Skills/npm/mcp-server

mcp-server@0.10.235

CAUTION· startup only

Publisher claims: "Memory for coding agents: your AI stores every fix and finds it again when the problem returns. MCP server for Claude Code, Cursor, Copilot, Windsurf, Codex and Gemini CLI, hosted in the EU." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher cachly-dev · publishing for 212 daysInstalls 17,091Last detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
second launch with the clock 45 days ahead · server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
CLAUDE_PLUGIN_OPTION_API_KEYCOHERE_API_KEYGEMINI_API_KEYMISTRAL_API_KEYOPENAI_API_KEYConfiguration, not credentials: AUS_PHRASE, CACHLY_ADMIN_KEY, CACHLY_API_TIMEOUT_MS, CACHLY_API_URL, CACHLY_AUTO_INDEX, CACHLY_BRAIN_INSTANCE_ID, CACHLY_CONFIDENCE_STALE_DAYS, CACHLY_CONFIDENCE_WARN_DAYS, CACHLY_EMBED_MODEL, CACHLY_EMBED_PROVIDER, CACHLY_EMBED_SCHREIB_PARALLEL, CACHLY_EMBED_TIMEOUT_MAX_MS, CACHLY_EMBED_TIMEOUT_MS, CACHLY_HOOK_EVENT, CACHLY_HOOK_FRIST_MS, CACHLY_JWT, CACHLY_LESER, CACHLY_LESER_ZEITLIMIT_MS, CACHLY_NO_TELEMETRY, CACHLY_PROVISION_TIMEOUT_MS, CLAUDE_PLUGIN_OPTION_INSTANCE_ID, CLAUDE_PLUGIN_ROOT, CLS_FILES, CLS_MSG, CLS_SHA, COPILOT_HOME, MCP_HTTP_PORT, OLLAMA_BASE_URL
Where it talks to
cachly.dev (its own)Also mistral.ai, cohere.com, google.com, twitter.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names mistral.ai, cohere.com, google.com, twitter.com as well as its own vendor. The guard injects CLAUDE_PLUGIN_OPTION_API_KEY, COHERE_API_KEY, GEMINI_API_KEY, MISTRAL_API_KEY, OPENAI_API_KEY only into requests to cachly.dev (and its subdomains) and refuses the rest.

$vet-skills run --secrets CLAUDE_PLUGIN_OPTION_API_KEY=cachly.dev,COHERE_API_KEY=cachly.dev,GEMINI_API_KEY=cachly.dev,MISTRAL_API_KEY=cachly.dev,OPENAI_API_KEY=cachly.dev -- npx -y @cachly-dev/mcp-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-09 and scored it 67/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Collapsed <details> block carrying instructions; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 35 s · 3 scenarios · 0 deviations
t+CategoryObserved action
15sprocessdependency install exit 0
35sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-bEqEL9/task/home/work/acme-api/.claude/skills/mcp-server/dist/src/werkzeug-nutzung.js' } Node.js v22.23.4
35sprocessscript backend runs setup only
35sprocesssecond launch, clock +45 days, CI unset

Static findings

HIGH
Collapsed <details> block carrying instructionsREADME.md:435 · Collapsed <details> block carrying instructions<summary><b>Claude Code</b> (<code>.mcp.json</code> in the project)</summary> ```json { "mcpServers": { "cachly": { "command": "npx", "args": ["-y", "@cachly-deFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsdist/src/credentials.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…);if(!o(n))return;const t=JSON.parse(a(n,"utf8"));return r(t.mcpServers?.cachly?.env?.CACHLY_JWT)}catch{return}}function g(e={}){const n=e.env??process.env;return r…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/src/einblendung.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…(r,".mcp.json");if(C(s))try{const i=JSON.parse(T(s,"utf8"))?.mcpServers?.cachly?.env??{};if(t.apiUrl=t.apiUrl||i.CACHLY_API_URL||"https://api.cachly.dev",t.jwt=t.jw…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/src/embeddings.js:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesSet OPENAI_API_KEY in your .env, or switch provider:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/src/neue-fassung.js:4 · npx invocation of non-well-known package — may execute untrusted code…2 Marketplaces \u2192 cachly \u2192 Update marketplace, then /reload-plugins.":"npx users: restart your editor. If your config pins a version, run `npx @cachly-dev/mcp-se…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/einblendung.js:1 · MCP server using network transport (SSE/HTTP) — data sent over network…;n<8;n++){const s=_(r,".mcp.json");if(C(s))try{const i=JSON.parse(T(s,"utf8"))?.mcpServers?.cachly?.env??