mcp-server@0.10.242
CAUTION· startup onlyPublisher claims: "Memory for coding agents: your AI stores every fix and finds it again when the problem returns. MCP server for Claude Code, Cursor, Copilot, Windsurf, Codex and Gemini CLI, hosted in the EU." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher cachly-dev · publishing for 212 daysInstalls 17,091Last detonated 3d ago
Coverage
Startup only; authenticated tool behavior not tested.- Tested
- second launch with the clock 45 days ahead · server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
- Not tested
- the tool list (the server exited before answering) · what the tools do when called with real credentials
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
CLAUDE_PLUGIN_OPTION_API_KEYCOHERE_API_KEYGEMINI_API_KEYMISTRAL_API_KEYOPENAI_API_KEYConfiguration, not credentials: AUS_PHRASE, CACHLY_ADMIN_KEY, CACHLY_API_TIMEOUT_MS, CACHLY_API_URL, CACHLY_AUTO_INDEX, CACHLY_BRAIN_INSTANCE_ID, CACHLY_CONFIDENCE_STALE_DAYS, CACHLY_CONFIDENCE_WARN_DAYS, CACHLY_EMBED_MODEL, CACHLY_EMBED_PROVIDER, CACHLY_EMBED_SCHREIB_PARALLEL, CACHLY_EMBED_TIMEOUT_MAX_MS, CACHLY_EMBED_TIMEOUT_MS, CACHLY_HOOK_EVENT, CACHLY_HOOK_FRIST_MS, CACHLY_JWT, CACHLY_LESER, CACHLY_LESER_ZEITLIMIT_MS, CACHLY_NO_TELEMETRY, CACHLY_PROVISION_TIMEOUT_MS, CACHLY_RECALL_NUR_LESEN, CLAUDE_PLUGIN_OPTION_INSTANCE_ID, CLAUDE_PLUGIN_ROOT, CLS_FILES, CLS_MSG, CLS_SHA, COPILOT_HOME, MCP_HTTP_PORT, OLLAMA_BASE_URL- Where it talks to
- cachly.dev (its own)Also mistral.ai, cohere.com, google.com, twitter.com — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- the tool list (the server exited before answering) · what the tools do when called with real credentials
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names mistral.ai, cohere.com, google.com, twitter.com as well as its own vendor. The guard injects CLAUDE_PLUGIN_OPTION_API_KEY, COHERE_API_KEY, GEMINI_API_KEY, MISTRAL_API_KEY, OPENAI_API_KEY only into requests to cachly.dev (and its subdomains) and refuses the rest.
$vet-skills run --secrets CLAUDE_PLUGIN_OPTION_API_KEY=cachly.dev,COHERE_API_KEY=cachly.dev,GEMINI_API_KEY=cachly.dev,MISTRAL_API_KEY=cachly.dev,OPENAI_API_KEY=cachly.dev -- npx -y @cachly-dev/mcp-server
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-11 and scored it 67/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: URL with embedded credentials; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 32 s · 3 scenarios · 0 deviationst+CategoryObserved action
12sprocessdependency install exit 0
32sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-95lsc9/task/home/work/acme-api/.claude/skills/mcp-server/dist/src/werkzeug-nutzung.js' } Node.js v22.23.4
32sprocessscript backend runs setup only
32sprocesssecond launch, clock +45 days, CI unset
Static findings
HIGH
URL with embedded credentialsdist/src/handlers/team.js:44 · URL with embedded credentials — may be phishing or credential leaking
AST07…erve (free, local, no key needed)"},gemini:{key:"GEMINI_API_KEY",hint:"Get at: https://aistudio.google.com/app/apikey"}},r=e[a]??e.openai,l=!!o.vector_token,c=JSON.stringify({mcpServers:{cachly:{command:"npx",args:["-y","@cachly-dev/mcp-se…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/src/hook-zugang.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…odeium","windsurf","mcp_config.json")].map(e=>{const r=i(e)?.mcpServers?.cachly?.env;return r&&typeof r=="object"?r:{}})}function h(...o){for(const e of o){const r=…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actiondist/src/ambient-hooks.js:6 · File type combined with upload action — agent may exfiltrate local data files
AST07…p"),bundlePath:d,scripts:G,settings:P}}const F=".cursor/hooks",Tt=".cursor/hooks.json",X="cachly-ambient-cursor.mjs",Pt={sessionStart:30,beforeSubmitPrompt:10,postToolUse:5};function U(t,o,e,s){return["#!/usr/bin/env node",`// cachly Ambie…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Access to sensitive file pathsdist/src/tools.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…"string"},description:'Files involved in this lesson (e.g. ["infra/deploy.sh", ".env"])'},commands:{type:"array",items:{type:"string"},description:'Commands that wo…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/src/embeddings.js:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05Set OPENAI_API_KEY in your .env, or switch provider:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/src/tuersteher.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…eichen",re:/[\u{E0000}-\u{E007F}\u{202A}-\u{202E}\u{2066}-\u{2069}]/u}],h="(?:\\.env\\b|\\benv\\b|\\bprintenv\\b|credentials|\\bsecrets?\\b|id_(?:rsa|ed25519|ecdsa|…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Collapsed <details> block carrying instructionsREADME.md:440 · Collapsed <details> block carrying instructions
