log10x-mcp@1.30.101
CAUTION· startup onlyPublisher claims: "Rank log patterns by cost, then compact, tier down or offload the excess. No log data reaches log10x." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher log-10x · publishing for 217 daysInstalls 9,559Last detonated 3d ago
Coverage
Startup only; authenticated tool behavior not tested.- Tested
- server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
- Not tested
- the tool list (the server exited before answering) · what the tools do when called with real credentials
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
ARTIFACTORY_TOKENCLICKHOUSE_API_KEYCLICKHOUSE_PASSWORDCX_SECRETDATADOG_API_KEYDD_API_KEYDOCKER_TOKENGH_TOKENGITHUB_TOKENLOG10X_API_KEYLOG10X_CREDENTIALS_PATHLOG10X_CUSTOMER_METRICS_AUTHLOG10X_LICENSE_KEYSUMO_ACCESS_KEYTENX_API_KEYTENX_LICENSE_KEYConfiguration, not credentials: __SAVE_LOG10X_RETRIEVER_BUCKET__, __SAVE_LOG10X_RETRIEVER_URL__, AWS_DEFAULT_REGION, AWS_REGION, CLICKHOUSE_DATABASE, CLICKHOUSE_URL, CLICKHOUSE_USER, CLICKHOUSE_USERNAME, CX_HOST, DATADOG_SITE, DD_SITE, DOCKER_USERNAME, GROUP_PREFIX, K8S_CONFIGMAP, K8S_NAMESPACE, KUBERNETES_SERVICE_HOST, LOG10X_API_BASE, LOG10X_BASELINE_MIN_DAYS, LOG10X_CUSTOMER_METRICS_TYPE, LOG10X_CUSTOMER_METRICS_URL, LOG10X_DEMO_FALLBACK, LOG10X_DEV_MODE, LOG10X_FENCED, LOG10X_FETCH_TIMEOUT_MS- Where it talks to
- log10x.com (its own)Also docker.com, sumologic.com, jfrog.io — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- the tool list (the server exited before answering) · what the tools do when called with real credentials
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names docker.com, sumologic.com, jfrog.io as well as its own vendor. The guard injects ARTIFACTORY_TOKEN, CLICKHOUSE_API_KEY, CLICKHOUSE_PASSWORD, CX_SECRET, DATADOG_API_KEY, DD_API_KEY, DOCKER_TOKEN, GH_TOKEN, GITHUB_TOKEN, LOG10X_API_KEY, LOG10X_CREDENTIALS_PATH, LOG10X_CUSTOMER_METRICS_AUTH, LOG10X_LICENSE_KEY, SUMO_ACCESS_KEY, TENX_API_KEY, TENX_LICENSE_KEY only into requests to log10x.com (and its subdomains) and refuses the rest.
$vet-skills run --secrets ARTIFACTORY_TOKEN=log10x.com,CLICKHOUSE_API_KEY=log10x.com,CLICKHOUSE_PASSWORD=log10x.com,CX_SECRET=log10x.com,DATADOG_API_KEY=log10x.com,DD_API_KEY=log10x.com,DOCKER_TOKEN=log10x.com,GH_TOKEN=log10x.com,GITHUB_TOKEN=log10x.com,LOG10X_API_KEY=log10x.com,LOG10X_CREDENTIALS_PATH=log10x.com,LOG10X_CUSTOMER_METRICS_AUTH=log10x.com,LOG10X_LICENSE_KEY=log10x.com,SUMO_ACCESS_KEY=log10x.com,TENX_API_KEY=log10x.com,TENX_LICENSE_KEY=log10x.com -- npx -y log10x-mcp
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-11 and scored it 78/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Credential pass-through configuration; Auto-update or dynamic fetch configuration; Auto-update or dynamic fetch configuration. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 34 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
13sprocessdependency install exit 0
33sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-YCWh4a/task/home/work/acme-api/.claude/skills/log10x-mcp/build/lib/self-telemetry.js' } Node.js v22.23.4
33sprocessscript backend runs setup only
33sprocessno install scripts to re-run
Static findings
HIGH
Credential pass-through configurationbuild/index.js:1271 · Credential pass-through configuration — agent relays sensitive credentials
AST02…ss back the device_code from log10x_signin_start to finish the browser flow, OR pass api_key directly for pasted-key sign-in (no browser). Hot-reloads envs (no MCP-host res…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagebuild/lib/demo-env.d.ts:6 · npx invocation of non-well-known package — may execute untrusted code
AST06* This makes the keyless `npx -y log10x-mcp` first-run land on the sameFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationdefault-manifest.json:539 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06…ocess `LOG10X_API_KEY` so the new key takes effect for THIS server immediately, hot-reloads envs. The new key is shown in the response (also viewable later at console.log10x.com → Profile → API Settings). The result message lists every pla…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File permission modification commandbuild/lib/dev-cli.js:35 · File permission modification command — agent changes file ownership/permissions
AST05import { mkdtemp, readFile, writeFile as fsWriteFile, rm, mkdir, chmod } from 'fs/promises';Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File type combined with upload actiondefault-manifest.json:360 · File type combined with upload action — agent may exfiltrate local data files
