Skills/npm/convex-mcp-gateway

convex-mcp-gateway@2.1.1

BLOCKED

Publisher claims: "Auth-aware Convex component that exposes selected Convex functions as MCP tools." Observed in sandbox: static analysis only — behavior not yet observed.

Registry npm (MCP server)Publisher tfohlmeister · joined 0 days agoInstalls 48,669Last detonated 2 h ago
Dispute verdict

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

CRITICAL
Access to sensitive file pathsREADME.md:378 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/client/mcp-handler.js:1977 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsREADME.md:602 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/client/mcp-handler.ts:3601 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Destructive file system command detecteddist/component/schema.js:78 · Destructive file system command detected
AST05
CRITICAL
Access to sensitive file pathsdist/client/mcp-handler.js:1991 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathssrc/client/mcp-handler.ts:3586 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/client/mcp-handler.js:2034 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
npx invocation of non-well-known packagedist/component/_generated/api.js:7 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packagedist/component/_generated/component.js:7 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packagedist/component/_generated/server.js:7 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packagesrc/component/_generated/server.ts:7 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packagedist/component/_generated/dataModel.js:7 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Destructive file system command detectedsrc/component/schema.ts:115 · Destructive file system command detected
AST05
HIGH
npx invocation of non-well-known packagesrc/component/_generated/component.ts:7 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packagedist/component/_generated/dataModel.d.ts:6 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packagedist/component/_generated/api.d.ts:6 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packagedist/component/_generated/component.d.ts:6 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packagesrc/component/_generated/api.ts:7 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageREADME.md:184 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packagesrc/component/_generated/dataModel.ts:7 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Access to sensitive file pathssrc/client/mcp-handler.ts:3649 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
npx invocation of non-well-known packagedist/component/_generated/server.d.ts:6 · npx invocation of non-well-known package — may execute untrusted code
AST06