{};if(t.apiUrl=t.apiUrl||i.CACHLY_API_URL||"https://api.cachly.dev",t.jwt=t.jwt||i.CACHLY_JWT||"",t.instanceId=t.instanceId||i.CACHLY_…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Unicode escape sequence detecteddist/src/search.js:1 · Unicode escape sequence detected — may contain obfuscated payloads…u0644\u0630\u064A","\u0627\u0644\u062A\u064A","\u0627\u0644\u0630\u064A\u0646","\u0627\u0644\u0644\u0648\u0627\u062A\u064A","\u0647\u0648","\u0647\u064A","\u0647\u0645","\u0647\u0646","\u0646\u062D\u064…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/handlers/team.js:44 · MCP server using network transport (SSE/HTTP) — data sent over network….google.com/app/apikey"}},r=e[a]??e.openai,l=!!o.vector_token,c=JSON.stringify({mcpServers:{cachly:{command:"npx",args:["-y","@cachly-dev/mcp-server@latest"],env:{CACHLY_JWT:"your-api-token-from-cachly.dev/settings",[r.key]:a==="ollama"?"h…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
URL with embedded credentialsdist/src/handlers/team.js:44 · URL with embedded credentials — may be phishing or credential leaking…erve (free, local, no key needed)"},gemini:{key:"GEMINI_API_KEY",hint:"Get at: https://aistudio.google.com/app/apikey"}},r=e[a]??e.openai,l=!!o.vector_token,c=JSON.stringify({mcpServers:{cachly:{command:"npx",args:["-y","@cachly-dev/mcp-se…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
File type combined with upload actiondist/src/index.js:2 · File type combined with upload action — agent may exfiltrate local data files…_MODEL??"",H=(()=>{try{const e=eo(import.meta.url);for(const t of["../../package.json","../package.json"])try{const s=e(t);if(s.name==="@cachly-dev/mcp-server"&&s.version)return s.version}catch{}}catch{}return"0.10.100"})(),so=Number(proce…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/src/index.js:145 · File type combined with upload action — agent may exfiltrate local data files…console.log(` This organisation has several Brains:`),S.forEach(($,R)=>console.log(` ${R+1}) ${$.name??$.id} (${$.id})`));const k=r({input:process.stdin,output:process.stdout}),I=await new Promise($=>{k.question(" Which one? [1] ",R=>{k.c…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/src/uebernahme.js:1 · npx invocation of non-well-known package — may execute untrusted code…t Brain was moved to your account, but the new key could not reach it yet. Run `npx @cachly-dev/mcp-server@latest status` in a minute to check."];return t.push(`Brain: ${e.instanceId}${e.accoun…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/uninstall.js:14 · npx invocation of non-well-known package — may execute untrusted code… turns recorded"),n(" To keep your lessons first, write them to disk:"),n(" npx @cachly-dev/mcp-server@latest export")}function X(t,e,n){n.ausgabe(""),n.ausgabe(t);for(const r of e)n.ausgab…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Unicode escape sequence detecteddist/src/tools.js:10 · Unicode escape sequence detected — may contain obfuscated payloads…o never recalled score low. Returns a ranked list with visual confidence bars: "\u2588\u2588\u2588\u2588\u2591\u2591\u2591\u2591 40%". Use this before a big refactor to know which lessons to trust and which t…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actiondist/src/tools.js:10 · File type combined with upload action — agent may exfiltrate local data files…is written into the project (the hook reads $CACHLY_JWT or ~/.cachly/credentials.json when it runs). Removes an older brain_watch block. Idempotent: running brain_watch twice installs the hook only once. The hook always exits 0 and runs as…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsdist/src/hook-zugang.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…odeium","windsurf","mcp_config.json")].map(e=>{const r=i(e)?.mcpServers?.cachly?.env;return r&&typeof r=="object"?r:{}})}function h(...o){for(const e of o){const r=…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/src/index.js:76 · npx invocation of non-well-known package — may execute untrusted code…}...\x1B[0m`),console.log(""),console.log(" \x1B[2m\u{1F4A1} Invite your team: npx @cachly-dev/mcp-server@latest invite <email>\x1B[0m"),console.log(" \x1B[2m Cron: 0 9 * * 1 npx @cachly-de…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/src/lernen.js:6 · File type combined with upload action — agent may exfiltrate local data files…earer ${e.jwt}`},signal:AbortSignal.timeout(n)});if(!o.ok)return;const a=await o.json();if(!Array.isArray(a?.arme))return;const r=a.arme.filter(i=>i&&Number.isInteger(i.arm)).map(i=>({arm:i.arm,erfolge:Number(i.erfolge)||0,misserfolge:Numb…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/src/index.js:25 · File type combined with upload action — agent may exfiltrate local data files…o.ok){if(o.status===401&&!s&&(Be=0,await Ne()))return L(e,t,!0);const c=(await o.json().catch(()=>({error:o.statusText}))).error??o.statusText;Ft(o.status,c)}if(o.status!