Skills/npm/echelongraph-mcp

echelongraph-mcp@3.2.5

CAUTION

Publisher claims: "MCP server for CVE lookups: EchelonGraph scores, CISA KEV, EPSS, CWE, exploits, version and SBOM checks, vendor advisories, and per-CVE exposure derived from Shodan data. Shodan data is owned by Shodan, which holds its copyright (© Shodan). Keyless." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher echelongraph · publishing for 143 daysInstalls 9,190Last detonated 12 min ago
What would fix thisWatchDispute verdict

Coverage

Server started and answered tools/list.
Tested
MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with real credentials

Before you give it your token

It will ask for
ECHELONGRAPH_FORWARD_TOKENMCP_REQUIRE_FORWARD_TOKENSYNTHETIC_UA_TOKENConfiguration, not credentials: ECHELONGRAPH_API_BASE, ECHELONGRAPH_API_TIMEOUT_MS, ECHELONGRAPH_FORWARD_HOST, ECHELONGRAPH_MCP_UA, MCP_ADMISSION_WAIT_MS, MCP_BODY_IDLE_MS, MCP_H2C, MCP_LARGE_BODY_SLOTS, MCP_LARGE_BODY_WAIT_MS, MCP_MAX_BODY_BYTES, MCP_MAX_IN_FLIGHT, MCP_MAX_SBOM_BODY_BYTES, MCP_RATE_LIMIT_PER_MIN, MCP_REQUEST_TIMEOUT_MS, VENDOR_COVERAGE_PATH
Where it talks to
echelongraph.io (its own)Also drupal.org, google.com, shodan.io, crates.io, redhat.com, creativecommons.org, cve.org — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names drupal.org, google.com, shodan.io, crates.io, redhat.com, creativecommons.org, cve.org as well as its own vendor. The guard injects ECHELONGRAPH_FORWARD_TOKEN, MCP_REQUIRE_FORWARD_TOKEN, SYNTHETIC_UA_TOKEN only into requests to echelongraph.io (and its subdomains) and refuses the rest.

$vet-skills run --secrets ECHELONGRAPH_FORWARD_TOKEN=echelongraph.io,MCP_REQUIRE_FORWARD_TOKEN=echelongraph.io,SYNTHETIC_UA_TOKEN=echelongraph.io -- npx -y echelongraph-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-15 and scored it 71/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Credential pass-through configuration; Credential pass-through configuration; Destructive file system command detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 25 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
4.7sprocessdependency install exit 0
25sclaimed16 tools: cve_summary, search_cves, get_cve, cve_exposure, exposure_radar, kev_recent, epss_history, check_affected, check_sbom, scan_manifest, cve_intel, cve_remediation, get_cwe, vendor_advisories_for_cve, get_vendor_advisory, search_vendor_advisories
25stools963360ecc2a1653d
25stools0be9e127e79eb3b0
25stoolsecbe9d041390b345
25stoolsd3120a4b4fcc304c
25stools90eeeb652d884fc9
25stools371d0d81c3b84031
25stoolsd8463bf68c3236a1
25stools06e1399e2a9819cb
25stools9a89b0c7af94f933
25stools4fbc49e657cea6a7
25stoolsef97f409fe39feda
25stools257575d766df2c3f
25stoolscad1af62c2489c3e
25stools20aa061709bc6e5c
25stools92dcc0c76e71ded2
25stools8daabda59dc9cd00
25sprocessscript backend runs setup only
25sprocessno install scripts to re-run

