Skills/npm/dataforseo-mcp-server

dataforseo-mcp-server@3.1.3

CAUTION

Publisher claims: "CLI and MCP server for DataForSEO API — browse documentation and make authenticated API requests" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher dataforseo · joined 0 days agoInstalls 61,032Last detonated 1 h ago
Dispute verdict

Behavior trace

Honeypot run · 3 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
2.5sprocessdependency install exit 1
2.8sprocessexec /usr/bin/timeout
2.8sprocessexited 1: Node.js v22.23.4
2.8sclaimedno tools/list reply (exit 1)
2.8sprocessscript backend runs setup only

Static findings

CRITICAL
Access to sensitive file pathsdist/core/env.js:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/core/docs/cache.js:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/core/env.js:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/core/api/client.js:7 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/core/docs/cache.js:26 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)README.md:3 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
CRITICAL
Access to sensitive file pathsdist/mcp/index-http.js:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
npx invocation of non-well-known packageREADME.md:12 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Access to sensitive file pathsdist/mcp/index-http.js:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
npx invocation of non-well-known packagedist/core/tools/api-request-tool.js:76 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageSKILL.md:31 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Access to sensitive file pathsdist/mcp/index-http.js:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
npx invocation of non-well-known packageREADME.md:18 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageREADME.md:63 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageSKILL.md:18 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Access to sensitive file pathsdist/core/mcp/args.js:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
npx invocation of non-well-known packageSKILL.md:14 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageREADME.md:67 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageSKILL.md:5 · npx invocation of non-well-known package — may execute untrusted code
AST06
MEDIUM
File type combined with upload actionREADME.md:229 · File type combined with upload action — agent may exfiltrate local data files
AST07
HIGH
npx invocation of non-well-known packageREADME.md:59 · npx invocation of non-well-known package — may execute untrusted code
AST06
MEDIUM
MCP server using network transport (SSE/HTTP)README.md:18 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)README.md:63 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)SKILL.md:176 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)SKILL.md:31 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)README.md:72 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)README.md:193 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04