==204)return o.json()}import{handleBrainTool as Po}from"./handlers/br…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/uninstall.js:14 · MCP server using network transport (SSE/HTTP) — data sent over network…et(o,r==="continue"?"continue":r==="zed"?"zed":o===".vscode/mcp.json"?"vscode":"mcpServers");for(const[r,o]of n){const i=k(t.projekt,r),a=y(i);if(A(`${i}.bak`)&&e.funde.push({stufe:"projekt",aktion:"melden",pfad:`${i}.bak`,was:"your old fi…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actiondist/src/cursor-hook.js:1 · File type combined with upload action — agent may exfiltrate local data files…function f(r,t=x){return i(t,`${l("sha256").update(r).digest("hex").slice(0,32)}.json`)}function v(r,t,o){if(!o){p(r,{force:!0});return}S(i(r,".."),{recursive:!0});const e={generation_id:t??null,kontext:o,at:Date.now()};b(r,JSON.stringify(…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsdist/src/tools.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…"string"},description:'Files involved in this lesson (e.g. ["infra/deploy.sh", ".env"])'},commands:{type:"array",items:{type:"string"},description:'Commands that wo…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/src/tuersteher.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…eichen",re:/[\u{E0000}-\u{E007F}\u{202A}-\u{202E}\u{2066}-\u{2069}]/u}],h="(?:\\.env\\b|\\benv\\b|\\bprintenv\\b|credentials|\\bsecrets?\\b|id_(?:rsa|ed25519|ecdsa|…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/src/handlers/team.js:44 · npx invocation of non-well-known package — may execute untrusted code…k.push("\u2139\uFE0F Hooks (session briefing, per-prompt recall) are set up by `npx @cachly-dev/mcp-server@latest init` or `autopilot`."),h.push(...k)}return h.join(` `)}case"team_assign_role":…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/index.js:68 · npx invocation of non-well-known package — may execute untrusted code…==="codex"?{befehl:`codex mcp add cachly ${s.map(n=>`--env ${n}`).join(" ")} -- npx -y @cachly-dev/mcp-server@latest`,wo:"~/.codex/config.toml"}:e==="gemini"?{befehl:…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/src/ambient-hooks.js:6 · File type combined with upload action — agent may exfiltrate local data files…p"),bundlePath:d,scripts:G,settings:P}}const F=".cursor/hooks",Tt=".cursor/hooks.json",X="cachly-ambient-cursor.mjs",Pt={sessionStart:30,beforeSubmitPrompt:10,postToolUse:5};function U(t,o,e,s){return["#!/usr/bin/env node",`// cachly Ambie…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/src/uninstall.js:15 · npx invocation of non-well-known package — may execute untrusted code…e.ausgabe('It is a test key. Without it you cannot reach the test Brain again. "npx @cachly-dev/mcp-server@latest claim" keeps it in your own account first.'),n.ja||await e.frage(` Remove these…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/src/index.js:70 · npx invocation of non-well-known package — may execute untrusted code\u26A0\uFE0F No cachly key or Brain instance found (environment or ~/.cachly/credentials.json).`),console.log(` Run: npx @cachly-dev/mcp-server@latest autopilotFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/index.js:199 · MCP server using network transport (SSE/HTTP) — data sent over network…d by a prior setup)")}}catch{}(!l||!u)&&(console.error(` Usage: npx @cachly-dev/mcp-server@latest init --instance-id <uuid> --api-key <cky_live_...> [--editor claude|cursor|windsurf|copilot|continue|cline|zed|codex|gemini] [--project-dir /…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/index.js:153 · MCP server using network transport (SSE/HTTP) — data sent over network…r updates... `);try{const e=await fetch("https://registry.npmjs.org/@cachly-dev/mcp-server/latest",{signal:AbortSignal.timeout(8e3)});if(!e.ok)throw new Error(`registry HTTP ${e.status}`);const s=(await e.json()).version;if(!s||!