Is mcp-server@0.1.71 safe to install?

mcp-server@0.1.71

CAUTION· not started

Publisher claims: "MCP server for Scaly - connect AI assistants to your cloud infrastructure" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher occam-scaly · publishing for 328 daysInstalls 1,264Last detonated 20 h ago

What would fix this Watch Dispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.

Tested: the dependency install step · every file read, file written and host contacted by what ran
Not tested: server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: SCALY_API_KEYSCALY_AUTH_STORE_PATHSCALY_MCP_AUTH_MODESCALY_MCP_AUTH_TIMEOUT_MSSCALY_MCP_AUTHORIZATION_SERVERSSCALY_MCP_OAUTH_PROBESCALY_MCP_OAUTH_PROBE_REDIRECT_ORIGINSSCALY_OIDC_TOKENConfiguration, not credentials: API_ENDPOINT, SCALY_ACCOUNT_ID, SCALY_API_URL, SCALY_APPSYNC_KEY, SCALY_CLI_BIN, SCALY_CONFIG_DIR, SCALY_DB_TUNNEL_DEBUG, SCALY_DB_TUNNEL_OPEN_TIMEOUT_MS, SCALY_DB_TUNNEL_URL, SCALY_MCP_ACTIVE_SCOPES, SCALY_MCP_ALLOWED_HOSTS, SCALY_MCP_AUDIT, SCALY_MCP_AUDIT_FILE, SCALY_MCP_CLIENT_LABEL, SCALY_MCP_CRASH_THRESHOLD, SCALY_MCP_CRASH_WINDOW_MS, SCALY_MCP_DESIRED_MODE, SCALY_MCP_HTTP_HOST, SCALY_MCP_HTTP_PORT, SCALY_MCP_PUBLIC_URL, SCALY_MCP_TIMEOUT_MS, SCALY_MCP_TRANSPORT, SCALY_STAGE, SCALY_WORKSPACE_ROOT, SCALY_WORKSPACE_URL
Where it talks to: no vendor host named in the codeAlso scalyapps.io, scaly.cloud — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names scalyapps.io, scaly.cloud as well as its own vendor. The guard injects SCALY_API_KEY, SCALY_AUTH_STORE_PATH, SCALY_MCP_AUTH_MODE, SCALY_MCP_AUTH_TIMEOUT_MS, SCALY_MCP_AUTHORIZATION_SERVERS, SCALY_MCP_OAUTH_PROBE, SCALY_MCP_OAUTH_PROBE_REDIRECT_ORIGINS, SCALY_OIDC_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y @occam-scaly/mcp-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Credential pass-through configuration; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 11 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

10sprocessdependency install exit 254 · npm error enoent This is related to npm not being able to find a file. npm error enoent npm error A complete log of this run can be found in: /tmp/ks-detonate-lABKUJ/task/home/.npm/_logs/2026-11-13T16_44_01_373Z-debug-0.log

10sclaimednot started: dependency install failed (exit 254); the server itself was not observed

10sprocessscript backend runs setup only

10sprocessno install scripts to re-run

Static findings

HIGH

Access to sensitive file pathsdist/tools/doctor.js:91 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

…cription: 'Run a local connectivity checklist (auth, API reachability, optional .env keys, optional DB tunnel port, optional storage access). The API reachability p…

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Process kill commanddist/tools/db.js:638 · Process kill command — agent can terminate processes// kill the opposite direction while it is still draining query results.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

File type combined with upload actiondist/tools/db.js:1031 · File type combined with upload action — agent may exfiltrate local data filesreturn await client.query(input.sql, input.params || []);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)dist/resources/onboarding.js:25 · MCP server using network transport (SSE/HTTP) — data sent over network

{"mcpServers":{"scaly":{"command":"npx","args":["-y","@occam-scaly/mcp-server@latest"],"env":{"SCALY_WORKSPACE_URL":"https://WORKSPACE.scaly.cloud"}}}}

Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

File type combined with upload actiondist/tools/db.js:903 · File type combined with upload action — agent may exfiltrate local data filesreturn await client.query(input.sql, input.params || []);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

HIGH

Credential pass-through configurationdist/tools/db.js:425 · Credential pass-through configuration — agent relays sensitive credentials

const data = await requestDatabaseProxyToken((query, variables) => (0, client_js_1.oidcQuery)(query, variables), CREATE_DB_PROXY_TOKEN, {

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST02

MEDIUM

npx invocation of non-well-known packagedist/tools/project.js:312 · npx invocation of non-well-known package — may execute untrusted code// Prefer monorepo script when available (dev), otherwise use published CLI via npx (end users).Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