AST01<summary><b>Claude Code</b> (<code>.mcp.json</code> in the project)</summary> ```json { "mcpServers": { "cachly": { "command": "npx", "args": ["-y", "@cachly-deFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
File permission modification commanddist/src/ambient-hooks.js:1 · File permission modification command — agent changes file ownership/permissions
AST05…tsSync as w,readFileSync as j}from"node:fs";import{readFile as v,writeFile as E,chmod as M,mkdir as N}from"node:fs/promises";import{dirname as K,resolve as l}from"nod…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File type combined with upload actiondist/src/ambient-hooks.js:9 · File type combined with upload action — agent may exfiltrate local data files
AST07…tei:Tt,merge:e=>xt(e)})}const W=".github/hooks",Nt=".github/hooks/cachly-ambient.json",Q="cachly-ambient-copilot.mjs",Ct={sessionStart:30,userPromptSubmitted:10,postToolUse:5};function Ut(t){return U("VS Code / Copilot",st,it,t)}function A…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Auto-update or dynamic fetch configurationdist/src/neue-fassung.js:4 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06…E0F **cachly:** version ${e} is available (${s}). ${n?"Claude Code keeps plugin auto-update off for this marketplace. Turn it on once: /plugin \u2192 Marketplaces \u2192 cachly \u2192 Enable auto-update. Or update now: /plugin \u2192 Marke…Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathsdist/src/einblendung.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…(r,".mcp.json");if(C(s))try{const i=JSON.parse(T(s,"utf8"))?.mcpServers?.cachly?.env??{};if(t.apiUrl=t.apiUrl||i.CACHLY_API_URL||"https://api.cachly.dev",t.jwt=t.jw…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File permission modification commanddist/src/cls-hook.js:1 · File permission modification command — agent changes file ownership/permissions
AST05…existsSync as f,statSync as h}from"node:fs";import{readFile as _,writeFile as p,chmod as u,mkdir as C}from"node:fs/promises";import{basename as l,dirname as d,resolve…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Access to sensitive file pathsdist/src/index.js:69 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…ngify(r,null,2)}if(n==="zed"){const u=r.context_servers??{},v=u.cachly?.command?.env?.CACHLY_JWT;return v&&he(v,i),u.cachly={command:{path:"npx",args:["-y","@cachly…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/src/index.js:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…f(n(r))try{const d=await s(r,"utf-8"),f=JSON.parse(d),l=f?.mcpServers?.cachly;l?.env&&(l.env.CACHLY_JWT=e,await t(r,JSON.stringify(f,null,2),"utf-8"))}catch{}}))}ca…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/src/credentials.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…);if(!o(n))return;const t=JSON.parse(a(n,"utf8"));return r(t.mcpServers?.cachly?.env?.CACHLY_JWT)}catch{return}}function g(e={}){const n=e.env??process.env;return r…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagedist/src/doctor.js:1 · npx invocation of non-well-known package — may execute untrusted code
AST06…eturn{name:"Credential",status:"fail",detail:"CACHLY_JWT is not set",hint:"Run `npx @cachly-dev/mcp-server@latest autopilot` (browser sign-in) or export CACHLY_JWT=<cky_\u2026>."};const t=e.sta…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/src/index.js:32 · npx invocation of non-well-known package — may execute untrusted code
AST06…Setup required**","","Run the setup wizard once in your terminal:"," ```"," npx @cachly-dev/mcp-server@latest autopilot"," ```","",`Or get your API key at: ${j("/setup-ai","ambient-signin…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/src/index.js:68 · npx invocation of non-well-known package — may execute untrusted code
AST06…==="codex"?{befehl:`codex mcp add cachly ${s.map(n=>`--env ${n}`).join(" ")} -- npx -y @cachly-dev/mcp-server@latest`,wo:"~/.codex/config.toml"}:e==="gemini"?{befehl:…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Unicode escape sequence detecteddist/src/search.js:1 · Unicode escape sequence detected — may contain obfuscated payloads
