Skills/npm/coolify-mcp

coolify-mcp@3.10.1

BLOCKED

Publisher claims: "MCP server for Coolify — 46 optimized tools for infrastructure management, diagnostics, and documentation search" Observed in sandbox: sends data to localhost.

Registry npm (MCP server)Publisher masonator · publishing for 620 daysInstalls 12,706Last detonated 1 h ago
What would fix thisWatchDispute verdict

Coverage

Started with a decoy COOLIFY_ACCESS_TOKEN; tool list observed. Tool calls with a real credential not tested.
Tested
server startup with a tagged decoy in COOLIFY_ACCESS_TOKEN · MCP initialize and tools/list · every tool description, for hidden instructions · where the decoy credential went · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with a real credential
Needs
COOLIFY_ACCESS_TOKEN — give it to the server where it runs, through vet-skills run --secrets, so the value never enters the server's environment. Never paste a credential into a chat, a ticket or a report.

Before you give it your token

It will ask for
CF_ACCESS_CLIENT_SECRETCOOLIFY_ACCESS_TOKENCOOLIFY_ACCESS_TOKEN_FILEMCP_ACCESS_TOKEN_TTLMCP_OAUTH_STATE_FILEMCP_REFRESH_TOKEN_TTLConfiguration, not credentials: CF_ACCESS_CLIENT_ID, COOLIFY_BASE_URL, COOLIFY_INSTANCES, COOLIFY_MCP_AUDIT, COOLIFY_MCP_ELICITATION, COOLIFY_MCP_REQUIRE_HUMAN, COOLIFY_UI_URL, MCP_ALLOW_INSECURE_HTTP, MCP_CLIENT_IP_HEADER, MCP_HOST, MCP_PORT, MCP_PUBLIC_URL, MCP_READONLY, MCP_REDIRECT_HOSTS, MCP_REQUEST_STATE_KEY, MCP_TRANSPORT
Where it talks to
no vendor host named in the codeAlso coolify.io, coollabs.io, evil.example — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · contacted localhost (undeclared)
What we could not test
what the tools do when called with a real credential

Do not connect it. The honeypot or a critical finding blocked this version; the evidence is below.

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-15 and scored it 47/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Access to sensitive file paths; Prompting user to enter sensitive credentials; Pipe-to-shell pattern. Summary: sends data to localhost.

Behavior trace

Honeypot run · 55 s · 2 scenarios
t+CategoryObserved action
0.0sprocessno install scripts in bundle
15sprocessdependency install exit 0
35sprocessrelaunched with a decoy COOLIFY_ACCESS_TOKEN (tagged; nothing real)
55snetworkCONNECT tcp://localhost:3000 · not in the allow-list, refused
55sclaimed46 tools with a decoy COOLIFY_ACCESS_TOKEN: get_version, get_mcp_version, get_infrastructure_overview, diagnose_app, diagnose_server, find_issues, list_servers, get_server, coolify_url, server_resources, server_domains, list_destinations, validate_server, projects, environments, list_applications, get_application, application, logs, application_logs, list_databases, get_database, database, list_services, get_service
55stools687513c78a486f56
55stools32dcf1b5206b2509
55stools0431a386a586d640
55stools9bcf436ccc1a9949
55stools3bceab68bbdca492
55stools61a448e078289ecf
55stools63c66f11612b5c23
55stools57f0b23074773835
55stools253a16f41b002be2
55stools39f811536c596c16
55stools7270a7e081587b95
55stoolse880930cd33a08a5
55stools0a1583cda5d7083b
55stools58d0496384f58c44
55stools3c5848f475cc9d09
55stoolsd39d5f7fe5077f3f
55stools313413927eb07844
55stools37e9aeeb7a7954e3
55stools7be614e1e49f5675
55stools0ccd0e1aef2ae93b
55stoolsb93abda35f30d046
55stools01030c80631855ac
55stools5606ce7a2c37865b
55stoolsceb167a2cde30f6a
55stools1c7d9f6f9a502430
55stoolsa178ddcfc6efcecc
55stools9fe2c0d9da41eb47
55stools1ecebf43ec3e1692
55stools53d4e7d5d6a177a6
55stools3a05a7fe95fd9359
55stools18970105d4751e67
55stools631173db24b0c788
55stools5f6b1ad2296e5135
55stoolsba4ac7beb10d5224
55stools2f0418c070371a3d
55stools0b061b38c37ea643
55stools61d8926b4644d730
55stoolsaa83740c826dd46a
55stools2287f906846b40cc
55stools6ef718cd4687d1e2
55stools2a7dc0c50a0c6da5
55stoolse75aa2d55998b58d
55stools986f691383180a20
55stoolsae02d01e65649e3a
55stoolse416d1f5fc1d4d54
55stools76f2c5064b88694e
55sprocessscript backend runs setup only
55sprocessno install scripts to re-run