Static findings

MEDIUM
MCP server using network transport (SSE/HTTP)dist/index.js:2384 · MCP server using network transport (SSE/HTTP) — data sent over network…is a count of MCP servers.`); } if (data.era) { sentences.push(`mcp_servers.era divides every counted hostname by the protocol era its answer identified: ${b("era", "legacy")}, an initialize-era server (an InitializeResult, or the legacy S…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Credential pass-through configurationdist/index.js:122 · Credential pass-through configuration — agent relays sensitive credentials// The base as quoted in tool results. A proxy credential in the URL's userinfo is dropped.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
MCP server using network transport (SSE/HTTP)dist/index.js:2293 · MCP server using network transport (SSE/HTTP) — data sent over network…st.mjs pins this to MCP_CHALLENGE_REASONS. const MCP_CHALLENGE_REASON_FIELDS = "mcp_servers.not_assessed_by_reason.resource_mismatch, mcp_servers.not_assessed_by_reason.cross_origin_pointer, mcp_servers.not_assessed_by_reason.bare_challeng…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Credential pass-through configurationdist/runtime.js:159 · Credential pass-through configuration — agent relays sensitive credentialsexport function forwardToken() {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Destructive file system command detecteddist/index.js:1999 · Destructive file system command detected// None is validated: detect.go says "verified" means STRUCTURALLY verified (a checksum or formatFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)dist/index.js:2387 · MCP server using network transport (SSE/HTTP) — data sent over network…ot re-checked since.`); } if (data.transport) { sentences.push(`mcp_servers.transport divides them by the transport that identified the server: ${b("transport", "streamable_http")}, a POST to /mcp; ${b("transport", "legacy_sse")}, the endp…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Destructive file system command detecteddist/tools/manifests/requirements.js:1 · Destructive file system command detected// requirements.txt (#2835): pip's requirements file formatFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/tools/scan_manifest.js:40 · File type combined with upload action — agent may exfiltrate local data files…0 of filename and content, up to 5,000,000 characters in all. Read: requirements.txt (== and === pins only), go.mod, package-lock.json and npm-shrinkwrap.json (v1-v3), Cargo.lock, Gemfile.lock, composer.lock, poetry.lock and gradle.lockfil…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Credential pass-through configurationdist/http.js:614 · Credential pass-through configuration — agent relays sensitive credentialsforward_token_configured: forwardToken() !== "",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationdist/http.js:32 · Credential pass-through configuration — agent relays sensitive credentials// client's address and a forward token core-backend checks (runtime.ts; core-backendFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationdist/http.js:39 · Credential pass-through configuration — agent relays sensitive credentialsimport { forwardToken, markHttpEntrypoint, onUpstreamFailure, requestLabels, requestSettled, SYNTHETIC_UA_FAMILY, withClient } from "./runtime.js";Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationdist/runtime.js:187 · Credential pass-through configuration — agent relays sensitive credentialsconst token = forwardToken();Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
npx invocation of non-well-known packagedist/parseBudget.js:635 · npx invocation of non-well-known package — may execute untrusted codeexport const LOCAL_INSTEAD = "run this server locally (npx -y echelongraph-mcp), whose bounds are a share of its own machine's memory, not this endpoint's";Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/index.js:491 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files...env,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configurationdist/http.js:102 · Credential pass-through configuration — agent relays sensitive credentialsif (process.env.MCP_REQUIRE_FORWARD_TOKEN === "1" && !forwardToken()) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
MCP server using network transport (SSE/HTTP)dist/index.js:2379 · MCP server using network transport (SSE/HTTP) — data sent over network…rm_via", "wellknown_root")}, that URI at the root.`); } sentences.push(`mcp_servers.pending_readjudication (${n("pending_readjudication")}) counts verdicts decided by a rule EchelonGraph has since replaced and not yet re-checked under the …Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)dist/index.js:2435 · MCP server using network transport (SSE/HTTP) — data sent over network… checked by EchelonGraph's identified probes. ${SHODAN_OWNERSHIP} It also gives MCP-server counts: hostnames named like an MCP server in EchelonGraph's own Certificate Transparency feed (no Shodan data), each counted once by its latest ver…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Credential pass-through configurationdist/runtime.js:155 · Credential pass-through configuration — agent relays sensitive credentials/** The header that carries the forward token, and the one that names the client (core-backend waf/mcpforward.go). */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Process kill commanddist/httpPolicy.js:262 · Process kill command — agent can terminate processes// the requests served beside them, which were enough to kill the instance (#2773): "Requests inFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Credential pass-through configurationdist/index.js:225 · Credential pass-through configuration — agent relays sensitive credentials// upstreamHeaders: empty on stdio; on the hosted endpoint, the forward token and theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02

Cost to the agent

Instructions loaded
≈100 tok
1 file · 43 in bundle
Tool list per prompt
≈12,319 tok
16 tools · 770 per tool
Handshake
13172 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 1915

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Not checked against OSV yet; the weekly check has not reached this version.

What would make this Verified

9 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim echelongraph: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim echelongraphPropose a patch to the maintainer