Is mcp-server@0.10.231 safe to install?

mcp-server@0.10.231

CAUTION· not started

Publisher claims: "Memory for coding agents: your AI stores every fix and finds it again when the problem returns. MCP server for Claude Code, Cursor, Copilot, Windsurf, Codex and Gemini CLI, hosted in the EU." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher cachly-dev · publishing for 212 daysInstalls 17,091Last detonated 8d ago

What would fix this Watch Dispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.

Tested: second launch with the clock 45 days ahead · the dependency install step · every file read, file written and host contacted by what ran
Not tested: server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

Code inventory arrives with this version's next honeypot run.

It will ask for: unknown until the next run
Where it talks to: unknown until the next run
What the honeypot saw: no credential files read · no network
What we could not test: server startup · the tool list · tool behavior

Not enough was observed to say yet. Not started: dependency install failed; the server itself was not observed. This version's code has not been inventoried for credentials and hosts either; both arrive with its next honeypot run (popular servers first). `vet-skills try mcp-server` runs it now and prints the full answer.

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-07 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; URL with embedded credentials; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 1 s · 3 scenarios · 0 deviations

t+CategoryObserved action

0.8sprocessdependency install exit 1

1.0sprocessexec /usr/bin/date

1.0sprocessexec /usr/bin/timeout

1.0sclaimedno tools/list reply (exit 0)

1.0sprocessscript backend runs setup only

1.0sprocesssecond launch, clock +45 days, CI unset

1.1sprocessexec /usr/bin/faketime

Static findings

MEDIUM

File type combined with upload actiondist/src/ambient-hooks.js:9 · File type combined with upload action — agent may exfiltrate local data files

`,"utf-8")}return{scriptPath:i,bundlePath:n,hooksPath:r,scripts:T,hooks:b}}function H(t){return!!t&&typeof t=="object"&&!Array.isArray(t)}class O extends Error{}function Z(t,o){if(t!==void 0&&!Array.i

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File permission modification commanddist/src/cls-hook.js:1 · File permission modification command — agent changes file ownership/permissions

import{existsSync as f,statSync as h}from"node:fs";import{readFile as _,writeFile as p,chmod as u,mkdir as C}from"node:fs/promises";import{basename as l,dirname as d,resolve as o}from"node:path";impor

Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

HIGH

Access to sensitive file pathsdist/src/embeddings.js:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesSet OPENAI_API_KEY in your .env, or switch provider:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

URL with embedded credentialsdist/src/handlers/team.js:44 · URL with embedded credentials — may be phishing or credential leaking

`)}case"setup_ai_memory":{const{instance_id:i,project_dir:t,embed_provider:a="openai",project_description:n="a software project"}=w,o=await E(`/api/v1/instances/${i}`),e={openai:{key:"OPENAI_API_KEY",

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

HIGH

Access to sensitive file pathsdist/src/einblendung.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

import{readFileSync as T,existsSync as C,writeFileSync as j,mkdirSync as F,statSync as W,appendFileSync as V}from"node:fs";import{dirname as R,join as _}from"node:path";import{tmpdir as b}from"node:os

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

LOW

Collapsed <details> block carrying instructionsREADME.md:370 · Collapsed <details> block carrying instructions · informational: not an instruction file · informational: not an instruction file

<summary><b>Claude Code</b> (<code>.mcp.json</code> in the project)</summary> ```json { "mcpServers": { "cachly": { "command": "npx", "args": ["-y", "@cachly-de

Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

MEDIUM

npx invocation of non-well-known packagedist/src/doctor.js:1 · npx invocation of non-well-known package — may execute untrusted code

import{existsSync as a,readFileSync as u}from"node:fs";import{resolve as d}from"node:path";import{AMBIENT_HOOK_VERSION as h}from"./ambient-hooks.js";import{netBalance as y}from"./ambient-recall.js";im

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

HIGH

Access to sensitive file pathsdist/src/tuersteher.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

import{VERDACHT_TAG as o}from"./verdacht-marke.js";const d=/\banweisung\w*|\binstruction\w*|\bausf(?:ue|ü)hr\w*|\bexecute\b|\bhochlad\w*|\bupload\w*|\bsende\w*|\berw(?:ae|ä)hn\w*|\blade\b[^>]{0,80}\bh

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdist/src/index.js:69 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

`)}catch{}}if(s==="continue"){const u=a.experimental??{},h=u.modelContextProtocolServers??[];let y;for(const m of h){const r=m.env??{};if(r.CACHLY_JWT){y=r.CACHLY_JWT;break}}y&&he(y,i);const x=h.filte