Static findings

MEDIUM
File type combined with upload actiondist/data/coolify-docs.json:7 · File type combined with upload action — agent may exfiltrate local data files…/tls-certificates): Manage Traefik ACME certificates and restore backups of acme.json.\n- [Custom SSL Certificates](https://coolify.io/docs/core/networking/proxy/traefik/custom-ssl-certs): Load certificates from a Coolify server into Traef…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File permission modification commanddist/__tests__/startup-check.test.js:235 · File permission modification command — agent changes file ownership/permissions// root-owned /data on machines where the chmod case below cannot run.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packagedist/lib/coolify-client.d.ts:108 · npx invocation of non-well-known package — may execute untrusted codeexport declare const DOCTOR_POINTER = "To diagnose, run `npx @masonator/coolify-mcp doctor` with this server's environment.";Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
MCP server using network transport (SSE/HTTP)dist/__tests__/mcp-server.test.js:1037 · MCP server using network transport (SSE/HTTP) — data sent over networkconst strict = new CoolifyMcpServer({ baseUrl: 'http://localhost:3000', accessToken: 'test-token' }, { requireElicitation: true });Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Access to sensitive file pathsdist/__tests__/oauth.test.js:97 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'file://localhost/etc/passwd',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Privileged sudo commanddist/__tests__/elicitation.test.js:443 · Privileged sudo command — agent may execute with elevated privilegesexpect(sanitizeForPrompt('`sudo rm -rf`')).toBe('sudo rm -rf');Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathsdist/__tests__/startup-check.test.js:43 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// A shared .env between a stdio config and an HTTP deployment must notFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathsdist/__tests__/ssrf.test.js:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'file:///etc/passwd',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)dist/__tests__/mcp-server.test.js:1045 · MCP server using network transport (SSE/HTTP) — data sent over networkconst strict = new CoolifyMcpServer({ baseUrl: 'http://localhost:3000', accessToken: 'test-token' }, { requireElicitation: true });Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathsdist/lib/startup-check.d.ts:26 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* shared .env with an unexpanded Coolify magic var) must not stop a stdioFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathsdist/__tests__/integration/helpers.js:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// otherwise wins over .env and silently skips every test — and a skipped suiteFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
URL to the cloud instance metadata addressdist/__tests__/ssrf.test.js:45 · URL to the cloud instance metadata address — reads the VM's credentials'https://169.254.169.254/latest/meta-data',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)dist/__tests__/mcp-server.test.js:1053 · MCP server using network transport (SSE/HTTP) — data sent over networkconst asker = new CoolifyMcpServer({ baseUrl: 'http://localhost:3000', accessToken: 'test-token' }, { requireElicitation: true });Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Remote installer piped to shelldist/lib/coolify-client.js:250 · Remote installer piped to shell…backups`, which schedules database dumps and works on older versions. Upgrade: `curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash -s 4.2.0`'; } if (status === 422 && /\/storages$/.test(path)) { …Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
URL to the cloud instance metadata addressdist/__tests__/oauth.test.js:1122 · URL to the cloud instance metadata address — reads the VM's credentialsawait expect(provider.resolveClient('https://169.254.169.254/latest/client.json')).rejects.toThrow(/could not be fetched/);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)dist/__tests__/audit.test.js:216 · MCP server using network transport (SSE/HTTP) — data sent over networkconst server = new CoolifyMcpServer({ baseUrl: 'http://localhost:3000', accessToken: 'test-token' }, { auditByDefault: true });Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
CRITICAL
Prompting user to enter sensitive credentialsdist/lib/startup-check.js:226 · Prompting user to enter sensitive credentials — social engineering'Re-paste the token without it.');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Remote installer piped to shelldist/lib/coolify-client.js:239 · Remote installer piped to shell…may be wrong, or belong to a different resource type than this route. Upgrade: `curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash -s 4.2.0`'; } if (status === 404 && /\/storages\/[\w-]+\/backups(\/run)…Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
CRITICAL
Pipe-to-shell patterndist/lib/coolify-client.js:250 · Pipe-to-shell pattern — downloads and immediately executes remote code…backups`, which schedules database dumps and works on older versions. Upgrade: `curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash -s 4.2.0`'; } if (status === 422 && /\/storages$/.test(path)) { …Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Access to sensitive file pathsdist/__tests__/audit.test.js:51 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesexpect(pickUuids({ uuid: '../../etc/passwd' })).toBeUndefined();Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
URL with embedded credentialsdist/__tests__/ssrf.test.js:41 · URL with embedded credentials — may be phishing or credential leaking'https://user:[email protected]/x',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
