gc2-mcp-server@1.2.4
CAUTIONPublisher claims: "GC2 (Geo Compute Cloud) MCP Server" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher mapcentia · publishing for 9 daysInstalls 569Last detonated 18 h ago
Coverage
Server started and answered tools/list.- Tested
- MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
- Not tested
- what the tools do when called with real credentials
Before you give it your token
- It will ask for
API_TOKENConfiguration, not credentials: API_BASE_URL- Where it talks to
- no vendor host named in the codeAlso gc2.io — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- what the tools do when called with real credentials
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names gc2.io as well as its own vendor. The guard injects API_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.
$vet-skills run --net declared -- npx -y @mapcentia/gc2-mcp-server
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-13 and scored it 69/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; URL with embedded credentials. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 28 s · 2 scenariost+CategoryObserved action
0.0sprocessno install scripts in bundle
8.0sprocessdependency install exit 0
28sfilesystemread ~/.config/configstore/gc2-env.json outside project
28sclaimed140 tools: postCall, postCallDry, getClient, deleteClient, patchClient, postClient, getColumn, deleteColumn, postColumn, patchColumn, postCommit, getConfiguration, deleteConfiguration, patchConfiguration, postConfiguration, getPublicConfiguration, getConstraint, deleteConstraint, postConstraint, getEvents, postEvents, getFeature, deleteFeature, patchFeature, postFeature
28stools0844beb2eedbb015
28stools0942e0c460fd2229
28stools705c5b4dcb2feae6
28stools7ae79fbe3e18fb9d
28stools75b2d7ae7cc2a4c6
28stoolsdf1d600287e83098
28stools71b5740307009a5d
28stoolsf2e43a591a5dbbe1
28stools4e97cf6b022556bb
28stools06c274df7f34951d
28stoolsf0e5792ffa1ba1ca
28stools0740f942481d704a
28stoolsc94f148c4ec53361
28stools61b35d62d1295d54
28stools232a6b1bc4587700
28stools3702114f3029c7e3
28stools5b1e58cab7211aca
28stools63306150733d715f
28stools02b844578dbb0f11
28stoolsa691c6d000523220
28stools184a5fae0f52e796
28stoolsa015e3bbe4726b47
28stoolsdcc2521b6a9eb754
28stools2a4e3e1c8c921a10
28stools034a7b8259622974
28stools5b5b1357ba0a470f
28stools517d280a9d648cfa
28stools7d3f855bdc053c29
28stoolsbf8489d7a3555aab
28stools207db08e2d3fb6f5
28stoolsbe5cbe91a3d1c3f3
28stools7faa819737bbca08
28stools961e31d29b3dd57f
28stools96a6547c8eddbc73
28stoolsb3de23edb91731ee
28stools2b721ed231771984
28stoolscc3a771dc3ac3795
28stoolsa9dd9ced47ba5eb5
28stoolscafbc460a32e2426
28stools168c63618a9317da
28stools47c0c2f386535b60
28stools92b21d25c148ab0c
28stools19bd1994e6293b3e
28stools68db2d7a0cec629f
28stools2365b353c6558224
28stools53de710ad0d40c24
28stools9ad392b25659b6d9
28stools4273a7c3c2b1522c
28stoolsfd7aafa498a3bdbc
28stools2990098edac4822d
28stoolsf1962e849554ce3a
28stools8201bce7f2065545
28stoolseb3f233e75e033d2
28stoolsf0cede8461f9d3ef
28stools65f25b0ff7086405
28stools349b5d4d2863418e
28stoolsfec0388bbd79365f
28stools9b58c0febaf947b0
28stools5854220aa9406899
28stools00e0b7ee3c700db8
28stools6b8db0b30d49d5e1
28stools8282268a8d71f8c3
28stools457b245c9fd239b6
28stoolsb92897408c6bf40f
28stools7a8e2b38a938bafd
28stoolsf6c86d11da4022a2
28stools68d04ca60d1a09bf
28stoolsb17ab0f5abe0891a
28stoolse1167f00b807217d
28stools5014f6ce977bcf96
28stoolsd85d83d55fe0d2c6
28stools6e2b21343511430d
28stools91b8db46bcdc8c03
28stools6a2eda8bac259ee7
28stools99589c70862ee032
28stoolsbf1e6c0bdc8a8c28
28stools8b515c78e1cf3bb8
28stools064223ad5a6dcbb3
28stoolse3058ce1ac4bb1b1
28stoolsd37204a0a6bef6d8
28sprocessscript backend runs setup only
28sprocessno install scripts to re-run
Static findings
MEDIUM
MCP server using network transport (SSE/HTTP)skills/gc2-scheduler/SKILL.md:12 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04…26-09 — **not** on production `api.gc2.io`. MCP tools ship with `@mapcentia/gc2-mcp-server` 1.1.0+ (restart the server after upgrading the spec). No `@mapcentia/gc2-sdk` class as of 0.3.0 — use the MCP tools or spec-backed HTTP. **Super-us…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.HIGH
Access to sensitive file pathsskills/gc2-rules/SKILL.md:39 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05- Never commit secrets in `.env`.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsskills/gc2-provisioning/SKILL.md:106 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05.env.exampleFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
URL with embedded credentialscentia-api.json:6944 · URL with embedded credentials — may be phishing or credential leaking
AST07"example": "https://user:[email protected]/path/repo.git"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Process kill commandskills/gc2-tile-seeding/SKILL.md:37 · Process kill command — agent can terminate processes
AST05…old callers keep working unchanged (same shapes and status codes), and no pgrep/kill remains. Two deliberate differences: the `cmd` field is gone from the POST respo…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File type combined with upload actionskills/danish-search/SKILL.md:176 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`${postnr} ${postnrnavn}, kommune ${kommunekode}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Access to sensitive file pathsskills/gc2-auth-model/SKILL.md:108 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05Never commit secrets. Keep `.env.example` with placeholders.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Authorization escalation languageskills/gc2-auth-model/SKILL.md:49 · Authorization escalation language
AST01… that need a bearer even for public data. Never grant the default user write or admin privileges to make a guest app "work". - In browsers use a **public** client so no secret…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.Cost to the agent
Instructions loaded
≈25,040 tok
23 files · 28 in bundle
Tool list per prompt
≈55,137 tok
140 tools · 394 per tool
Handshake
6813 ms
launch to tools/list, stdio
Undocumented tools
39
description under 20 chars · avg 69
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for @mapcentia/gc2-mcp-server@1.2.4 as of 18 h ago. This is the package itself, not its dependencies.
What would make this Verified
11 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs. Seen: ~/.config/configstore/gc2-env.json.
- Unclaimed publisher≈ +8 on the totalClaim mapcentia: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim mapcentiaPropose a patch to the maintainer