Skills/npm/mcp-builder-kit

mcp-builder-kit@1.2.3

VERIFIED· startup only

Publisher claims: "Production Toolkit & Scaffolding Engine for Model Context Protocol (MCP) Servers" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher ritualdev-lab · publishing for 31 daysInstalls 329Last detonated 9 h ago
$claude mcp add mcp-builder-kit -- npx -y @ritualdev-lab/mcp-builder-kit
WatchReport an issue

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
AGENTSHIELD_BADGE_SECRETAPI_KEYGRPC_AUTH_TOKEN or --allow-unauthenticatedConfiguration, not credentials: API_BASE_URL, GRAPHQL_ENDPOINT, GRPC_HOST, MCP_INSPECTOR_VERBOSE, MCP_PROTOCOL_VERSION, MCP_SERVER_NAME
Where it talks to
no vendor host named in the codeAlso dodopayments.com, shields.io, ritualdev.in, cal.com, gitcoin.co, polar.sh, biomejs.dev, fly.io, railway.com, tailwindcss.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names dodopayments.com, shields.io, ritualdev.in, cal.com, gitcoin.co, polar.sh, biomejs.dev, fly.io, railway.com, tailwindcss.com as well as its own vendor. The guard injects AGENTSHIELD_BADGE_SECRET, API_KEY, GRPC_AUTH_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y @ritualdev-lab/mcp-builder-kit

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-14 and scored it 81/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 20 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
20sclaimedstartup only: exited (0) before answering · Examples: npx @ritualdev-lab/mcp-builder-kit init my-sqlite-server npx @ritualdev-lab/mcp-builder-kit add-tool search_documents --desc "Searches internal knowledge" --params "query:string,limit:number" npx @ritualdev-lab/mcp-builder-kit from-openapi ./petstore.json --lang typescript
20sprocessscript backend runs setup only
20sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packageSKILL.md:21 · npx invocation of non-well-known package — may execute untrusted codenpx @ritualdev-lab/mcp-builder-kit init <server-name> --lang typescript --transport stdioFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli.js:34 · npx invocation of non-well-known package — may execute untrusted codenpx @ritualdev-lab/mcp-builder-kit <command> [options]Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/chunk-GXVZOV7D.js:308 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files} else if (entry.endsWith(".ts") || entry.endsWith(".js") || entry.endsWith(".py") || entry.endsWith(".json") || entry.endsWith(".env")) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:34 · npx invocation of non-well-known package — may execute untrusted codenpx @ritualdev-lab/mcp-builder-kit init <server-name> --lang pythonFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli.js:470 · npx invocation of non-well-known package — may execute untrusted codeconsole.log(` \u{1F449} Run: npx @ritualdev-lab/mcp-builder-kit badge ${serverSlug}Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli.js:115 · npx invocation of non-well-known package — may execute untrusted codenpx @ritualdev-lab/mcp-builder-kit from-openapi ./petstore.json --lang typescriptFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detecteddist/chunk-GXVZOV7D.js:50 · Python subprocess execution detectedremediation: "Use subprocess.run(['cmd', arg], shell=False) with tokenized arguments"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Unicode escape sequence detecteddist/cli.js:956 · Unicode escape sequence detected — may contain obfuscated payloads…ughputEndpointsPerSec} endpoints/s`.padEnd(29)} \u2502` ); console.log("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u250…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/cli.js:860 · Unicode escape sequence detected — may contain obfuscated payloads…; const summary = await runMockSandboxTest(tools); console.log( ` \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u250…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/cli.js:941 · Unicode escape sequence detected — may contain obfuscated payloads… const metrics = McpBenchmarkEngine.runBenchmark(iterations); console.log("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathsdist/chunk-RNCIFRTK.js:256 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files.env*Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/chunk-RNCIFRTK.js:179 · npx invocation of non-well-known package — may execute untrusted codeinstructions.push("2. Test locally on Cloudflare edge: npx wrangler dev");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/chunk-RNCIFRTK.js:180 · npx invocation of non-well-known package — may execute untrusted codeinstructions.push("3. Deploy to global edge network: npx wrangler deploy");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Unicode escape sequence detecteddist/cli.js:866 · Unicode escape sequence detected — may contain obfuscated payloads…\u2502 Average Latency: ${`${summary.avgLatencyMs}ms`.padEnd(36)} \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u25…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
npx invocation of non-well-known packagedist/cli.js:114 · npx invocation of non-well-known package — may execute untrusted codenpx @ritualdev-lab/mcp-builder-kit add-tool search_documents --desc "Searches internal knowledge" --params "query:string,limit:number"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli.js:113 · npx invocation of non-well-known package — may execute untrusted codenpx @ritualdev-lab/mcp-builder-kit init my-sqlite-serverFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/cli.js:811 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` \u2022 Output Dir: ${targetDir}Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈431 tok
1 file · 39 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @ritualdev-lab/mcp-builder-kit@1.2.3 as of 8 h ago. This is the package itself, not its dependencies.

mcp-builder-kit@1.2.3 safety verdict: Verified (startup only) — KillerSkills