File permission modification commandpackage.json:24 · File permission modification command — agent changes file ownership/permissions"build": "tsc && shx mkdir -p dist/data && shx cp src/data/*.json dist/data/ && shx chmod +x dist/*.js",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
LOW
URL to a private-network addressdist/__tests__/startup-check.test.js:370 · URL to a private-network address — a LAN or development target['http://10.0.0.5:8000', false],Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL with embedded credentialsdist/__tests__/oauth.test.js:943 · URL with embedded credentials — may be phishing or credential leaking['https://user:[email protected]/client.json', 'userinfo'],Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
CRITICAL
Pipe-to-shell patterndist/lib/coolify-client.js:216 · Pipe-to-shell pattern — downloads and immediately executes remote code…application) require Coolify v4.2+. Check version with `get_version`. Upgrade: `curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash -s 4.2.0`'; } if (status === 404 && /\/destinations(\/|$)/.test(path)) …Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
MCP server using network transport (SSE/HTTP)dist/__tests__/mcp-server.test.js:1010 · MCP server using network transport (SSE/HTTP) — data sent over networkconst strict = new CoolifyMcpServer({ baseUrl: 'http://localhost:3000', accessToken: 'test-token' }, { requireElicitation: true });Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)dist/__tests__/audit.test.js:161 · MCP server using network transport (SSE/HTTP) — data sent over networkconst server = new CoolifyMcpServer({ baseUrl: 'http://localhost:3000', accessToken: 'test-token' }, options);Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Destructive file system command detecteddist/__tests__/coolify-client.test.js:4605 · Destructive file system command detectedcommand: 'rm -rf /tmp/*',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/lib/startup-check.js:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* shared .env with an unexpanded Coolify magic var) must not stop a stdioFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detecteddist/__tests__/coolify-client.test.js:4582 · Destructive file system command detectedcommand: 'rm -rf /tmp/*',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/index.js:9 · npx invocation of non-well-known package — may execute untrusted code// `npx @masonator/coolify-mcp doctor` (#368): diagnose the environment andFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Destructive file system command detecteddist/__tests__/coolify-client.test.js:4592 · Destructive file system command detectedcommand: 'rm -rf /tmp/*',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shelldist/lib/coolify-client.js:216 · Remote installer piped to shell…application) require Coolify v4.2+. Check version with `get_version`. Upgrade: `curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash -s 4.2.0`'; } if (status === 404 && /\/destinations(\/|$)/.test(path)) …Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
CRITICAL
Pipe-to-shell patterndist/lib/coolify-client.js:239 · Pipe-to-shell pattern — downloads and immediately executes remote code…may be wrong, or belong to a different resource type than this route. Upgrade: `curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash -s 4.2.0`'; } if (status === 404 && /\/storages\/[\w-]+\/backups(\/run)…Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file pathsdist/data/coolify-docs.json:7 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…cli/command-reference/commands/app/env-sync): Sync environment variables from a .env file\n- [Env update](https://coolify.io/docs/cli/command-reference/commands/app…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Prompting user to enter sensitive credentialsdist/lib/startup-check.js:230 · Prompting user to enter sensitive credentials — social engineering'Coolify rejects every request with 401. Re-paste the token without it.');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Access to sensitive file pathsdist/__tests__/token-source.test.js:233 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst run = async (env) => (await runDoctor({ COOLIFY_BASE_URL: 'https://coolify.example.com', ...env }, offline)).instances[0].checks.find((c) => c.check === 'config');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/lib/coolify-client.js:148 · npx invocation of non-well-known package — may execute untrusted codeexport const DOCTOR_POINTER = "To diagnose, run `npx @masonator/coolify-mcp doctor` with this server's environment.";Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
MCP server using network transport (SSE/HTTP)dist/__tests__/mcp-server.test.js:1024 · MCP server using network transport (SSE/HTTP) — data sent over networkconst strict = new CoolifyMcpServer({ baseUrl: 'http://localhost:3000', accessToken: 'test-token' }, { requireElicitation: true });Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04

Cost to the agent

Instructions loaded
≈67 tok
1 file · 81 in bundle
Tool list per prompt
≈8,303 tok
46 tools · 181 per tool
Handshake
1259 ms
launch to tools/list, stdio
Undocumented tools
6
description under 20 chars · avg 165

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @masonator/coolify-mcp@3.10.1 as of 24 min ago. This is the package itself, not its dependencies.

What would make this Verified

33 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Contacts a host you did not declare≈ +23 on the totalList every host you talk to in SKILL.md frontmatter (`network: [api.example.com]`), or stop contacting the ones you cannot justify.
  2. Prompting user to enter sensitive credentials≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  4. Unclaimed publisher≈ +8 on the totalClaim masonator: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  5. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  6. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim masonatorPropose a patch to the maintainer