AST07…le": "Link symbol units", "description": "Link an existing folder of `.10x.json` symbol units (from a prior compile) into a single `.10x.tar` library, with NO source scan. This is the same compiler-flavor Compiler app invoked with link-onl…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Auto-update or dynamic fetch configurationdefault-manifest.json:461 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06…Either path writes the resolved API key to `~/.log10x/credentials` (mode 0600), hot-reloads the MCP's env list in-process, and (if `LOG10X_API_KEY` is set in the host config and would override the new file) clears that env var in-process a…Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationdefault-manifest.json:783 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06…ps repo. Two modes: `mode=csv` (default) edits `compact-lookup.csv`, the engine hot-reloads on each gitops poll (no pipeline restart, no event drops); `mode=js` replaces `compact-object-global.js` with new predicate logic, the engine trigg…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionbuild/lib/poc-cache.js:14 · File type combined with upload action — agent may exfiltrate local data files
AST07* <cache-dir>/<key>/templater/templates.json — templater outputFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagebuild/lib/demo-env.js:6 · npx invocation of non-well-known package — may execute untrusted code
AST06* This makes the keyless `npx -y log10x-mcp` first-run land on the sameFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actiondefault-manifest.json:394 · File type combined with upload action — agent may exfiltrate local data files
AST07…_query` or recovered from the S3 results prefix). Pulls the coordinator's `_DONE.json` stats (scanned / matched / streamRequests / streamBlobs / submittedTasks / expectedMarkers), counts per-worker byte-count markers under `q/<queryId>/`, …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionbuild/index.js:1310 · File type combined with upload action — agent may exfiltrate local data files
AST07…' }, { name: 'log10x_compile_link', intent: 'Link an existing folder of .10x.json symbol units into a single .10x.tar library, with NO source scan: the same compiler invoked with link-only args (units folder as outputSymbolFolder, no sourc…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File permission modification commandpackage.json:20 · File permission modification command — agent changes file ownership/permissions
AST05…rser/promql.js vendor/promql-parser/package.json build/vendor/promql-parser/ && chmod +x build/index.js && chmod +x build/bin/tenx-recur.js && rm -rf build/product-kb…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File type combined with upload actiondefault-manifest.json:783 · File type combined with upload action — agent may exfiltrate local data files
AST07…he customer's GitOps repo. Two modes: `mode=csv` (default) edits `compact-lookup.csv`, the engine hot-reloads on each gitops poll (no pipeline restart, no event drops); `mode=js` replaces `compact-object-global.js` with new predicate logic…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionbuild/lib/budget-tick.js:486 · File type combined with upload action — agent may exfiltrate local data files
AST07'config-generation.csv': renderGenerationCsv(computeGeneration(capsCsv)),Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionbuild/lib/poc-cache.d.ts:14 · File type combined with upload action — agent may exfiltrate local data files
AST07* <cache-dir>/<key>/templater/templates.json — templater outputFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File permission modification commandbuild/lib/dev-cli.js:292 · File permission modification command — agent changes file ownership/permissions
AST05// mount. chmod after mkdir (mkdir's mode is umask-filtered), harmless onFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File type combined with upload actionbuild/tools/compile.js:131 · File type combined with upload action — agent may exfiltrate local data files
AST07.describe('Absolute path where the symbol library is written (the .10x.json units and the linked .10x.tar). Defaults to a fresh temp directory, returned in the result as data.payload.output.folder.'),Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.Cost to the agent
Instructions loaded
≈62 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for log10x-mcp@1.30.101 as of 3d ago. This is the package itself, not its dependencies.
What would make this Verified
2 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim log-10x: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
- npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
- File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
- File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim log-10xPropose a patch to the maintainer