Skills/npm/echelongraph-mcp

echelongraph-mcp@3.2.4

CAUTION

Publisher claims: "MCP server for CVE lookups: EchelonGraph scores, CISA KEV, EPSS, CWE, exploits, version and SBOM checks, vendor advisories, and per-CVE exposure derived from Shodan data. Shodan data is owned by Shodan, which holds its copyright (© Shodan). Keyless." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher echelongraph · publishing for 142 daysInstalls 8,418Last detonated 30 h ago
What would fix thisWatchDispute verdict

Coverage

Server started and answered tools/list.
Tested
MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with real credentials

Before you give it your token

It will ask for
ECHELONGRAPH_FORWARD_TOKENMCP_REQUIRE_FORWARD_TOKENSYNTHETIC_UA_TOKENConfiguration, not credentials: ECHELONGRAPH_API_BASE, ECHELONGRAPH_API_TIMEOUT_MS, ECHELONGRAPH_FORWARD_HOST, ECHELONGRAPH_MCP_UA, MCP_ADMISSION_WAIT_MS, MCP_BODY_IDLE_MS, MCP_H2C, MCP_LARGE_BODY_SLOTS, MCP_LARGE_BODY_WAIT_MS, MCP_MAX_BODY_BYTES, MCP_MAX_IN_FLIGHT, MCP_MAX_SBOM_BODY_BYTES, MCP_RATE_LIMIT_PER_MIN, MCP_REQUEST_TIMEOUT_MS, VENDOR_COVERAGE_PATH
Where it talks to
echelongraph.io (its own)Also drupal.org, google.com, shodan.io, crates.io, redhat.com, creativecommons.org, cve.org — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names drupal.org, google.com, shodan.io, crates.io, redhat.com, creativecommons.org, cve.org as well as its own vendor. The guard injects ECHELONGRAPH_FORWARD_TOKEN, MCP_REQUIRE_FORWARD_TOKEN, SYNTHETIC_UA_TOKEN only into requests to echelongraph.io (and its subdomains) and refuses the rest.

$vet-skills run --secrets ECHELONGRAPH_FORWARD_TOKEN=echelongraph.io,MCP_REQUIRE_FORWARD_TOKEN=echelongraph.io,SYNTHETIC_UA_TOKEN=echelongraph.io -- npx -y echelongraph-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-13 and scored it 71/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Credential pass-through configuration; Credential pass-through configuration; Credential pass-through configuration. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 24 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
3.9sprocessdependency install exit 0
24sclaimed16 tools: cve_summary, search_cves, get_cve, cve_exposure, exposure_radar, kev_recent, epss_history, check_affected, check_sbom, scan_manifest, cve_intel, cve_remediation, get_cwe, vendor_advisories_for_cve, get_vendor_advisory, search_vendor_advisories
24stools963360ecc2a1653d
24stools0be9e127e79eb3b0
24stoolsecbe9d041390b345
24stoolsd3120a4b4fcc304c
24stools90eeeb652d884fc9
24stools371d0d81c3b84031
24stoolsd8463bf68c3236a1
24stools06e1399e2a9819cb
24stools9a89b0c7af94f933
24stools4fbc49e657cea6a7
24stoolsef97f409fe39feda
24stools4c431b0c44ca9175
24stoolscad1af62c2489c3e
24stools1fade7afc80dc523
24stoolse96debe69149c16d
24stools085652bc04ddde9d
24sprocessscript backend runs setup only
24sprocessno install scripts to re-run