AST07…u0644\u0630\u064A","\u0627\u0644\u062A\u064A","\u0627\u0644\u0630\u064A\u0646","\u0627\u0644\u0644\u0648\u0627\u062A\u064A","\u0647\u0648","\u0647\u064A","\u0647\u0645","\u0647\u0646","\u0646\u062D\u064…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
File type combined with upload actiondist/src/lernen.js:6 · File type combined with upload action — agent may exfiltrate local data files
AST07…earer ${e.jwt}`},signal:AbortSignal.timeout(n)});if(!o.ok)return;const a=await o.json();if(!Array.isArray(a?.arme))return;const r=a.arme.filter(i=>i&&Number.isInteger(i.arm)).map(i=>({arm:i.arm,erfolge:Number(i.erfolge)||0,misserfolge:Numb…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/src/index.js:145 · File type combined with upload action — agent may exfiltrate local data files
AST07…console.log(` This organisation has several Brains:`),k.forEach((_,R)=>console.log(` ${R+1}) ${_.name??_.id} (${_.id})`));const $=r({input:process.stdin,output:process.stdout}),I=await new Promise(_=>{$.question(" Which one? [1] ",R=>{$.c…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/src/tools.js:1 · File type combined with upload action — agent may exfiltrate local data files
AST07…ype:"string",description:"Absolute path to workspace root \u2014 enables package.json analysis for openclaw cross-promo (optional)"}},required:[]}},{name:"brain_hygiene",description:"Autonomously sweep and maintain your Brain \u2014 flags …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Unicode escape sequence detecteddist/src/tools.js:10 · Unicode escape sequence detected — may contain obfuscated payloads
AST07…o never recalled score low. Returns a ranked list with visual confidence bars: "\u2588\u2588\u2588\u2588\u2591\u2591\u2591\u2591 40%". Use this before a big refactor to know which lessons to trust and which t…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
File type combined with upload actiondist/src/embeddings.js:7 · File type combined with upload action — agent may exfiltrate local data files
AST07…c.status}: ${h.slice(0,200)}`),{status:c.status,retryAfterSek:m})}return(await c.json()).embedding}case"mistral":{const n=process.env.MISTRAL_API_KEY;if(!n)throw new Error("MISTRAL_API_KEY not set");const s=a.model!=="text-embedding-3-smal…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/src/tools.js:10 · File type combined with upload action — agent may exfiltrate local data files
AST07…is written into the project (the hook reads $CACHLY_JWT or ~/.cachly/credentials.json when it runs). Removes an older brain_watch block. Idempotent: running brain_watch twice installs the hook only once. The hook always exits 0 and runs as…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Unicode escape sequence detecteddist/src/handlers/team.js:44 · Unicode escape sequence detected — may contain obfuscated payloads
AST07…vector token \u2014 rotate it in the dashboard (every tier includes one)"}`,"","\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
File type combined with upload actiondist/src/uninstall.js:14 · File type combined with upload action — agent may exfiltrate local data files
AST07…t.entries(re))n.set(o,r==="continue"?"continue":r==="zed"?"zed":o===".vscode/mcp.json"?"vscode":"mcpServers");for(const[r,o]of n){const i=k(t.projekt,r),a=y(i);if(A(`${i}.bak`)&&e.funde.push({stufe:"projekt",aktion:"melden",pfad:`${i}.bak`…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/src/index.js:186 · File type combined with upload action — agent may exfiltrate local data files
AST07…er ${e}`},signal:AbortSignal.timeout(8e3)});let c=0,r=0;if(i.ok){const b=await i.json();c=b.lesson_count??0,r=b.total_recall_count??0}const d=await fetch(`${x}/api/v1/brains/share`,{method:"POST",headers:{Authorization:`Bearer ${e}`,"Conte…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagedist/src/uninstall.js:14 · npx invocation of non-well-known package — may execute untrusted code
