mcp-atlas@0.3.11
VERIFIEDPublisher claims: "Query the parcel ArcGIS REST endpoints of 515 counties across 51 US states (50 states plus DC), 509 endpoints total, for owner, APN and address lookup via the Model Context Protocol (MCP), plus verified city code-violation, building-permit and zoning-case" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher urbankitstudio · joined 0 days agoInstalls 4,044Last detonated 7 h ago
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-03 and scored it 87/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 2 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
1.8sprocessdependency install exit 1
2.0sprocessexec /usr/bin/timeout
2.0sprocessexited 1: Node.js v22.23.4
2.0sclaimedno tools/list reply (exit 1)
2.0sprocessscript backend runs setup only
Static findings
MEDIUM
Unicode escape sequence detecteddist/tool-input.js:20 · Unicode escape sequence detected — may contain obfuscated payloadsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07No other findings across 2,126 lines in 13 files.