mcp-gateway@17.0.0

CAUTION

Publisher claims: "MCP gateway for AI models (OpenAI, Grok, DeepSeek, Claude and other function-calling LLMs) and for web pages and apps: one authenticated, observable endpoint in front of your MCP servers with routing, scopes, rate limits and metrics." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher winstonsayno · joined 0 days agoInstalls 29,756Last detonated 1 h ago

Dispute verdict

Behavior trace

Honeypot run · 1 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.7sprocessdependency install exit 1

0.9sprocessexec /usr/bin/timeout

0.9sprocessexited 1: Node.js v22.23.4

0.9sclaimedno tools/list reply (exit 1)

0.9sprocessscript backend runs setup only

Static findings

HIGH

Outbound HTTP to raw IP addressdist/cli.js:181 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Outbound HTTP to raw IP addressdist/cli.js:933 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Access to sensitive file pathsdist/catalog/index.js:202 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packageREADME.md:137 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

URL with embedded credentialsdist/config/diff.js:34 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

Outbound HTTP to raw IP addressdist/bench/index.js:103 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Access to sensitive file pathsdist/config/gitops.js:361 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packageREADME.md:140 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagedist/catalog/index.js:18 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Outbound HTTP to raw IP addressdist/bench/index.js:102 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

npx invocation of non-well-known packagedist/config/loader.js:1585 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:133 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:136 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:139 · npx invocation of non-well-known package — may execute untrusted code

AST06

MEDIUM

File type combined with upload actiondist/cli.js:182 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)dist/cli.js:181 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

MEDIUM

File type combined with upload actiondist/cli.js:133 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

URL using raw IP addressdist/cli.js:933 · URL using raw IP address — may bypass domain-based filtering

AST07

HIGH

Auto-update or dynamic fetch configurationdist/gateway/api.d.ts:23 · Auto-update or dynamic fetch configuration — agent may load new code at runtime

AST06

MEDIUM

URL using raw IP addressdist/bench/index.js:102 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

File type combined with upload actiondist/cli.js:180 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)README.md:239 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

MEDIUM

File type combined with upload actiondist/gateway/api.js:996 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

File type combined with upload actiondist/mcp/endpoint.js:392 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

File type combined with upload actiondist/mcp/endpoint.js:387 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

File type combined with upload actiondist/features/k8s.js:238 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

File type combined with upload actiondist/cli.js:389 · File type combined with upload action — agent may exfiltrate local data files

AST07

HIGH

Auto-update or dynamic fetch configurationdist/mcp/endpoint.js:161 · Auto-update or dynamic fetch configuration — agent may load new code at runtime

AST06

HIGH

npx invocation of non-well-known packagedist/config/loader.js:1594 · npx invocation of non-well-known package — may execute untrusted code

AST06

MEDIUM

File type combined with upload actiondist/cli.js:459 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

URL using raw IP addressdist/bench/index.js:103 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressdist/cli.js:181 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

File type combined with upload actiondist/gateway/api.js:280 · File type combined with upload action — agent may exfiltrate local data files

AST07