload action — agent may exfiltrate local data files
AST07…k(t):k(e.cwd,e.entry),o=await Y(e.cwd,c);(o==="created"||o==="updated")&&console.log(`[mcp-use] ${o} mcp-env.d.ts`);let r=se(e.cwd),d=e.viewsDir??(e.mcpDir===void 0?void 0:u(e.mcpDir,"views"));F(Z(e.cwd,d))||console.log("[mcp-use] views di…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
MCP server using network transport (SSE/HTTP)dist/start-YRL33M5Q.js:4 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04…ntry (${i}) has no default export. The server entry must \`export default\` its MCPServer instance (see the mcp-use entry contract).`);let e=c.default;if(!A(e))throw new Error(`The default export of ${i} is not an MCPServer: it has no list…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
npx invocation of non-well-known packagedist/agent-skills/openapi-to-mcp/SKILL.md:54 · npx invocation of non-well-known package — may execute untrusted code
AST06…reference. If the spec is Swagger 2.0, run it through `swagger2openapi` first (`npx swagger2openapi --outfile openapi.yaml swagger.yaml`). Sanity-check the dereferenced file: ope…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
MCP server using network transport (SSE/HTTP)dist/commands/dev.js:8 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04…l||typeof t!="object")throw new Error("The server entry must default-export the MCPServer instance (`export default server`) and never call listen() itself \u2014 `mcp-use dev` owns the socket.");let r=t;if(typeof r.fetch!="function")throw…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
File type combined with upload actiondist/commands/login.js:1 · File type combined with upload action — agent may exfiltrate local data files
AST07…("login_failed",`Could not start the device login (${e.status}).`);let n=await e.json();if(typeof n.device_code!="string"||typeof n.user_code!="string"||typeof n.verification_uri!="string"||typeof n.expires_in!="number"||typeof n.interval!…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/commands/screenshot.js:41 · File type combined with upload action — agent may exfiltrate local data files
AST07…patible_inspector",`Inspector health check failed (${n.status}).`);let r=await n.json();if(r.status!=="ok"||r.protocol!=="mcp-use-inspector-preview"||r.version!==1||!r.capabilities?.includes("view-preview"))throw new s("incompatible_inspec…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File permission modification commanddist/chunk-SAEWQLD5.js:1 · File permission modification command — agent changes file ownership/permissions
AST05…s n}from"./chunk-TH3EAS77.js";import{constants as s}from"fs";import{access as m,chmod as i,mkdir as c,readFile as d,rename as u,writeFile as p}from"fs/promises";impor…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File type combined with upload actiondist/chunk-M6WKA4PO.js:1 · File type combined with upload action — agent may exfiltrate local data files
AST07…erface as e}from"readline/promises";async function c(o,r){if(r.yes)return!0;if(r.json||!process.stdin.isTTY)throw new s(`${o} Pass --yes to confirm.`);let t=e({input:process.stdin,output:process.stdout});try{return(await t.question(`${o} […Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/commands/dev.js:5 · File type combined with upload action — agent may exfiltrate local data files
AST07…Q}){let se=k.$comment;if(Q.$comment===!0)z.code((0,i._)`${u.default.self}.logger.log(${se})`);else if(typeof Q.$comment=="function"){let Re=(0,i.str)`${Z}/$comment`,be=z.scopeValue("root",{ref:q.root});z.code((0,i._)`${u.default.self}.opts…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/dist-TRMPOPRZ.js:7 · File type combined with upload action — agent may exfiltrate local data files
AST07…X}){let se=A.$comment;if(X.$comment===!0)T.code((0,i._)`${l.default.self}.logger.log(${se})`);else if(typeof X.$comment=="function"){let ve=(0,i.str)`${Y}/$comment`,$e=T.scopeValue("root",{ref:N.root});T.code((0,i._)`${l.default.self}.opts…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/commands/deploy.js:4 · File type combined with upload action — agent may exfiltrate local data files
AST07…,deploymentId:u}}async function J(t){try{let e=JSON.parse(await et(`${t}/package.json`,"utf8"));if(e!==null&&typeof e=="object"&&"name"in e&&typeof e.name=="string"&&e.name.trim())return e.name}catch{}return Qe(t)}async function Te(t){let …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagedist/agent-skills/openapi-to-mcp/SKILL.md:64 · npx invocation of non-well-known package — may execute untrusted code
AST06npx create-mcp-use-app@latest <project-name> --template blankFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actiondist/dist-TRMPOPRZ.js:21 · File type combined with upload action — agent may exfiltrate local data files
AST07…).join(", ");f+=` Response Headers: {${d}}`}y||u>=400?console.error(f):console.log(f)});return c=>async(i,l)=>{let u=performance.now(),m=l?.method||"GET",_=typeof i=="string"?i:i.toString(),w=r?new Headers(l?.headers):void 0;try{let S=awai…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/dist-TRMPOPRZ.js:19 · File type combined with upload action — agent may exfiltrate local data files
AST07… to load well-known OAuth protected resource metadata.`);return ps.parse(await s.json())}async function Nu(e,t,r=fetch){let s=ct(r);try{return await s(e,{headers:t})}catch(o){if(!(o instanceof TypeError)||!nu)throw o;if(t)try{return await …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagedist/agent-skills/openapi-to-mcp/SKILL.md:67 · npx invocation of non-well-known package — may execute untrusted code
AST06npx create-mcp-use-app@latest <project-name> --template mcp-appsFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/agent-skills/openapi-to-mcp/SKILL.md:72 · npx invocation of non-well-known package — may execute untrusted code
