Skills/npm/loopctl-mcp-server

loopctl-mcp-server@3.12.0

VERIFIED

Publisher claims: "MCP server for loopctl — structural trust for AI development loops" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher mkreyman · publishing for 226 daysInstalls 2,648Last detonated 3d ago
$claude mcp add loopctl-mcp-server -- npx -y loopctl-mcp-server
WatchReport an issue

Coverage

Server started and answered tools/list.
Tested
MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with real credentials

Before you give it your token

It will ask for
LOOPCTL_API_KEYConfiguration, not credentials: CLAUDE_SESSION_ID, ESCALATIONS_PATH, HANDOFF_KEY_PREFIX, LOOPCTL_AGENT_KEY, LOOPCTL_ORCH_KEY, LOOPCTL_SERVER, LOOPCTL_USER_KEY, RUNNERS_PATH, SOURCES_PATH, TUNING_DRAFTS_PATH
Where it talks to
loopctl.com (its own)Also example.internal — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names example.internal as well as its own vendor. The guard injects LOOPCTL_API_KEY only into requests to loopctl.com (and its subdomains) and refuses the rest.

$vet-skills run --secrets LOOPCTL_API_KEY=loopctl.com -- npx -y loopctl-mcp-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-11 and scored it 85/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 24 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
3.8sprocessdependency install exit 0
24sclaimed175 tools: get_tenant, list_projects, resolve_project, create_project, create_kb_scope, archive_kb_scope, restore_kb_scope, handoff, channel_post, channel_recent, channel_handoffs, channel_get, channel_delete, channel_graduate, channel_claim, channel_release, channel_done, channel_lock, channel_unlock, channel_claims, channel_locks, delete_project, restore_project, update_project, get_progress
24sprocessscript backend runs setup only
24sprocessno install scripts to re-run

Static findings

HIGH
Tool description instructs the agent: credential exfiltration instructionmcp:tools/revoke_dispatch:1 · Instruction aimed at the agent: credential exfiltration instructionEVOKE A DISPATCH AND ITS WHOLE SUBTREE (POST /api/v1/dispatches/:id/revoke), plus the ephemeral api_key each one minted. `Dispatches.revoke/2` matches the dispaFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST01
LOW
Refusal suppressionREADME.md:538 · Refusal suppression — attempting to prevent safety responses · informational: not an instruction file…he declared prefixes. A retry carrying a `dispatch_id` loopctl already holds is never refused for either prefix reason: its claim is already standing, so the declaration on…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packageindex.js:876 · npx invocation of non-well-known package — may execute untrusted code// one-shot post shape. With the process-lifetime id an npx respawn mid-lease 404'dFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Credential pass-through configurationindex.js:8287 · Credential pass-through configuration — agent relays sensitive credentials"Pass api_key_id (api_keys.id credential) OR agent_id (agents.id logical identity) — not both. " +Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathslib/payload-path.js:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// so a symlink named x.json cannot point at /etc/passwd or /procFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packageindex.js:601 · npx invocation of non-well-known package — may execute untrusted code// process-lifetime uuid turns every npx respawn or /mcp reconnect into a 409 on thisFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/claim-session.js:15 · npx invocation of non-well-known package — may execute untrusted code* process-lifetime id, every npx respawn or `/mcp` reconnect turns the session's OWN liveFix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈56 tok
1 file · 33 in bundle
Tool list per prompt
≈72,488 tok
175 tools · 414 per tool
Handshake
3672 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 983

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for loopctl-mcp-server@3.12.0 as of 3d ago. This is the package itself, not its dependencies.