Static findings

HIGH
Credential pass-through configurationdist/http.js:32 · Credential pass-through configuration — agent relays sensitive credentials// client's address and a forward token core-backend checks (runtime.ts; core-backendFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationdist/index.js:122 · Credential pass-through configuration — agent relays sensitive credentials// The base as quoted in tool results. A proxy credential in the URL's userinfo is dropped.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
MCP server using network transport (SSE/HTTP)dist/index.js:2293 · MCP server using network transport (SSE/HTTP) — data sent over network…st.mjs pins this to MCP_CHALLENGE_REASONS. const MCP_CHALLENGE_REASON_FIELDS = "mcp_servers.not_assessed_by_reason.resource_mismatch, mcp_servers.not_assessed_by_reason.cross_origin_pointer, mcp_servers.not_assessed_by_reason.bare_challeng…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
npx invocation of non-well-known packagedist/parseBudget.js:635 · npx invocation of non-well-known package — may execute untrusted codeexport const LOCAL_INSTEAD = "run this server locally (npx -y echelongraph-mcp), whose bounds are a share of its own machine's memory, not this endpoint's";Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Credential pass-through configurationdist/index.js:225 · Credential pass-through configuration — agent relays sensitive credentials// upstreamHeaders: empty on stdio; on the hosted endpoint, the forward token and theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationdist/runtime.js:159 · Credential pass-through configuration — agent relays sensitive credentialsexport function forwardToken() {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Destructive file system command detecteddist/index.js:1999 · Destructive file system command detected// None is validated: detect.go says "verified" means STRUCTURALLY verified (a checksum or formatFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detecteddist/tools/manifests/requirements.js:1 · Destructive file system command detected// requirements.txt (#2835): pip's requirements file formatFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/tools/scan_manifest.js:40 · File type combined with upload action — agent may exfiltrate local data files…0 of filename and content, up to 5,000,000 characters in all. Read: requirements.txt (== and === pins only), go.mod, package-lock.json and npm-shrinkwrap.json (v1-v3), Cargo.lock, Gemfile.lock, composer.lock, poetry.lock and gradle.lockfil…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Credential pass-through configurationdist/http.js:102 · Credential pass-through configuration — agent relays sensitive credentialsif (process.env.MCP_REQUIRE_FORWARD_TOKEN === "1" && !forwardToken()) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathsdist/index.js:491 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files...env,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)dist/index.js:2435 · MCP server using network transport (SSE/HTTP) — data sent over network… checked by EchelonGraph's identified probes. ${SHODAN_OWNERSHIP} It also gives MCP-server counts: hostnames named like an MCP server in EchelonGraph's own Certificate Transparency feed (no Shodan data), each counted once by its latest ver…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Credential pass-through configurationdist/http.js:614 · Credential pass-through configuration — agent relays sensitive credentialsforward_token_configured: forwardToken() !== "",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Process kill commanddist/httpPolicy.js:262 · Process kill command — agent can terminate processes// the requests served beside them, which were enough to kill the instance (#2773): "Requests inFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)dist/index.js:2387 · MCP server using network transport (SSE/HTTP) — data sent over network…ot re-checked since.`); } if (data.transport) { sentences.push(`mcp_servers.transport divides them by the transport that identified the server: ${b("transport", "streamable_http")}, a POST to /mcp; ${b("transport", "legacy_sse")}, the endp…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Credential pass-through configurationdist/http.js:39 · Credential pass-through configuration — agent relays sensitive credentialsimport { forwardToken, markHttpEntrypoint, onUpstreamFailure, requestLabels, requestSettled, SYNTHETIC_UA_FAMILY, withClient } from "./runtime.js";Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
MCP server using network transport (SSE/HTTP)dist/index.js:2384 · MCP server using network transport (SSE/HTTP) — data sent over network…is a count of MCP servers.`); } if (data.era) { sentences.push(`mcp_servers.era divides every counted hostname by the protocol era its answer identified: ${b("era", "legacy")}, an initialize-era server (an InitializeResult, or the legacy S…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Credential pass-through configurationdist/runtime.js:187 · Credential pass-through configuration — agent relays sensitive credentialsconst token = forwardToken();Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
MCP server using network transport (SSE/HTTP)dist/index.js:2379 · MCP server using network transport (SSE/HTTP) — data sent over network…rm_via", "wellknown_root")}, that URI at the root.`); } sentences.push(`mcp_servers.pending_readjudication (${n("pending_readjudication")}) counts verdicts decided by a rule EchelonGraph has since replaced and not yet re-checked under the …Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Credential pass-through configurationdist/runtime.js:155 · Credential pass-through configuration — agent relays sensitive credentials/** The header that carries the forward token, and the one that names the client (core-backend waf/mcpforward.go). */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02

Cost to the agent

Instructions loaded
≈100 tok
1 file · 43 in bundle
Tool list per prompt
≈12,331 tok
16 tools · 771 per tool
Handshake
12483 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 1918

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for echelongraph-mcp@3.2.4 as of 30 h ago. This is the package itself, not its dependencies.

What would make this Verified

9 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim echelongraph: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
  6. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim echelongraphPropose a patch to the maintainer