HIGH

Access to sensitive file pathsdist/resources/onboarding.d.ts:6 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

…/guides/workloads. Interactive login does not enroll a machine. No hand-written .env or .pem is needed for sign-in; Workload enrollment generates its own private ke…

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdist/tools/doctor.js:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files.describe('Workspace-relative path to a .env file to check (optional).'),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Process kill commanddist/resilience.js:4 · Process kill command — agent can terminate processes// Issue #44 FIX-1: a single uncaught async error used to kill the process,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

MCP server using network transport (SSE/HTTP)dist/resources/onboarding.d.ts:6 · MCP server using network transport (SSE/HTTP) — data sent over network

…om the workspace Connections page. A standard stdio configuration is:\n\n {\"mcpServers\":{\"scaly\":{\"command\":\"npx\",\"args\":[\"-y\",\"@occam-scaly/mcp-server@latest\"],\"env\":{\"SCALY_WORKSPACE_URL\":\"https://WORKSPACE.scaly.cloud…

Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

HIGH

Credential pass-through configurationdist/tools/db.js:397 · Credential pass-through configuration — agent relays sensitive credentials

return 'Scaly could not mint a database proxy token in time. Retry; if it persists, run scaly_doctor and contact support with the resource ID.';

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST02

HIGH

Credential pass-through configurationdist/tools/db.js:315 · Credential pass-through configuration — agent relays sensitive credentialsmutation CreateDatabaseProxyToken(Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST02

HIGH

Access to sensitive file pathsdist/tools/doctor.js:143 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// .env key checklist (optional)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Credential pass-through configurationdist/tools/db.js:12 · Credential pass-through configuration — agent relays sensitive credentials

const { resolveDatabaseTunnel, requestDatabaseProxyToken, resolveDatabaseControlPlaneDomain } = dbRequire('../../vendor/db-tunnel.js');

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST02

HIGH

Credential pass-through configurationdist/tools/db.js:320 · Credential pass-through configuration — agent relays sensitive credentialscreateDatabaseProxyToken(where: $where, ttlMinutes: $ttlMinutes, accessMode: $accessMode) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST02

HIGH

Access to sensitive file pathsdist/resources/onboarding.js:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

…/guides/workloads. Interactive login does not enroll a machine. No hand-written .env or .pem is needed for sign-in; Workload enrollment generates its own private ke…

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdist/tools/doctor.js:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files.default('.env')Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

npx invocation of non-well-known packagedist/tools/project.js:334 · npx invocation of non-well-known package — may execute untrusted code// Last-resort fallback: npx install. This is intentionally not the default.Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

LOW

Unpinned dependencydist/resources/onboarding.d.ts:6 · Unpinned dependency

…s login are separate.\n\nCLI:\n1. Install Node.js with npm if needed, then run: npm install -g @occam-scaly/scaly-cli@latest\n2. The executable is scaly. Check: scaly --version\n3. Run: scaly auth login -…

Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.

AST06

LOW

Unpinned dependencydist/tools/project.js:583 · Unpinned dependency

…ackage dependency ${expectedRange}. Update the global CLI install, for example: npm install -g @occam-scaly/scaly-cli@latest.`); } return (0, index_js_1.ok)({ bundl…

Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.

AST06

LOW

Unpinned dependencydist/resources/onboarding.js:17 · Unpinned dependency1. Install Node.js with npm if needed, then run: npm install -g @occam-scaly/scaly-cli@latestFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.

AST06

LOW

Authorization escalation languageREADME.md:342 · Authorization escalation language · informational: not an instruction fileStarting a client in `/` does not grant root privileges. Local project tools useFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

MEDIUM

npx invocation of non-well-known packagedist/tools/project.js:571 · npx invocation of non-well-known package — may execute untrusted code

warnings.push('Falling back to npx @occam-scaly/scaly-cli@latest. Install the MCP package from npm (recommended) or set SCALY_CLI_BIN for a pinned CLI.');

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

Cost to the agent

Instructions loaded

≈57 tok

1 file · 81 in bundle

Tool list per prompt

≈0 tok

0 tools · 0 per tool

Handshake

no reply

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @occam-scaly/mcp-server@0.1.71 as of 20 h ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%

Unclaimed publisher≈ +8 on the totalClaim occam-scaly: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
Unpinned dependencies≈ +4 on the totalPin exact versions (and ideally hashes) in package.json, requirements or the install script so the bundle cannot change under you.
Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.

Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim occam-scaly Propose a patch to the maintainer