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdist/src/index.js:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

import{setzeClientKennung as zt}from"./herkunft.js";import{jwtExpiryMs as Ut,checkJwt as Jt,handleApiError as Wt,diagnoseAuth as Te,planAuthHeal as Je,readClientCredentialsFromEnv as Ft,buildClientCre

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

File type combined with upload actiondist/src/ambient-hooks.js:6 · File type combined with upload action — agent may exfiltrate local data files

`,"utf-8")),{sessionStartPath:r("SessionStart"),promptSubmitPath:r("UserPromptSubmit"),preToolUsePath:r("PreToolUse"),stopPath:r("Stop"),bundlePath:d,scripts:G,settings:P}}const F=".cursor/hooks",Tt="

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

HIGH

Access to sensitive file pathsdist/src/credentials.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

import{existsSync as o,mkdirSync as p,writeFileSync as f,renameSync as y,chmodSync as l,readFileSync as a}from"node:fs";import{resolve as s,dirname as m}from"node:path";function h(){return process.env

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Auto-update or dynamic fetch configurationdist/src/neue-fassung.js:4 · Auto-update or dynamic fetch configuration — agent may load new code at runtime

`)}catch{}}return l},s=e.heim??y(t),a=s?U(s):"",o=(e.jetzt??Date.now)(),u=a?await j(a):null;if(u&&o-u.zeit>=0&&o-u.zeit<A)return{art:"zwischenspeicher",neueste:u.latest,neuer:n(u.latest)};try{const i=

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

File permission modification commanddist/src/ambient-hooks.js:1 · File permission modification command — agent changes file ownership/permissions

import{existsSync as w,readFileSync as j}from"node:fs";import{readFile as v,writeFile as E,chmod as M,mkdir as N}from"node:fs/promises";import{dirname as K,resolve as l}from"node:path";import{fileURLT

Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

HIGH

Access to sensitive file pathsdist/src/hook-zugang.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

import{readdirSync as f,readFileSync as l}from"node:fs";import{homedir as k}from"node:os";import{join as n}from"node:path";import{readInstanceId as d,resolveApiKey as j}from"./credentials.js";import{e

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdist/src/tools.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

const e=[{name:"list_instances",description:"List all your cachly cache instances with their status and connection details. Read-only. Returns an array of instance objects \u2014 each with id, name, t

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

File type combined with upload actiondist/src/cursor-hook.js:1 · File type combined with upload action — agent may exfiltrate local data files

import{createHash as l}from"node:crypto";import{mkdirSync as S,readFileSync as d,renameSync as _,rmSync as p,writeFileSync as b}from"node:fs";import{tmpdir as g}from"node:os";import{join as i}from"nod

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

HIGH

Outbound HTTP to raw IP addressdist/src/tools.js:1 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

const e=[{name:"list_instances",description:"List all your cachly cache instances with their status and connection details. Read-only. Returns an array of instance objects \u2014 each with id, name, t

Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)dist/src/doctor.js:1 · MCP server using network transport (SSE/HTTP) — data sent over network

import{existsSync as a,readFileSync as u}from"node:fs";import{resolve as d}from"node:path";import{AMBIENT_HOOK_VERSION as h}from"./ambient-hooks.js";import{netBalance as y}from"./ambient-recall.js";im

Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

MCP server using network transport (SSE/HTTP)dist/src/hook-zugang.js:1 · MCP server using network transport (SSE/HTTP) — data sent over network

import{readdirSync as f,readFileSync as l}from"node:fs";import{homedir as k}from"node:os";import{join as n}from"node:path";import{readInstanceId as d,resolveApiKey as j}from"./credentials.js";import{e

Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

MCP server using network transport (SSE/HTTP)dist/src/einblendung.js:1 · MCP server using network transport (SSE/HTTP) — data sent over network

import{readFileSync as T,existsSync as C,writeFileSync as j,mkdirSync as F,statSync as W,appendFileSync as V}from"node:fs";import{dirname as R,join as _}from"node:path";import{tmpdir as b}from"node:os

Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

File type combined with upload actiondist/src/index.js:2 · File type combined with upload action — agent may exfiltrate local data files

import{setzeClientKennung as zt}from"./herkunft.js";import{jwtExpiryMs as Ut,checkJwt as Jt,handleApiError as Wt,diagnoseAuth as Te,planAuthHeal as Je,readClientCredentialsFromEnv as Ft,buildClientCre

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

Unicode escape sequence detecteddist/src/handlers/team.js:44 · Unicode escape sequence detected — may contain obfuscated payloads

`)}case"setup_ai_memory":{const{instance_id:i,project_dir:t,embed_provider:a="openai",project_description:n="a software project"}=w,o=await E(`/api/v1/instances/${i}`),e={openai:{key:"OPENAI_API_KEY",

Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.