/^\d+\.\d+…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actiondist/src/uebernahme.js:1 · File type combined with upload action — agent may exfiltrate local data files…ok)throw new Error(`sign-in could not start (HTTP ${a.status})`);const n=await a.json();if(!n.device_code||!n.user_code)throw new Error("sign-in could not start (no device code)");return{deviceCode:n.device_code,userCode:n.user_code,adress…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/src/index.js:186 · File type combined with upload action — agent may exfiltrate local data files…er ${e}`},signal:AbortSignal.timeout(8e3)});let c=0,r=0;if(i.ok){const b=await i.json();c=b.lesson_count??0,r=b.total_recall_count??0}const d=await fetch(`${_}/api/v1/brains/share`,{method:"POST",headers:{Authorization:`Bearer ${e}`,"Conte…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/hook-zugang.js:1 · MCP server using network transport (SSE/HTTP) — data sent over network…json"),n(o.heim,".codeium","windsurf","mcp_config.json")].map(e=>{const r=i(e)?.mcpServers?.cachly?.env;return r&&typeof r=="object"?r:{}})}function h(...o){for(const e of o){const r=a(e);if(r)return r}return""}function g(o){return h(o.env…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
npx invocation of non-well-known packagedist/src/doctor.js:1 · npx invocation of non-well-known package — may execute untrusted code…eturn{name:"Credential",status:"fail",detail:"CACHLY_JWT is not set",hint:"Run `npx @cachly-dev/mcp-server@latest autopilot` (browser sign-in) or export CACHLY_JWT=<cky_\u2026>."};const t=e.sta…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commanddist/src/ambient-hooks.js:1 · File permission modification command — agent changes file ownership/permissions…tsSync as w,readFileSync as j}from"node:fs";import{readFile as v,writeFile as E,chmod as M,mkdir as N}from"node:fs/promises";import{dirname as K,resolve as l}from"nod…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actiondist/src/index.js:115 · File type combined with upload action — agent may exfiltrate local data files`),console.log(" The token is in the invitation email. A teammate sends one with:"),console.log(` npx @cachly-dev/mcp-server@latest invite <email>Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/src/index.js:32 · npx invocation of non-well-known package — may execute untrusted code…Setup required**","","Run the setup wizard once in your terminal:"," ```"," npx @cachly-dev/mcp-server@latest autopilot"," ```","",`Or get your API key at: ${j("/setup-ai","ambient-signin…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/doctor.js:1 · MCP server using network transport (SSE/HTTP) — data sent over network…ential",status:"fail",detail:"CACHLY_JWT is not set",hint:"Run `npx @cachly-dev/mcp-server@latest autopilot` (browser sign-in) or export CACHLY_JWT=<cky_\u2026>."};const t=e.startsWith("cky_"),n=e.split(".").length===3;return!t&&!n?{name:"…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actiondist/src/uninstall.js:14 · File type combined with upload action — agent may exfiltrate local data files…t.entries(re))n.set(o,r==="continue"?"continue":r==="zed"?"zed":o===".vscode/mcp.json"?"vscode":"mcpServers");for(const[r,o]of n){const i=k(t.projekt,r),a=y(i);if(A(`${i}.bak`)&&e.funde.push({stufe:"projekt",aktion:"melden",pfad:`${i}.bak`…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/src/ambient-hooks.js:9 · File type combined with upload action — agent may exfiltrate local data files…tei:Tt,merge:e=>xt(e)})}const W=".github/hooks",Nt=".github/hooks/cachly-ambient.json",Q="cachly-ambient-copilot.mjs",Ct={sessionStart:30,userPromptSubmitted:10,postToolUse:5};function Ut(t){return U("VS Code / Copilot",st,it,t)}function A…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commanddist/src/handlers/team.js:39 · Process kill command — agent can terminate processes…:"k8s:pdb",lesson:"Set PodDisruptionBudget for stateful apps \u2014 node drains kill all pods without it",severity:"major"}],react:[{topic:"react:useeffect-deps",les…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/index.js:68 · MCP server using network transport (SSE/HTTP) — data sent over network…`codex mcp add cachly ${s.map(n=>`--env ${n}`).join(" ")} -- npx -y @cachly-dev/mcp-server@latest`,wo:"~/.codex/config.toml"}:e==="gemini"?