Skills/npm/mcp-server

mcp-server@0.143.0

VERIFIED· startup only

Publisher claims: "MCP server for Cmssy - hosted headless CMS with native commerce, run by your AI agent" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher cmssy · publishing for 254 daysInstalls 13,470Last detonated 3d ago
$claude mcp add mcp-server -- npx -y @cmssy/mcp-server
WatchReport an issue

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials
Needs
CMSSY_API_TOKEN — give it to the server where it runs, through vet-skills run --secrets, so the value never enters the server's environment. Never paste a credential into a chat, a ticket or a report.

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
CMSSY_API_TOKENCMSSY_DRAFT_SECRETCMSSY_WEBHOOK_SECRETConfiguration, not credentials: CMSSY_API_URL, CMSSY_ORG_SLUG, CMSSY_WORKSPACE_ID, CMSSY_WORKSPACE_SLUG
Where it talks to
cmssy.io (its own)
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard. It asks for CMSSY_API_TOKEN, CMSSY_DRAFT_SECRET, CMSSY_WEBHOOK_SECRET and talks to cmssy.io. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --secrets CMSSY_API_TOKEN=cmssy.io,CMSSY_DRAFT_SECRET=cmssy.io,CMSSY_WEBHOOK_SECRET=cmssy.io -- npx -y @cmssy/mcp-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-11 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed (it asks for CMSSY_API_TOKEN); the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 50 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
10sprocessdependency install exit 0
30sprocessrelaunched with a decoy CMSSY_API_TOKEN (tagged; nothing real)
50sclaimedstartup only: exited before answering, asking for CMSSY_API_TOKEN (a decoy value was refused)
50sprocessscript backend runs setup only
50sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsdist/init-assets.generated.js:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"path": ".env.example",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
URL to the cloud instance metadata addressdist/__tests__/hosted-server.test.js:115 · URL to the cloud instance metadata address — reads the VM's credentialsexpect(fetchUrl).toHaveBeenCalledWith("http://169.254.169.254/x");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Access to sensitive file pathsdist/init-assets.generated.js:5 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…"content": "# `npx @cmssy/cli@latest link --token cs_...` writes all three into .env.local for you.\n# Your organization slug (Settings -> Headless in the cmssy das…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
URL to the cloud instance metadata addressdist/__tests__/hosted-server.test.js:112 · URL to the cloud instance metadata address — reads the VM's credentialsarguments: { workspace: "acme/shop", url: "http://169.254.169.254/x" },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Access to sensitive file pathsdist/__tests__/site-setup.test.js:77 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filespath: rel === "env.example" ? ".env.example" : rel,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/init-assets.generated.js:5 · npx invocation of non-well-known package — may execute untrusted code…EXT_INIT_FILES = [ { "path": ".env.example", "content": "# `npx @cmssy/cli@latest link --token cs_...` writes all three into .env.local for you.\n# Your organiza…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
URL to a private-network addressdist/__tests__/media-upload.test.js:110 · URL to a private-network address — a LAN or development targetexpect(fetchUrl).toHaveBeenCalledWith("http://10.0.0.1/a.png");Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Access to sensitive file pathsdist/__tests__/hosted-server.test.js:107 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesarguments: { workspace: "acme/shop", filePath: "/etc/passwd" },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
URL to a private-network addressdist/__tests__/media-upload.test.js:109 · URL to a private-network address — a LAN or development targetawait expect(resolveUploadSource({ url: "http://10.0.0.1/a.png" }, { allowFilePath: false, fetchUrl })).rejects.toThrow("blocked by host");Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07

Cost to the agent

Instructions loaded
≈59 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @cmssy/mcp-server@0.143.0 as of 3d ago. This is the package itself, not its dependencies.