AST07

MEDIUM

npx invocation of non-well-known packagedist/src/index.js:68 · npx invocation of non-well-known package — may execute untrusted code

`)}),process.stdout.on("error",()=>{}),process.stdin.on("error",()=>{});function Es(e,t){const n=Object.entries(t).map(([s,o])=>`${s}=${o}`);return e==="codex"?{befehl:`codex mcp add cachly ${n.map(s=

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagedist/src/index.js:70 · npx invocation of non-well-known package — may execute untrusted code

\u26A0\uFE0F  No cachly key or Brain instance found (environment or ~/.cachly/credentials.json).`),console.log(`   Run: npx @cachly-dev/mcp-server@latest autopilot

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Process kill commanddist/src/handlers/team.js:39 · Process kill command — agent can terminate processes

`)}case"import_public_brain":{const{instance_id:i,framework:t,limit:a=20}=w,n=await _(i),o={nextjs:[{topic:"nextjs:image-layout",lesson:'Use fill + relative parent instead of layout="fill" (deprecated

Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

File type combined with upload actiondist/src/index.js:179 · File type combined with upload action — agent may exfiltrate local data files

\u2713  Already configured: ${w} (no change)`)}const p=await Mt(y,l);for(const[w,C]of Object.entries(p))console.log(Dt(w.split(/[\\/]/).pop()??w,C));try{const w=await at(y,l),C=c(y,o(Yo(y),"post-commi

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actiondist/src/embeddings.js:7 · File type combined with upload action — agent may exfiltrate local data files

ollama  \u2192 OLLAMA_BASE_URL (local, no key needed)`);const n=`${a.apiUrl}/api/v1/embed`,s={text:t};(r??a.model)&&(s.model=r??a.model);const o=process.env.CACHLY_ADMIN_KEY??"",c=await fetch(n,{metho

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actiondist/src/index.js:25 · File type combined with upload action — agent may exfiltrate local data files

\u2022 Technical detail: ${d}`)}return te.set(e,i),Y("verbindung: Valkey verbunden"),i}async function O(e,t={},n=!1){n||Je(Te(b))!=="none"&&await Le(),Jt(b);const s=Number(process.env.CACHLY_API_TIMEO

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

npx invocation of non-well-known packagedist/src/handlers/team.js:44 · npx invocation of non-well-known package — may execute untrusted code

`)}case"setup_ai_memory":{const{instance_id:i,project_dir:t,embed_provider:a="openai",project_description:n="a software project"}=w,o=await E(`/api/v1/instances/${i}`),e={openai:{key:"OPENAI_API_KEY",

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagedist/src/index.js:32 · npx invocation of non-well-known package — may execute untrusted code

`)):["\u{1F9E0} **cachly AI Brain \u2014 Setup required**","","Run the setup wizard once in your terminal:","   ```","   npx @cachly-dev/mcp-server@latest autopilot","   ```","",`Or get your API key a

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

File type combined with upload actiondist/src/index.js:158 · File type combined with upload action — agent may exfiltrate local data files

`);try{const i=await fetch(`${_}/api/v1/instances/${t}/memory`,{headers:{Authorization:`Bearer ${e}`},signal:AbortSignal.timeout(8e3)});let c=0,a=0;if(i.ok){const h=await i.json();c=h.lesson_count??0,

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

Unicode escape sequence detecteddist/src/index.js:74 · Unicode escape sequence detected — may contain obfuscated payloads

`);try{const n=await fetch(`${_}/api/v1/instances/${t}/memory`,{headers:{Authorization:`Bearer ${e}`},signal:AbortSignal.timeout(8e3)});if(!n.ok)throw new Error(`stats HTTP ${n.status}`);const s=await

Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.

