Skills/npm/mcp-products

mcp-products@0.23.29

VERIFIED· startup only

Publisher claims: "MCP server exposing Telora product operations to Claude Code" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher telora · publishing for 241 daysInstalls 7,345Last detonated 3d ago
$claude mcp add mcp-products -- npx -y @telora/mcp-products
WatchReport an issue

Coverage

Startup only; authenticated tool behavior not tested.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
TELORA_ACCESS_TOKENConfiguration, not credentials: INCIDENT_KEY_MAX, INCIDENT_KEY_PREFIX, TELORA_MCP_PRELOAD, TELORA_MCP_PROFILE, TELORA_STATE_DIR, TELORA_TRACKER_ID, TELORA_URL
Where it talks to
no vendor host named in the codeAlso syntelyos.com, staging.example — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names syntelyos.com, staging.example as well as its own vendor. The guard injects TELORA_ACCESS_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y @telora/mcp-products

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-11 and scored it 80/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 26 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.1sprocessexec /usr/bin/which
5.5sprocessdependency install exit 0
26sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-gHhFY7/task/home/work/acme-api/.claude/skills/mcp-products/dist/handlers/auditTreeAuthoringGuide.js' } Node.js v22.23.4
26sprocessscript backend runs setup only
26sprocesssecond launch, clock +45 days, CI unset
26sprocessexec /usr/bin/which

Static findings

MEDIUM
npx invocation of non-well-known packagedist/handlers/daemonConfig.d.ts:111 · npx invocation of non-well-known package — may execute untrusted code* install (see resolveDaemonBinary). There is no npx fallback.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/handlers/daemonConfig.d.ts:76 · npx invocation of non-well-known package — may execute untrusted code* install. There is NO npx fallback: a long-running daemon launched from theFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/handlers/daemonConfig.js:147 · npx invocation of non-well-known package — may execute untrusted code* npx cache (~/.npm/_npx/<hash>/) cannot self-update -- `npm install -g`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Unpinned dependencydist/handlers/daemonConfig.js:241 · Unpinned dependency* global install (`npm install -g @telora/daemon@latest`) -- sinceFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
MEDIUM
npx invocation of non-well-known packagedist/handlers/daemonConfig.d.ts:80 · npx invocation of non-well-known package — may execute untrusted code* install-or-error rather than silently bootstrap a non-updating npx daemon.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationdist/handlers/daemonConfig.js:184 · Auto-update or dynamic fetch configuration — agent may load new code at runtime// self-update target, so spawn WITHOUT --no-auto-update and let the daemonFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationdist/handlers/daemonConfig.js:152 · Auto-update or dynamic fetch configuration — agent may load new code at runtime* --no-auto-update policy: npm-mode self-update (packages/daemon/src/Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Unpinned dependencydist/handlers/daemonConfig.d.ts:114 · Unpinned dependency* global install (`npm install -g @telora/daemon@latest`) -- sinceFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
LOW
Unpinned dependencydist/handlers/daemonConfig.js:153 · Unpinned dependency* self-update.ts) runs `npm install -g @telora/daemon@latest` -- it updatesFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
MEDIUM
npx invocation of non-well-known packagedist/handlers/daemonConfig.d.ts:104 · npx invocation of non-well-known package — may execute untrusted code* { found: false } when the install throws or still nothing resolves. npx isFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/handlers/daemonConfig.js:150 · npx invocation of non-well-known package — may execute untrusted code* install-or-error rather than silently bootstrap a non-updating npx daemon.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/handlers/daemonConfig.d.ts:77 · npx invocation of non-well-known package — may execute untrusted code* npx cache (~/.npm/_npx/<hash>/) cannot self-update -- `npm install -g`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/handlers/daemonConfig.js:187 · npx invocation of non-well-known package — may execute untrusted code// not-found -- there is deliberately no npx last-resort.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
URL to a private-network addressdist/handlers/productHandlers.js:44 · URL to a private-network address — a LAN or development targetbaseUrl: z.string().optional().describe("Local-model base URL, e.g. http://10.1.1.146:8888/v1 (register_local_endpoint)"),Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
npx invocation of non-well-known packagedist/handlers/daemonConfig.js:205 · npx invocation of non-well-known package — may execute untrusted code// No npx fallback: npx cannot self-update a long-running daemon. The callerFix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Unpinned dependencydist/handlers/daemonConfig.d.ts:83 · Unpinned dependency* self-update.ts) runs `npm install -g @telora/daemon@latest` -- it updatesFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
HIGH
Auto-update or dynamic fetch configurationdist/handlers/daemonConfig.js:172 · Auto-update or dynamic fetch configuration — agent may load new code at runtime// KEEPS --no-auto-update (non-obvious): self-update installs to the npmFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/handlers/daemonConfig.js:146 · npx invocation of non-well-known package — may execute untrusted code* install. There is NO npx fallback: a long-running daemon launched from theFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli/init.js:3 · npx invocation of non-well-known package — may execute untrusted code// `npx @telora/mcp-products init` -- interactive setup for Telora MCP serverFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationdist/handlers/daemonConfig.d.ts:82 · Auto-update or dynamic fetch configuration — agent may load new code at runtime* --no-auto-update policy: npm-mode self-update (packages/daemon/src/Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈54 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @telora/mcp-products@0.23.29 as of 3d ago. This is the package itself, not its dependencies.

mcp-products@0.23.29 safety verdict: Verified (startup only) — KillerSkills