AST06… turns recorded"),n(" To keep your lessons first, write them to disk:"),n(" npx @cachly-dev/mcp-server@latest export")}function X(t,e,n){n.ausgabe(""),n.ausgabe(t);for(const r of e)n.ausgab…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/einblendung.js:1 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04…;n<8;n++){const s=_(r,".mcp.json");if(C(s))try{const i=JSON.parse(T(s,"utf8"))?.mcpServers?.cachly?.env??{};if(t.apiUrl=t.apiUrl||i.CACHLY_API_URL||"https://api.cachly.dev",t.jwt=t.jwt||i.CACHLY_JWT||"",t.instanceId=t.instanceId||i.CACHLY_…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/index.js:199 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04…d by a prior setup)")}}catch{}(!l||!u)&&(console.error(` Usage: npx @cachly-dev/mcp-server@latest init --instance-id <uuid> --api-key <cky_live_...> [--editor claude|cursor|windsurf|copilot|continue|cline|zed|codex|gemini] [--project-dir /…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
File type combined with upload actiondist/src/index.js:25 · File type combined with upload action — agent may exfiltrate local data files
AST07…o.ok){if(o.status===401&&!s&&(Be=0,await Ne()))return L(e,t,!0);const c=(await o.json().catch(()=>({error:o.statusText}))).error??o.statusText;Ft(o.status,c)}if(o.status!==204)return o.json()}import{handleBrainTool as Po}from"./handlers/br…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/uninstall.js:14 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04…et(o,r==="continue"?"continue":r==="zed"?"zed":o===".vscode/mcp.json"?"vscode":"mcpServers");for(const[r,o]of n){const i=k(t.projekt,r),a=y(i);if(A(`${i}.bak`)&&e.funde.push({stufe:"projekt",aktion:"melden",pfad:`${i}.bak`,was:"your old fi…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/index.js:2 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04…./../package.json","../package.json"])try{const s=e(t);if(s.name==="@cachly-dev/mcp-server"&&s.version)return s.version}catch{}}catch{}return"0.10.100"})(),so=Number(process.env.CACHLY_PROVISION_TIMEOUT_MS??9e4);let N=$e(process.env.CACHLY…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/index.js:153 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04…r updates... `);try{const e=await fetch("https://registry.npmjs.org/@cachly-dev/mcp-server/latest",{signal:AbortSignal.timeout(8e3)});if(!e.ok)throw new Error(`registry HTTP ${e.status}`);const s=(await e.json()).version;if(!s||!/^\d+\.\d+…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
npx invocation of non-well-known packagedist/src/index.js:70 · npx invocation of non-well-known package — may execute untrusted code
AST06\u26A0\uFE0F No cachly key or Brain instance found (environment or ~/.cachly/credentials.json).`),console.log(` Run: npx @cachly-dev/mcp-server@latest autopilotFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/src/neue-fassung.js:4 · npx invocation of non-well-known package — may execute untrusted code
AST06…2 Marketplaces \u2192 cachly \u2192 Update marketplace, then /reload-plugins.":"npx users: restart your editor. If your config pins a version, run `npx @cachly-dev/mcp-se…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Unicode escape sequence detecteddist/src/index.js:74 · Unicode escape sequence detected — may contain obfuscated payloads
AST07…=p=>p.toLocaleDateString("en-US",{month:"short",day:"numeric"});if(console.log("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/index.js:68 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04…`codex mcp add cachly ${s.map(n=>`--env ${n}`).join(" ")} -- npx -y @cachly-dev/mcp-server@latest`,wo:"~/.codex/config.toml"}:e==="gemini"?{befehl:`gemini mcp add -s project ${s.map(n=>`-e ${n}`).join(" ")} cachly npx -- -y @cachly-dev/mcp…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
npx invocation of non-well-known packagedist/src/uninstall.js:15 · npx invocation of non-well-known package — may execute untrusted code
AST06…e.ausgabe('It is a test key. Without it you cannot reach the test Brain again. "npx @cachly-dev/mcp-server@latest claim" keeps it in your own account first.'),n.ja||await e.frage(` Remove these…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actiondist/src/cursor-hook.js:1 · File type combined with upload action — agent may exfiltrate local data files
AST07…function f(r,t=x){return i(t,`${l("sha256").update(r).digest("hex").slice(0,32)}.json`)}function v(r,t,o){if(!o){p(r,{force:!0});return}S(i(r,".."),{recursive:!0});const e={generation_id:t??null,kontext:o,at:Date.now()};b(r,JSON.stringify(…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/hook-zugang.js:1 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04…json"),n(o.heim,".codeium","windsurf","mcp_config.json")].map(e=>{const r=i(e)?.mcpServers?.cachly?.env;return r&&typeof r=="object"?r:{}})}function h(...o){for(const e of o){const r=u(e);if(r)return r}return""}function v(o){return h(o.env…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
