Skills/npm/mcp-gateway

mcp-gateway@17.0.7

CAUTION· not started

Publisher claims: "MCP gateway for AI models (OpenAI, Grok, DeepSeek, Claude and other function-calling LLMs) and for web pages and apps: one authenticated, observable endpoint in front of your MCP servers with routing, scopes, rate limits and metrics." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher winstonsayno · publishing for 38 daysInstalls 18,022Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
AWS_ACCESS_KEY_IDAWS_SECRET_ACCESS_KEYAWS_SESSION_TOKENGITHUB_TOKENGOOGLE_OAUTH_ACCESS_TOKENMCP_GATEWAY_API_KEYSREMOTE_MCP_TOKENConfiguration, not credentials: AURA_GATEWAY_KEY, AWS_REGION, CI_GATEWAY_KEY, GITHUB_SHA, KUBERNETES_SERVICE_HOST, KUBERNETES_SERVICE_PORT, MCP_GATEWAY_ADMIN_KEY, MCP_GATEWAY_HOST, MCP_GATEWAY_KEY, MCP_GATEWAY_KV, MCP_GATEWAY_LOG_LEVEL, MCP_GATEWAY_PORT, MCP_GATEWAY_REDIS_URL, MCP_GATEWAY_URL, PROTECTED_RESOURCE_METADATA_PATH
Where it talks to
no vendor host named in the codeAlso githubcopilot.com, cedarpolicy.com, search.internal — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names githubcopilot.com, cedarpolicy.com, search.internal as well as its own vendor. The guard injects AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, GITHUB_TOKEN, GOOGLE_OAUTH_ACCESS_TOKEN, MCP_GATEWAY_API_KEYS, REMOTE_MCP_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y @winstonsayno/mcp-gateway

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-11 and scored it 73/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: URL with embedded credentials; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 7 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
7.2sprocessdependency install exit 1 · (Use `node --trace-warnings ...` to show where the warning was created) npm error Cannot read properties of null (reading 'edgesOut') npm error A complete log of this run can be found in: /tmp/ks-detonate-z74115/task/home/.npm/_logs/2026-11-11T02_48_26_769Z-debug-0.log
7.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed
7.2sprocessscript backend runs setup only
7.2sprocessno install scripts to re-run

Static findings

MEDIUM
File type combined with upload actiondist/gateway/api.js:280 · File type combined with upload action — agent may exfiltrate local data filesres.status(403).json({ error: 'Forbidden', message: 'Scoped clients cannot read the security posture' });Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/cli.js:389 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('\nGive the key to the client; put the hash in auth.apiKeys. The key is not shown again.');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/catalog/index.js:18 · npx invocation of non-well-known package — may execute untrusted codeconst npx = (pkg, ...extra) => ({Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/gateway/api.js:996 · File type combined with upload action — agent may exfiltrate local data filesres.set('Content-Type', 'text/csv; charset=utf-8').set('Content-Disposition', 'attachment; filename="mcp-gateway-usage.csv"').send(usageCsv(rows, group));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)dist/cli.js:181 · MCP server using network transport (SSE/HTTP) — data sent over networkconsole.log(JSON.stringify({ mcpServers: { gateway: { url: `http://127.0.0.1:${port}/mcp`, headers: { Authorization: `Bearer ${apiKey}` } } } }, null, 2));Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
URL with embedded credentialsdist/config/diff.js:34 · URL with embedded credentials — may be phishing or credential leaking// 10.2: credentials in URLs (`https://user:pass@…`, `?token=…`) — the whole URL is masked so a GET → PUT round trip restores it.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
npx invocation of non-well-known packagedist/config/loader.js:1601 · npx invocation of non-well-known package — may execute untrusted codecommand: npxFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/mcp/endpoint.js:392 · File type combined with upload action — agent may exfiltrate local data filesres.status(400).json(rpcError(msg.id, { code: JSONRPC_INVALID_REQUEST, message: `Invalid Request: clients do not send responses in MCP ${MODERN_PROTOCOL_VERSION}` }));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsdist/config/gitops.js:361 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst env = typeof m?.env === 'string' ? m.env : '';Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/catalog/index.js:202 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescfg.env = { ...(t.env ?? {}), ...env };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiondist/cli.js:180 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`Created ${options.output}\n\nPoint your desktop client at the gateway instead of the individual servers:\n`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/cli.js:182 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`\nThen run: mcp-gateway start -c ${options.output}\n`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/mcp/endpoint.js:387 · File type combined with upload action — agent may exfiltrate local data filesres.status(400).json(rpcError(null, { code: JSONRPC_INVALID_REQUEST, message: `Invalid Request: MCP ${MODERN_PROTOCOL_VERSION} takes one JSON-RPC message per POST` }));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/features/k8s.js:238 · File type combined with upload action — agent may exfiltrate local data filesres.json({ items: manifests, notes: ['auth.apiKeys are not rendered: put them in a Secret (MCP_GATEWAY_API_KEYS) and pass ?secret=<name>'] });Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/cli.js:459 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`Written to ${options.output}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/cli.js:133 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` 1. Edit ${options.output} to configure your MCP servers`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Auto-update or dynamic fetch configurationdist/gateway/api.d.ts:23 · Auto-update or dynamic fetch configuration — agent may load new code at runtime* Apply hot-reloadable settings from a new config: auth (strategy, keys,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationdist/mcp/endpoint.js:161 · Auto-update or dynamic fetch configuration — agent may load new code at runtime/** Apply hot-reloadable settings (everything except `enabled` and `path`). */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/config/loader.js:1592 · npx invocation of non-well-known package — may execute untrusted codecommand: npxFix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈98 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @winstonsayno/mcp-gateway@17.0.7 as of 3d ago. This is the package itself, not its dependencies.

What would make this Verified

7 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim winstonsayno: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  5. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  6. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim winstonsaynoPropose a patch to the maintainer