Skills/npm/hostkey-mcp-server

hostkey-mcp-server@1.0.8

VERIFIED

Publisher claims: "MCP server for Hostkey .com portal (InvAPI invapi.hostkey.com): servers, power, ordering, reinstall, DNS, S3, billing" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher hostkey-cloud · publishing for 60 daysInstalls 1,389Last detonated 18 h ago
$claude mcp add hostkey-mcp-server -- npx -y hostkey-mcp-server
WatchReport an issue

Coverage

Started with a decoy HOSTKEY_API_KEY; tool list observed. Tool calls with a real credential not tested.
Tested
server startup with a tagged decoy in HOSTKEY_API_KEY · MCP initialize and tools/list · every tool description, for hidden instructions · where the decoy credential went · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with a real credential
Needs
HOSTKEY_API_KEY — give it to the server where it runs, through vet-skills run --secrets, so the value never enters the server's environment. Never paste a credential into a chat, a ticket or a report.

Before you give it your token

It will ask for
HOSTKEY_API_KEYConfiguration, not credentials: HOSTKEY_ALLOW_DESTRUCTIVE, HOSTKEY_CORS_ORIGINS, MODE
Where it talks to
hostkey.com, hostkey.ru (its own)
What the honeypot saw
no credential files read · no network
What we could not test
what the tools do when called with a real credential

Connect it with a scoped credential, under the guard. It asks for HOSTKEY_API_KEY and talks to hostkey.com, hostkey.ru. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind.

$vet-skills run --secrets HOSTKEY_API_KEY=hostkey.com -- npx -y hostkey-mcp-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-13 and scored it 90/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 53 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
13sprocessdependency install exit 0
33sprocessrelaunched with a decoy HOSTKEY_API_KEY (tagged; nothing real)
53sclaimed132 tools with a decoy HOSTKEY_API_KEY: get_servers, get_server, get_power_status, get_server_sensors, get_server_tags, search_servers_by_tag, list_presets, search_presets, get_preset_pricing, list_preset_groups, get_preset, list_stock_servers, get_stock_server, list_os, list_software, list_traffic_plans, get_account_info, logout, list_api_keys, list_server_api_keys, get_api_key, get_api_key_history, create_api_key, update_api_key, delete_api_key
53stools6b7e84edb8518f89
53stools97953002e02f3aca
53stools51d2b474585413c3
53stools898fc1827b6d4ce5
53stoolsd7bc5c6f485da6e0
53stoolsdcbca0f428396a9f
53stoolsb7e09a818fa07ca0
53stoolsf81ad22e119b2df5
53stoolsc99c8b70aa234283
53stools3aaf38e932dacf89
53stoolsf45930926439bc6e
53stools74164a3aa516b3f6
53stoolsd8231c86af30442a
53stoolsd1d1f901ee44ccb6
53stools31327561a7d6591a
53stoolsd7a500669205339c
53stoolsba52261e553c8cc1
53stools2f24dc17c5e4ef3a
53stools3e561ddc70163d76
53stoolse8439f2a048ea1a3
53stools0dbcb07285499620
53stools88f81327f7ad20a4
53stools47f8c67da663773e
53stools3624176b8796166a
53stoolsa36a13bf1c8e77d3
53stoolsc4f7420e67766ac5
53stoolseba3623abaa672f3
53stoolsbc5705ce8f4848a3
53stools1f58e80ed1ec1f70
53stoolsd099932b7311490e
53stools46e49dbfa9661b56
53stools6e2d5cec71398330
53stoolsd8ffbc9ee278034a
53stools2148ff2a86d4b843
53stools9bf0ecc69db367e9
53stools43eeb42adcf13dfc
53stools8ad016644e94219a
53stools425add424bc9bfdb
53stools7d9cf10363831bcc
53stools49146f26fbe00c0f
53stools2c6a51956357b34c
53stools9c21e64a6b7d12ce
53stoolsc0ff3616562402c5
53stools387a30ce96a184cb
53stools5b59c9a390a88366
53stools1f2b7fa2e8560bc5
53stools12b4857293c210f7
53stools1bfa617119b43326
53stoolsdbe5d3a04029a46a
53stools48deb7383c154f9f
53stools2efe6cbf70bca859
53stoolsfec7ac38494e2963
53stools5ff652f393de63ab
53stools4c07121ffc9ea276
53stools60d9203d28b1b706
53stools32e858e8e578e79a
53stools40dd11d56e63f715
53stoolscaee0d011c3e6b06
53stoolsb36e928390978ff0
53stools987a1e5c4a65a992
53stools928bd7abbb0c32ef
53stools9114c5ccfca0d672
53stoolse7d20d51f3d78790
53stools25f5e9e11465a4fa
53stools268ea21678f704d1
53stoolsf4b23169a6e2c06f
53stoolsacdfbf93128e91fb
53stools1e83a0cb2bbc9830
53stools7cc3b0991c2d2492
53stools0bac3b7241ee7ffe
53stools7ea811938ecfbdb8
53stools3750017126a1c626
53stools52f04946cf4c0057
53stools19db953634ddc3a1
53stoolsfd3a5cc00b378bd0
53stoolsa5e31f3c0508b85e
53stools9f1fb3193877ba74
53stools8f07c022a9981ac7
53stools9a8baad2f7840326
53stoolsc7dcba63b51a9ed5
53sprocessscript backend runs setup only
53sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsdist/index.mjs:1444 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** Hostkey MCP server (.com / invapi.hostkey.com). Env: see .env.example. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

No other findings across 1,874 lines in 5 files.

Cost to the agent

Instructions loaded
≈68 tok
1 file · 5 in bundle
Tool list per prompt
≈16,809 tok
132 tools · 127 per tool
Handshake
2594 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 115

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for hostkey-mcp-server@1.0.8 as of 18 h ago. This is the package itself, not its dependencies.