Skills/npm/loopctl-mcp-server

loopctl-mcp-server@3.13.1

VERIFIED

Publisher claims: "MCP server for loopctl — structural trust for AI development loops" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher mkreyman · publishing for 226 daysInstalls 2,648Last detonated 24 h ago
$claude mcp add loopctl-mcp-server -- npx -y loopctl-mcp-server
WatchReport an issue

Coverage

Server started and answered tools/list.
Tested
MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with real credentials

Before you give it your token

It will ask for
LOOPCTL_API_KEYConfiguration, not credentials: CLAUDE_SESSION_ID, ESCALATIONS_PATH, HANDOFF_KEY_PREFIX, LOOPCTL_AGENT_KEY, LOOPCTL_ORCH_KEY, LOOPCTL_SERVER, LOOPCTL_USER_KEY, RUNNERS_PATH, SOURCES_PATH, TUNING_DRAFTS_PATH
Where it talks to
loopctl.com (its own)Also example.internal — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names example.internal as well as its own vendor. The guard injects LOOPCTL_API_KEY only into requests to loopctl.com (and its subdomains) and refuses the rest.

$vet-skills run --secrets LOOPCTL_API_KEY=loopctl.com -- npx -y loopctl-mcp-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-13 and scored it 85/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 26 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
5.8sprocessdependency install exit 0
26sclaimed175 tools: get_tenant, list_projects, resolve_project, create_project, create_kb_scope, archive_kb_scope, restore_kb_scope, handoff, channel_post, channel_recent, channel_handoffs, channel_get, channel_delete, channel_graduate, channel_claim, channel_release, channel_done, channel_lock, channel_unlock, channel_claims, channel_locks, delete_project, restore_project, update_project, get_progress
26stools30e100d550637638
26stools3166d8f06af3c099
26stools0ca5ad994cb35672
26stools74e34c80f1e70c6f
26stools9be9d4763d5a8008
26stoolsc9302538b22d68d3
26stoolsd5443c462681e400
26stools0d9493d19483dec6
26stoolsb4156e86b6f71a1c
26stools2de16a1ac38a0b00
26stools7d739f04b792eac2
26stools4a6feeb5320e34c1
26stools1575ed4c3939ba07
26stoolse29be25ddd5465ef
26stools0e3297e4eafed4a6
26stoolse523fdc11fed3261
26stools590c8dd7fc75c3a3
26stoolsecbca7ea79861aa8
26stools5b377395423fe14a
26stools7f8be325483a6099
26stools9172a94c77cf5268
26stools208710bd38c54f62
26stoolsb4f80f6db7ee8fcb
26stools5646b780e7ea59c1
26stools4b3e77e126f75a73
26stools1e0220239546c3d9
26stools969b01633076e3f5
26stools56737fca2e22b083
26stools6c77970e8a6c1397
26stoolsa8d19916e7deea7c
26stools6ce740aba740df0f
26stools4407d0572ed05b29
26stools0805b19987ad51ab
26stoolsc6539de1bbbda0c5
26stools4147988ccf7298ae
26stools710803a43a94ffc2
26stools98920e9c87f9b793
26stools878e97731f38aa7b
26stoolsbfd3b8d587b1e695
26stools790475a5ffd5573e
26stoolsb2b1bbc722a37d63
26stools96adc99497aa7104
26stoolsb20c1e6430ab153e
26stoolsee82faad6f559d10
26stoolsbc69592e2bc3452e
26stoolsbd805e981a0eec10
26stoolscc7d4cccfaacc8f4
26stoolsef88e674418de46b
26stools1e5d2b44814ee13e
26stoolsf849bffca1235103
26stools42e490b74d54df7d
26stoolsc46926416a210838
26stools95241e59048f532d
26stools0317595359c33127
26stools4138027569fa9dd0
26stools05c81c802f5f0e69
26stools0a6faba06346b40c
26stoolsa806a8eea41a2364
26stoolsf65e29a72cc87eaf
26stools71ebc28d213c4ee6
26stoolsc53bf3ca95812d74
26stoolsa92f19b0b2024834
26stools620d4fbd60c56226
26stoolsb19616c7b47d89e8
26stools1340b1bd0a18787c
26stools78843a907c9ed162
26stoolsbf3e38ec839a1865
26stoolscb16167cbebc4bb0
26stools31f2afd46f68dd62
26stools297261f9026402e3
26stools991cf5e5043e001e
26stoolse3befc64d27fbd2d
26stools592d0e6c5920bd50
26stools8cef34ecd77eef3e
26stoolsa19b7288de143f7f
26stoolsa0e40e524a34162e
26stoolsfb0d979c03e8df16
26stools0257f42880dd6ab4
26stools12bc102b186e7cfe
26stools443bb68f7e8a37d6
26sprocessscript backend runs setup only
26sprocessno install scripts to re-run

Static findings

HIGH
Credential pass-through configurationindex.js:8298 · Credential pass-through configuration — agent relays sensitive credentials"Pass api_key_id (api_keys.id credential) OR agent_id (agents.id logical identity) — not both. " +Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
LOW
Refusal suppressionREADME.md:538 · Refusal suppression — attempting to prevent safety responses · informational: not an instruction file…he declared prefixes. A retry carrying a `dispatch_id` loopctl already holds is never refused for either prefix reason: its claim is already standing, so the declaration on…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packageindex.js:876 · npx invocation of non-well-known package — may execute untrusted code// one-shot post shape. With the process-lifetime id an npx respawn mid-lease 404'dFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageindex.js:601 · npx invocation of non-well-known package — may execute untrusted code// process-lifetime uuid turns every npx respawn or /mcp reconnect into a 409 on thisFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathslib/payload-path.js:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// so a symlink named x.json cannot point at /etc/passwd or /procFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagelib/claim-session.js:15 · npx invocation of non-well-known package — may execute untrusted code* process-lifetime id, every npx respawn or `/mcp` reconnect turns the session's OWN liveFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Tool description instructs the agent: credential exfiltration instructionmcp:tools/revoke_dispatch:1 · Instruction aimed at the agent: credential exfiltration instructionEVOKE A DISPATCH AND ITS WHOLE SUBTREE (POST /api/v1/dispatches/:id/revoke), plus the ephemeral api_key each one minted. `Dispatches.revoke/2` matches the dispaFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST01

Cost to the agent

Instructions loaded
≈56 tok
1 file · 33 in bundle
Tool list per prompt
≈72,668 tok
175 tools · 415 per tool
Handshake
9179 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 985

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for loopctl-mcp-server@3.13.1 as of 24 h ago. This is the package itself, not its dependencies.