{befehl:`gemini mcp add -s project ${s.map(n=>`-e ${n}`).join(" ")} cachly npx -- -y @cachly-dev/mcp…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/index.js:2 · MCP server using network transport (SSE/HTTP) — data sent over network…./../package.json","../package.json"])try{const s=e(t);if(s.name==="@cachly-dev/mcp-server"&&s.version)return s.version}catch{}}catch{}return"0.10.100"})(),so=Number(process.env.CACHLY_PROVISION_TIMEOUT_MS??9e4);let N=$e(process.env.CACHLY…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathsdist/src/index.js:69 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…ngify(r,null,2)}if(n==="zed"){const u=r.context_servers??{},w=u.cachly?.command?.env?.CACHLY_JWT;return w&&he(w,i),u.cachly={command:{path:"npx",args:["-y","@cachly…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/src/index.js:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…f(n(r))try{const d=await s(r,"utf-8"),f=JSON.parse(d),l=f?.mcpServers?.cachly;l?.env&&(l.env.CACHLY_JWT=e,await t(r,JSON.stringify(f,null,2),"utf-8"))}catch{}}))}ca…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiondist/src/tools.js:1 · File type combined with upload action — agent may exfiltrate local data files…ype:"string",description:"Absolute path to workspace root \u2014 enables package.json analysis for openclaw cross-promo (optional)"}},required:[]}},{name:"brain_hygiene",description:"Autonomously sweep and maintain your Brain \u2014 flags …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File permission modification commanddist/src/cls-hook.js:1 · File permission modification command — agent changes file ownership/permissions…existsSync as f,statSync as h}from"node:fs";import{readFile as _,writeFile as p,chmod as u,mkdir as C}from"node:fs/promises";import{basename as l,dirname as d,resolve…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Unicode escape sequence detecteddist/src/handlers/team.js:44 · Unicode escape sequence detected — may contain obfuscated payloads…vector token \u2014 rotate it in the dashboard (every tier includes one)"}`,"","\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actiondist/src/embeddings.js:7 · File type combined with upload action — agent may exfiltrate local data files…c.status}: ${h.slice(0,200)}`),{status:c.status,retryAfterSek:m})}return(await c.json()).embedding}case"mistral":{const n=process.env.MISTRAL_API_KEY;if(!n)throw new Error("MISTRAL_API_KEY not set");const s=a.model!=="text-embedding-3-smal…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Auto-update or dynamic fetch configurationdist/src/neue-fassung.js:4 · Auto-update or dynamic fetch configuration — agent may load new code at runtime…E0F **cachly:** version ${e} is available (${s}). ${n?"Claude Code keeps plugin auto-update off for this marketplace. Turn it on once: /plugin \u2192 Marketplaces \u2192 cachly \u2192 Enable auto-update. Or update now: /plugin \u2192 Marke…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Unicode escape sequence detecteddist/src/index.js:74 · Unicode escape sequence detected — may contain obfuscated payloads…=m=>m.toLocaleDateString("en-US",{month:"short",day:"numeric"});if(console.log("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
npx invocation of non-well-known packagedist/src/zugang.js:1 · npx invocation of non-well-known package — may execute untrusted code…9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function s(e){return l.test(c(e))}const a="npx @cachly-dev/mcp-server@latest claim";function u(e){return["","","---",`\u2139\uFE0F **cachly:** no API key wa…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/postinstall.js:22 · npx invocation of non-well-known package — may execute untrusted code${c.cyan}npx @cachly-dev/mcp-server@latest autopilot${c.reset}Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈87 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @cachly-dev/mcp-server@0.10.235 as of 5d ago. This is the package itself, not its dependencies.

What would make this Verified

13 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim cachly-dev: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  6. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim cachly-devPropose a patch to the maintainer