Process kill commanddist/src/handlers/team.js:39 · Process kill command — agent can terminate processes
AST05…:"k8s:pdb",lesson:"Set PodDisruptionBudget for stateful apps \u2014 node drains kill all pods without it",severity:"major"}],react:[{topic:"react:useeffect-deps",les…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/doctor.js:1 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04…ential",status:"fail",detail:"CACHLY_JWT is not set",hint:"Run `npx @cachly-dev/mcp-server@latest autopilot` (browser sign-in) or export CACHLY_JWT=<cky_\u2026>."};const t=e.startsWith("cky_"),n=e.split(".").length===3;return!t&&!n?{name:"…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
npx invocation of non-well-known packagedist/src/handlers/team.js:44 · npx invocation of non-well-known package — may execute untrusted code
AST06…L.push("\u2139\uFE0F Hooks (session briefing, per-prompt recall) are set up by `npx @cachly-dev/mcp-server@latest init` or `autopilot`."),h.push(...L)}return h.join(` `)}case"team_assign_role":…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/src/uebernahme.js:1 · npx invocation of non-well-known package — may execute untrusted code
AST06…t Brain was moved to your account, but the new key could not reach it yet. Run `npx @cachly-dev/mcp-server@latest status` in a minute to check."];return t.push(`Brain: ${e.instanceId}${e.accoun…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actiondist/src/index.js:2 · File type combined with upload action — agent may exfiltrate local data files
AST07…_MODEL??"",H=(()=>{try{const e=eo(import.meta.url);for(const t of["../../package.json","../package.json"])try{const s=e(t);if(s.name==="@cachly-dev/mcp-server"&&s.version)return s.version}catch{}}catch{}return"0.10.100"})(),so=Number(proce…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/src/uebernahme.js:1 · File type combined with upload action — agent may exfiltrate local data files
AST07…ok)throw new Error(`sign-in could not start (HTTP ${a.status})`);const n=await a.json();if(!n.device_code||!n.user_code)throw new Error("sign-in could not start (no device code)");return{deviceCode:n.device_code,userCode:n.user_code,adress…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/handlers/team.js:44 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04….google.com/app/apikey"}},r=e[a]??e.openai,l=!!o.vector_token,c=JSON.stringify({mcpServers:{cachly:{command:"npx",args:["-y","@cachly-dev/mcp-server@latest"],env:{CACHLY_JWT:"your-api-token-from-cachly.dev/settings",[r.key]:a==="ollama"?"h…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
File type combined with upload actiondist/src/index.js:115 · File type combined with upload action — agent may exfiltrate local data files
AST07`),console.log(" The token is in the invitation email. A teammate sends one with:"),console.log(` npx @cachly-dev/mcp-server@latest invite <email>Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagedist/src/index.js:76 · npx invocation of non-well-known package — may execute untrusted code
AST06…}...\x1B[0m`),console.log(""),console.log(" \x1B[2m\u{1F4A1} Invite your team: npx @cachly-dev/mcp-server@latest invite <email>\x1B[0m"),console.log(" \x1B[2m Cron: 0 9 * * 1 npx @cachly-de…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/src/zugang.js:1 · npx invocation of non-well-known package — may execute untrusted code
AST06…9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function s(e){return l.test(c(e))}const a="npx @cachly-dev/mcp-server@latest claim";function u(e){return["","","---",`\u2139\uFE0F **cachly:** no API key wa…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagescripts/postinstall.js:22 · npx invocation of non-well-known package — may execute untrusted code
AST06${c.cyan}npx @cachly-dev/mcp-server@latest autopilot${c.reset}Fix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Instructions loaded
≈87 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for @cachly-dev/mcp-server@0.10.242 as of 3d ago. This is the package itself, not its dependencies.
What would make this Verified
13 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim cachly-dev: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
- URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
- File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim cachly-devPropose a patch to the maintainer