Skills/npm/e-arveldaja-mcp

e-arveldaja-mcp@0.42.1

CAUTION· startup only

Publisher claims: "MCP server for Estonian e-arveldaja (e-Financials) API" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher iseppo · publishing for 244 daysInstalls 6,765Last detonated 1 h ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
EARVELDAJA_API_KEY_FILEEARVELDAJA_API_KEY_IDEARVELDAJA_API_PASSWORDNO_API_CREDENTIALS_FOUND_MESSAGEConfiguration, not credentials: EARVELDAJA_API_PUBLIC_VALUE, EARVELDAJA_AUDIT_LANG, EARVELDAJA_CONFIG_DIR, EARVELDAJA_DEBUG, EARVELDAJA_DISABLE_ANNUAL_REPORT, EARVELDAJA_DISABLE_LIGHTYEAR, EARVELDAJA_DISABLE_PRODUCTS, EARVELDAJA_DISABLE_PROGRESS, EARVELDAJA_DISABLE_REFERENCE_ADMIN, EARVELDAJA_DISABLE_SALES, EARVELDAJA_DISABLE_TAX_TOOLS, EARVELDAJA_DOCUMENT_READING, EARVELDAJA_EXPOSE_GRANULAR_TOOLS, EARVELDAJA_EXPOSE_SETUP_TOOLS, EARVELDAJA_LOCK_DIR, EARVELDAJA_LOG_FILE, EARVELDAJA_PROFILE, EARVELDAJA_SERVER
Where it talks to
no vendor host named in the codeAlso rik.ee, emta.ee, europa.eu, ipify.org — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names rik.ee, emta.ee, europa.eu, ipify.org as well as its own vendor. The guard injects EARVELDAJA_API_KEY_FILE, EARVELDAJA_API_KEY_ID, EARVELDAJA_API_PASSWORD, NO_API_CREDENTIALS_FOUND_MESSAGE only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y e-arveldaja-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

What changed since 0.42.0

vet-skills diff e-arveldaja-mcp 0.42.0 0.42.1

In the sandbox, this version reached for nothing 0.42.0 did not. Compared from the two recorded runs, not from source.

The guard can hold an update like this until someone approves it (runtime.on_change: hold). A change that only shows with a real credential, or on a path the run did not reach, is not in a trace and so not in this comparison.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-15 and scored it 78/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Collapsed <details> block carrying instructions; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 38 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
18sprocessdependency install exit 0
38sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-TCy85a/task/home/work/acme-api/.claude/skills/e-arveldaja-mcp/dist/server-bootstrap.js' } Node.js v22.23.5
38sprocessscript backend runs setup only
38sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsdist/config.d.ts:228 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* otherwise the steps point at the environment variables / .env file plus theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Collapsed <details> block carrying instructionsREADME.md:170 · Collapsed <details> block carrying instructions<summary>Building from source</summary> ```bash git clone https://github.com/iseppo/e-arveldaja-mcp.git cd e-arveldaja-mcp npm install && npm run build # Then uFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsdist/config.d.ts:221 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* would silently replace the guided surface: recommend env/.env or a temporaryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/prompts.js:31 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…nt supports prompts, the server may offer to verify it and save the resulting \`.env\` either only for this folder or so it works when you start the MCP server from…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/prompts.js:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files: `- ${credentialImportUnavailableAdvice(toolProfile)} The environment variable names and \`.env\` locations are in the \`setup\` run data.`}Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commanddist/config.js:1169 · File permission modification command — agent changes file ownership/permissions// byte-identical across the permission repair below (chmod only), so a matchingFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commanddist/config.js:268 · File permission modification command — agent changes file ownership/permissions// Test seam: lets a test force chmod to fail so the "preserve bytes onFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commanddist/stderr-tee.js:83 · File permission modification command — agent changes file ownership/permissions// fd (no TOCTOU re-path). If chmod throws, or the fd is still not 0600Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsdist/config.js:185 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…) or with EARVELDAJA_PROFILE=full; otherwise use the environment variables or a .env file."; } /** * Setup next steps. The credential-management tools (import_apik…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/config.d.ts:251 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* primitive as the credential .env writer; the two paths must never diverge.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/config.js:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst GLOBAL_ENV_FILE_NAME = ".env";Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/config.js:180 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn `The ${toolProfile} profile does not register the credential-import tools. Add the credentials through the environment variables or a local or shared .env file — no profile change is needed. `Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/config.js:175 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* would silently replace the guided surface: recommend env/.env or a temporaryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commanddist/config.js:107 · File permission modification command — agent changes file ownership/permissions`(mode ${(stats.mode & 0o777).toString(8)}). Run: chmod 600 ${escapeForLog(filePath)}\n`);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commanddist/stderr-tee.d.ts:9 · File permission modification command — agent changes file ownership/permissions* permission-hardening failure paths (a real chmod on an owned file succeedsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsdist/config.js:190 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* otherwise the steps point at the environment variables / .env file plus theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/config.d.ts:315 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** Read-only content fingerprint of the destination .env, for drift detection. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commanddist/config.js:256 · File permission modification command — agent changes file ownership/permissions`(mode ${(info.mode & 0o777).toString(8)}). Skipping. Run: chmod 600 ${escapeForLog(envPath)}\n`);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actiondist/limited-vat.js:425 · File type combined with upload action — agent may exfiltrate local data files…nknown") { return "Ettevõtte käibemaksustaatus ei ole teada (limited-vat.json ei ole loetav või EMTA KMKR päring ei andnud KMKR numbri kohta vastust), seega ei saa otsustada, kas sisendkäibemaks või pöördmaksustamine kehtib. Käibemaksust s…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsdist/config.d.ts:271 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* Env vars and .env are the canonical config sources. apikey*.txt remains aFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈51 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Not checked against OSV yet; the weekly check has not reached this version.

What would make this Verified

2 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim iseppo: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  5. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim iseppoPropose a patch to the maintainer