AST07

MEDIUM

npx invocation of non-well-known packagedist/src/index.js:76 · npx invocation of non-well-known package — may execute untrusted code

`))console.log(`  ${p}`);console.log("\x1B[90m"+"\u2500".repeat(63)+"\x1B[0m"),console.log(""),console.log("  \x1B[36m\u{1F426} Tweet this:\x1B[0m"),console.log(`  \x1B[4m${r.slice(0,90)}...\x1B[0m`),

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

File type combined with upload actiondist/src/index.js:111 · File type combined with upload action — agent may exfiltrate local data files

`),process.exit(1)}const{instance_id:l,instance_name:u,tier:h,label:y}=g,x=new Date(g.expires_at).toLocaleDateString();console.log(""),console.log("  \x1B[35m\u2554\u2550\u2550\u2550\u2550\u2550\u2550

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)dist/src/handlers/team.js:44 · MCP server using network transport (SSE/HTTP) — data sent over network

`)}case"setup_ai_memory":{const{instance_id:i,project_dir:t,embed_provider:a="openai",project_description:n="a software project"}=w,o=await E(`/api/v1/instances/${i}`),e={openai:{key:"OPENAI_API_KEY",

Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

MCP server using network transport (SSE/HTTP)dist/src/index.js:2 · MCP server using network transport (SSE/HTTP) — data sent over network

import{setzeClientKennung as zt}from"./herkunft.js";import{jwtExpiryMs as Ut,checkJwt as Jt,handleApiError as Wt,diagnoseAuth as Te,planAuthHeal as Je,readClientCredentialsFromEnv as Ft,buildClientCre

Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

MCP server using network transport (SSE/HTTP)dist/src/index.js:68 · MCP server using network transport (SSE/HTTP) — data sent over network

`)}),process.stdout.on("error",()=>{}),process.stdin.on("error",()=>{});function Es(e,t){const n=Object.entries(t).map(([s,o])=>`${s}=${o}`);return e==="codex"?{befehl:`codex mcp add cachly ${n.map(s=

Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

File type combined with upload actiondist/src/lernen.js:6 · File type combined with upload action — agent may exfiltrate local data files

`,{mode:384}),l}catch{return null}}async function ce(e,t,n,o){let a;try{a=K(g())}catch{return}const r=`${c(e.instanceId)}-`,i=[];for(const u of a){const s=h(g(),u);try{const l=o-D(s).mtimeMs;l>ie?E(s,

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

URL using raw IP addressdist/src/tools.js:1 · URL using raw IP address — may bypass domain-based filtering

const e=[{name:"list_instances",description:"List all your cachly cache instances with their status and connection details. Read-only. Returns an array of instance objects \u2014 each with id, name, t

Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

npx invocation of non-well-known packagedist/src/neue-fassung.js:4 · npx invocation of non-well-known package — may execute untrusted code

`)}catch{}}return l},s=e.heim??y(t),a=s?U(s):"",o=(e.jetzt??Date.now)(),u=a?await j(a):null;if(u&&o-u.zeit>=0&&o-u.zeit<A)return{art:"zwischenspeicher",neueste:u.latest,neuer:n(u.latest)};try{const i=

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

MCP server using network transport (SSE/HTTP)dist/src/index.js:171 · MCP server using network transport (SSE/HTTP) — data sent over network

Usage: npx @cachly-dev/mcp-server@latest init --instance-id <uuid> --api-key <cky_live_...> [--editor claude|cursor|windsurf|copilot|continue|cline|zed|codex|gemini] [--project-dir /path] [--api-url h

Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

npx invocation of non-well-known packagedist/src/uninstall.js:15 · npx invocation of non-well-known package — may execute untrusted code

Remove these ${c.length} items from this project? [y/N] `)){const m=Y(i);Q(m,e),h+=m.filter(f=>f.status==="entfernt").length,u+=m.filter(f=>f.status==="uebersprungen"&&f.fund.aktion!=="melden").length

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagedist/src/uebernahme.js:1 · npx invocation of non-well-known package — may execute untrusted code

const l="https://auth.cachly.dev/realms/cachly/protocol/openid-connect",d="cachly-cli",p="X-Trial-Key";function h(e){return typeof e=="string"&&/^cky_trial_[A-Za-z0-9]{8,}$/.test(e.trim())}function g(

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

MCP server using network transport (SSE/HTTP)dist/src/index.js:125 · MCP server using network transport (SSE/HTTP) — data sent over network

`);try{const e=await fetch("https://registry.npmjs.org/@cachly-dev/mcp-server/latest",{signal:AbortSignal.timeout(8e3)});if(!e.ok)throw new Error(`registry HTTP ${e.status}`);const n=(await e.json()).

Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

File type combined with upload actiondist/src/uebernahme.js:1 · File type combined with upload action — agent may exfiltrate local data files

const l="https://auth.cachly.dev/realms/cachly/protocol/openid-connect",d="cachly-cli",p="X-Trial-Key";function h(e){return typeof e=="string"&&/^cky_trial_[A-Za-z0-9]{8,}$/.test(e.trim())}function g(

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actiondist/src/uninstall.js:14 · File type combined with upload action — agent may exfiltrate local data files

`,entfernt:n}}function Ge(t,e){const n=I(e,t);return n!==""&&!n.startsWith("..")&&!T(n)}function W(t,e,n,r){const o=new Set(t.filter(c=>c.stufe===e&&(c.aktion==="datei-loeschen"||c.aktion==="ordner-lo

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

npx invocation of non-well-known packagedist/src/zugang.js:1 · npx invocation of non-well-known package — may execute untrusted code

import{istPlatzhalter as o}from"./credentials.js";function c(e){if(typeof e!="string")return"";const t=e.trim();return t&&!o(t)?t:""}const l=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Unicode escape sequence detecteddist/src/tools.js:10 · Unicode escape sequence detected — may contain obfuscated payloads

Optionally writes copilot-instructions.md directly to the project directory.`,inputSchema:{type:"object",properties:{instance_id:{type:"string",description:"UUID of the cachly instance to use as the A

Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.

AST07

MEDIUM

Unicode escape sequence detecteddist/src/search.js:1 · Unicode escape sequence detected — may contain obfuscated payloads

const d=new Set(["the","a","an","is","are","was","were","be","been","being","have","has","had","having","do","does","did","doing","will","would","could","should","may","might","shall","can","to","of",

Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.

AST07

MEDIUM

File type combined with upload actiondist/src/tools.js:10 · File type combined with upload action — agent may exfiltrate local data files

Optionally writes copilot-instructions.md directly to the project directory.`,inputSchema:{type:"object",properties:{instance_id:{type:"string",description:"UUID of the cachly instance to use as the A

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

npx invocation of non-well-known packagedist/src/uninstall.js:14 · npx invocation of non-well-known package — may execute untrusted code

`,entfernt:n}}function Ge(t,e){const n=I(e,t);return n!==""&&!n.startsWith("..")&&!T(n)}function W(t,e,n,r){const o=new Set(t.filter(c=>c.stufe===e&&(c.aktion==="datei-loeschen"||c.aktion==="ordner-lo

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

File type combined with upload actiondist/src/tools.js:1 · File type combined with upload action — agent may exfiltrate local data files

const e=[{name:"list_instances",description:"List all your cachly cache instances with their status and connection details. Read-only. Returns an array of instance objects \u2014 each with id, name, t

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)dist/src/uninstall.js:14 · MCP server using network transport (SSE/HTTP) — data sent over network

`,entfernt:n}}function Ge(t,e){const n=I(e,t);return n!==""&&!n.startsWith("..")&&!T(n)}function W(t,e,n,r){const o=new Set(t.filter(c=>c.stufe===e&&(c.aktion==="datei-loeschen"||c.aktion==="ordner-lo

Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

npx invocation of non-well-known packagescripts/postinstall.js:22 · npx invocation of non-well-known package — may execute untrusted code${c.cyan}npx @cachly-dev/mcp-server@latest autopilot${c.reset}Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

Cost to the agent

Instructions loaded

≈87 tok

1 file · 81 in bundle

Tool list per prompt

≈0 tok

0 tools · 0 per tool

Handshake

no reply

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @cachly-dev/mcp-server@0.10.231 as of 8d ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%

Unclaimed publisher≈ +8 on the totalClaim cachly-dev: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
Outbound HTTP to raw IP address≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.

Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim cachly-dev Propose a patch to the maintainer

Watch this skill

One email when mcp-server gets a new release, its verdict moves, or the maintainer changes. Free, no account needed.

Safer alternatives

Verified skills that do a similar job.

postman-mcp-server91 · Verified
postman · npm · 46,717 installs · agents, claude, code
node9-ai88 · Verified
node9-ai · npm · 13,008 installs · agents, every, claude
mcp91 · Verified
hypequery · npm · 37,661 installs · agents, claude, code

README badge

Shows the live score and label; updates itself as new versions are detonated. Paste into your README or registry listing:

[![KillerSkills verdict for mcp-server](https://killerskills.ai/badge/npm/mcp-server.svg)](https://killerskills.ai/skills/npm/mcp-server?ref=badge)

Version history

0.10.25067 · Caution

0.10.24267 · Caution

0.10.23567 · Caution

0.10.23170 · Caution

0.10.22970 · Caution

0.10.22170 · Caution

0.10.21970 · Caution

0.10.21870 · Caution

0.10.21570 · Caution

0.10.21470 · Caution

Stable for 2 days. Same maintainers since first release.

Declared permissions

networknone

filesystem./ (project)

memorynone

3 of 3 declarations honored in sandbox.

Block it everywhere

vet-skills block mcp-server
--org acme --reason "v_68f2"