Skills/npm/gateway

gateway@0.42.0

CAUTION· startup only

Publisher claims: "Suveren gateway — local agent gateway built in compliance with the Human Agency Protocol (HAP). Runs the UI, control plane, and MCP server in one Node process." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher suveren · publishing for 176 daysInstalls 8,542Last detonated 10 h ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials
Needs
SUVEREN_MCP_TOKEN — give it to the server where it runs, through vet-skills run --secrets, so the value never enters the server's environment. Never paste a credential into a chat, a ticket or a report.

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
SUVEREN_INTERNAL_SECRETConfiguration, not credentials: HAP_BUILD_SHA, HAP_MODE, HAP_UI_DIST, NODE_EXTRA_CA_CERTS, npm_config_global, ProgramData, PROGRAMDATA, SUVEREN_AS_URL, SUVEREN_AUTOSTART, SUVEREN_BIND_HOST, SUVEREN_BUILTIN_GUIDES_DIR, SUVEREN_CA_REEXEC_DONE, SUVEREN_CP_PORT, SUVEREN_DATA_DIR, SUVEREN_GATEWAY_VERSION, SUVEREN_INSTALL_METHOD, SUVEREN_INSTALL_SETTINGS_FILE, SUVEREN_LAUNCHER, SUVEREN_MANIFESTS_DIR, SUVEREN_MCP_INTERNAL_URL, SUVEREN_MCP_PORT, SUVEREN_MCP_PUBLIC_PORT, SUVEREN_POLICY_FILE, SUVEREN_POLICY_REGISTRY, SUVEREN_POLICY_REGISTRY_KEY, SUVEREN_PROFILES_DIR, SUVEREN_SIMULATION, USERDOMAIN, USERNAME
Where it talks to
suveren.ai (its own)Also openrouter.ai, groq.com, together.xyz, ghcr.io, apple.com, microsoft.com, nodejs.org, company.internal — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names openrouter.ai, groq.com, together.xyz, ghcr.io, apple.com, microsoft.com, nodejs.org, company.internal as well as its own vendor. The guard injects SUVEREN_INTERNAL_SECRET only into requests to suveren.ai (and its subdomains) and refuses the rest.

$vet-skills run --secrets SUVEREN_INTERNAL_SECRET=suveren.ai -- npx -y @suveren/gateway

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-14 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Prompting user to enter sensitive credentials; Destructive file system command detected; Prompting user to enter sensitive credentials. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 50 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessinstall script run in the sandbox
9.4sprocessdependency install exit 0
29sprocessrelaunched with a decoy SUVEREN_MCP_TOKEN (tagged; nothing real)
49sclaimedstartup only: exited before answering, asking for SUVEREN_MCP_TOKEN (a decoy value was refused)
49sprocessscript backend runs setup only
50sprocesssecond launch, clock +45 days, CI unset

Static findings

CRITICAL
Prompting user to enter sensitive credentialscontent/integrations/linkedin.json:197 · Prompting user to enter sensitive credentials — social engineering"title": "Enter your credentials below",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
npx invocation of non-well-known packagebin/suveren-gateway.js:1182 · npx invocation of non-well-known package — may execute untrusted code// npx and none of the integration shims — the gateway starts and thenFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/control-plane/index.mjs:3503 · File type combined with upload action — agent may exfiltrate local data filesres.status(500).json({ error: "install_failed", message: output });Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Destructive file system command detecteddist/mcp-server/chunk-PU4VQEEA.mjs:50 · Destructive file system command detectedThe format \u2014 only these blocks, one after another. Anything else is dropped (write_report tells you how much):Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Prompting user to enter sensitive credentialscontent/integrations/calendar.json:254 · Prompting user to enter sensitive credentials — social engineering"title": "Enter your credentials below",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
CRITICAL
Prompting user to enter sensitive credentialscontent/integrations/mollie.json:503 · Prompting user to enter sensitive credentials — social engineering"title": "Enter your token below",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
CRITICAL
Prompting user to enter sensitive credentialsdist/control-plane/index.mjs:1971 · Prompting user to enter sensitive credentials — social engineeringmessage: `Your agent has no authority until you unlock it. Open ${url} and enter your API key.`,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
CRITICAL
Prompting user to enter sensitive credentialscontent/integrations/gmail.json:316 · Prompting user to enter sensitive credentials — social engineering"title": "Enter your credentials below",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathsdist/control-plane/index.mjs:2464 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfor (const f of manifest?.credentials?.fields ?? []) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandbin/suveren-gateway.js:428 · Process kill command — agent can terminate processes// kill is: nothing else will reap the children.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandbin/suveren-gateway.js:460 · Process kill command — agent can terminate processes// ESRCH (group already gone) or an environment where group-killFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)server.js:236 · MCP server using network transport (SSE/HTTP) — data sent over network[join(__dirname, 'dist', 'mcp-server', 'http.mjs')],Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actiondist/control-plane/index.mjs:3506 · File type combined with upload action — agent may exfiltrate local data filesres.json({ ok: true, installed: true, detail: output });Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/control-plane/index.mjs:3515 · File type combined with upload action — agent may exfiltrate local data filesres.status(500).json({ error: "uninstall_failed", message: output });Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)server.js:48 · MCP server using network transport (SSE/HTTP) — data sent over network// control-plane and MCP-server children below (those are fresh processes, soFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actiondist/control-plane/index.mjs:3518 · File type combined with upload action — agent may exfiltrate local data filesres.json({ ok: true, installed: false, detail: output });Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagelib/autostart-templates.mjs:36 · npx invocation of non-well-known package — may execute untrusted code// cannot find npx or the integration bin shims, so every integration silentlyFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/autostart-templates.mjs:115 · npx invocation of non-well-known package — may execute untrusted code// PATH, so npx and the integration shims go missing and every integrationFix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈76 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @suveren/gateway@0.42.0 as of 4 h ago. This is the package itself, not its dependencies.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Prompting user to enter sensitive credentials≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. Unclaimed publisher≈ +8 on the totalClaim suveren: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim suverenPropose a patch to the maintainer