Skills/npm/e-arveldaja-mcp

e-arveldaja-mcp@0.42.0

CAUTION· startup only

Publisher claims: "MCP server for Estonian e-arveldaja (e-Financials) API" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher iseppo · publishing for 243 daysInstalls 5,794Last detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
EARVELDAJA_API_KEY_FILEEARVELDAJA_API_KEY_IDEARVELDAJA_API_PASSWORDNO_API_CREDENTIALS_FOUND_MESSAGEConfiguration, not credentials: EARVELDAJA_API_PUBLIC_VALUE, EARVELDAJA_AUDIT_LANG, EARVELDAJA_CONFIG_DIR, EARVELDAJA_DEBUG, EARVELDAJA_DISABLE_ANNUAL_REPORT, EARVELDAJA_DISABLE_LIGHTYEAR, EARVELDAJA_DISABLE_PRODUCTS, EARVELDAJA_DISABLE_PROGRESS, EARVELDAJA_DISABLE_REFERENCE_ADMIN, EARVELDAJA_DISABLE_SALES, EARVELDAJA_DISABLE_TAX_TOOLS, EARVELDAJA_DOCUMENT_READING, EARVELDAJA_EXPOSE_GRANULAR_TOOLS, EARVELDAJA_EXPOSE_SETUP_TOOLS, EARVELDAJA_LOCK_DIR, EARVELDAJA_LOG_FILE, EARVELDAJA_PROFILE, EARVELDAJA_SERVER
Where it talks to
no vendor host named in the codeAlso rik.ee, emta.ee, europa.eu, ipify.org — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names rik.ee, emta.ee, europa.eu, ipify.org as well as its own vendor. The guard injects EARVELDAJA_API_KEY_FILE, EARVELDAJA_API_KEY_ID, EARVELDAJA_API_PASSWORD, NO_API_CREDENTIALS_FOUND_MESSAGE only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y e-arveldaja-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-09 and scored it 78/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 31 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
11sprocessdependency install exit 0
31sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-S4E6oq/task/home/work/acme-api/.claude/skills/e-arveldaja-mcp/dist/server-bootstrap.js' } Node.js v22.23.4
31sprocessscript backend runs setup only
31sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsdist/config.d.ts:221 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* would silently replace the guided surface: recommend env/.env or a temporaryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/config.js:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst GLOBAL_ENV_FILE_NAME = ".env";Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/config.js:175 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* would silently replace the guided surface: recommend env/.env or a temporaryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/config.d.ts:315 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** Read-only content fingerprint of the destination .env, for drift detection. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/config.d.ts:271 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* Env vars and .env are the canonical config sources. apikey*.txt remains aFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/config.d.ts:251 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* primitive as the credential .env writer; the two paths must never diverge.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/config.d.ts:228 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* otherwise the steps point at the environment variables / .env file plus theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/config.js:180 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn `The ${toolProfile} profile does not register the credential-import tools. Add the credentials through the environment variables or a local or shared .env file — no profile change is needed. `Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Collapsed <details> block carrying instructionsREADME.md:168 · Collapsed <details> block carrying instructions<summary>Building from source</summary> ```bash git clone https://github.com/iseppo/e-arveldaja-mcp.git cd e-arveldaja-mcp npm install && npm run build # Then uFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsdist/prompts.js:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files: `- ${credentialImportUnavailableAdvice(toolProfile)} The environment variable names and \`.env\` locations are in the \`setup\` run data.`}Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commanddist/config.js:256 · File permission modification command — agent changes file ownership/permissions`(mode ${(info.mode & 0o777).toString(8)}). Skipping. Run: chmod 600 ${escapeForLog(envPath)}\n`);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commanddist/config.js:107 · File permission modification command — agent changes file ownership/permissions`(mode ${(stats.mode & 0o777).toString(8)}). Run: chmod 600 ${escapeForLog(filePath)}\n`);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commanddist/config.js:1169 · File permission modification command — agent changes file ownership/permissions// byte-identical across the permission repair below (chmod only), so a matchingFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commanddist/stderr-tee.d.ts:9 · File permission modification command — agent changes file ownership/permissions* permission-hardening failure paths (a real chmod on an owned file succeedsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsdist/config.js:185 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…) or with EARVELDAJA_PROFILE=full; otherwise use the environment variables or a .env file."; } /** * Setup next steps. The credential-management tools (import_apik…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiondist/limited-vat.js:425 · File type combined with upload action — agent may exfiltrate local data files…nknown") { return "Ettevõtte käibemaksustaatus ei ole teada (limited-vat.json ei ole loetav või EMTA KMKR päring ei andnud KMKR numbri kohta vastust), seega ei saa otsustada, kas sisendkäibemaks või pöördmaksustamine kehtib. Käibemaksust s…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsdist/prompts.js:31 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…nt supports prompts, the server may offer to verify it and save the resulting \`.env\` either only for this folder or so it works when you start the MCP server from…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commanddist/stderr-tee.js:83 · File permission modification command — agent changes file ownership/permissions// fd (no TOCTOU re-path). If chmod throws, or the fd is still not 0600Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commanddist/config.js:268 · File permission modification command — agent changes file ownership/permissions// Test seam: lets a test force chmod to fail so the "preserve bytes onFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsdist/config.js:190 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* otherwise the steps point at the environment variables / .env file plus theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈51 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for e-arveldaja-mcp@0.42.0 as of 5d ago. This is the package itself, not its dependencies.

What would make this Verified

2 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim iseppo: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  5. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim iseppoPropose a patch to the maintainer