AST06…ng-agent skills by default too; that's fine. Verify the template catalog with `npx create-mcp-use-app@latest --list-templates` if it's been a while — the available set is `blank`, `mcp-ser…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File permission modification commanddist/chunk-2MNZ3N5B.js:6 · File permission modification command — agent changes file ownership/permissions
AST05…mport{spawn as le}from"child_process";import{readFileSync as de}from"fs";import{chmod as pe,mkdir as me}from"fs/promises";import{dirname as fe,join as R,resolve as ge…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File type combined with upload actiondist/chunk-2MNZ3N5B.js:26 · File type combined with upload action — agent may exfiltrate local data files
AST07…valid JSON: ${n instanceof Error?n.message:String(n)}`)}}function ie(e){return e.json||e.noOpen||!process.stdin.isTTY?"never":"ask"}async function Ne(){let e=Re({input:process.stdin,output:process.stderr});try{await e.question("This server…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/commands/dev.js:8 · File type combined with upload action — agent may exfiltrate local data files
AST07…op-tunnel"),i=new URL(s.url).pathname;if(s.method==="GET"&&i===a)return Response.json(r());if(s.method==="POST"&&i===o)try{return await e.tunnel.start(e.port),Response.json({ok:!0,restarting:!1})}catch(u){let y=u instanceof Error?u.message…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/commands/build.js:2 · File type combined with upload action — agent may exfiltrate local data files
AST07…{...e,entry:b(e.entry,t,i),css:e.css.map(a=>b(a,t,i))}}function J(e,i,n){console.log(`[mcp-use] MCP_ASSETS_URL set \u2014 publish ${S(e,i).replaceAll("\\","/")}/ at ${n}`)}async function Oe(e,i){let n=await we({cwd:i.cwd,cacheDir:i.cacheDi…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/commands/deploy.js:38 · File type combined with upload action — agent may exfiltrate local data files
AST07.manufact/project.json. Uploads omit local credentials, .env files, dependencies,Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/commands/build.js:4 · File type combined with upload action — agent may exfiltrate local data files
AST07…t,`${JSON.stringify(h,null,2)} `);let be=Math.round(performance.now()-i);console.log(`[mcp-use] built ${S(e.cwd,c)} \u2192 ${S(e.cwd,r.build)}/${y} (${be}ms)`);return}await le(r.build,{recursive:!0,force:!0});let _=u(r.build,"views");await…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Unicode escape sequence detecteddist/chunk-7R3IMNAZ.js:58 · Unicode escape sequence detected — may contain obfuscated payloads
AST07…]??null}let i={regex:"\u0645\u062F\u062E\u0644",email:"\u0628\u0631\u064A\u062F \u0625\u0644\u0643\u062A\u0631\u0648\u0646\u064A",url:"\u0631\u0627\u0628\u0637",emoji:"\u0625\u064A\u0645\u0648\u062C\u064A",uu…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
File type combined with upload actiondist/commands/deployments.js:1 · File type combined with upload action — agent may exfiltrate local data files
AST07…remove"].includes(t)&&!await E(`${t} deployment ${u[0]}?`,{yes:r.yes===!0,json:n.json})){n.result({cancelled:!0},"Cancelled.");return}let e=await w(r);if(t==="list"){let o=r.server??process.env.MANUFACT_SERVER,p=await e.call(e.client.GET("…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagedist/agent-skills/openapi-to-mcp/SKILL.md:217 · npx invocation of non-well-known package — may execute untrusted code
AST06npx mcp-use client connect dev http://localhost:3000/mcpFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actiondist/commands/domains.js:3 · File type combined with upload action — agent may exfiltrate local data files
AST07…ort.");if(e==="rm"&&!await C("Remove this custom domain?",{yes:o.yes===!0,json:t.json}))return;let{cloud:n,server:D}=await w(o),c=await n.call(n.client.GET("/api/v1/servers/{id}",{params:{path:{id:D}}})),r=c.id,l=`${g()}/cloud/${encodeURIC…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/chunk-HRH5QADJ.js:1 · File type combined with upload action — agent may exfiltrate local data files
AST07…MANUFACT_TOKEN","MCP_USE_API_KEY"];function j(){return ne(te(),".manufact","auth.json")}function re(){return ne(te(),".mcp-use","config.json")}async function A(){let e=j();return await M(e)||await Re(e),L(e,{})}async function Te(e){await H…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/commands/deploy.js:5 · File type combined with upload action — agent may exfiltrate local data files
AST07…ble","Git is unavailable. Use --no-github to upload local source.");await le(r,r.json===!0),m=await ot(await Te(e),r);let g=await e.call(e.client.POST("/api/v1/github/installations/{installationId}/repos",{params:{path:{installationId:m.in…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.Cost to the agent
Instructions loaded
≈10,150 tok
6 files · 80 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for @mcp-use/cli@5.1.0 as of 2d ago. This is the package itself, not its dependencies.
What would make this Verified
8 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim mcp-use: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Obfuscated code≈ +5 on the totalRemove base64-assembled strings, eval of decoded text and minified blobs. Reviewers and scanners both treat unreadable code as hostile.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Base64 encoding combined with network call≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
- File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
- MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim mcp-usePropose a patch to the maintainer