mcp-server@0.2.76
CAUTION· install onlyPublisher claims: "Bridge API MCP server — exposes Jira endpoints as MCP tools for Claude Code agents" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher bridge_gpt · publishing for 231 daysInstalls 1,486Last detonated 22 h ago
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
BAPI_API_KEYCLAIM_TOKENEXECUTOR_UNIT_CREDENTIAL_DIAGNOSTIC_NAMEINSTALL_BRIDGE_EMAIL_OR_TOKEN_PROMPTMAX_MCP_OUTPUT_TOKENSMERGE_WORKFLOW_API_KEY_SECRET_NAMEREDACTED_API_KEYUSER_ACCESS_KEY_ENCODED_LENGTHor--remove-merge-token/--scrub-inherited-github-credentialsConfiguration, not credentials: ACTION_FETCHED, ACTION_ID, ACTION_KEY, BAPI_BASE_URL, BAPI_CORRECTION_INTENT_VERSION, BAPI_DOCS_DIR, BAPI_EPIC_LAUNCH_PROFILE, BAPI_INSTALL_DEBUG, BAPI_INVITE, BAPI_MCP_HOST_FAMILY, BAPI_MCP_TOOL_SURFACE_GATING_ENABLED, BAPI_PIPELINES_DIR, BAPI_PROJECT_ROOT, BAPI_REPO_NAME, BAPI_SIGNUP_EMAIL, BRIDGE_MCP_PROFILE, BRIDGE_PERMISSIONS_MANIFEST_RELPATH, BRIDGE_SKIP_PREPUSH, CLAUDE_PROJECT_DIR, CODEX_HOME, CURSOR_TRACE_DIR, DYNO, EPIC_IMPLEMENTER_NODE_PATH, EPIC_KEY, EXPECTED_HEAD_SHA, LEASE_OWNER, MERGE_SHA, MSYSTEM, OPERATION, OUTCOME, PLANE_RUNTIME_LOG_PATH, PLATFORM_PATH_DELIMITER- Where it talks to
- bridgegpt-api.com, bridgegpt.ai (its own)Also cursor.com, x.com, deny-all.invalid — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- use of the skill by an agent
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names cursor.com, x.com, deny-all.invalid as well as its own vendor. The guard injects BAPI_API_KEY, CLAIM_TOKEN, EXECUTOR_UNIT_CREDENTIAL_DIAGNOSTIC_NAME, INSTALL_BRIDGE_EMAIL_OR_TOKEN_PROMPT, MAX_MCP_OUTPUT_TOKENS, MERGE_WORKFLOW_API_KEY_SECRET_NAME, REDACTED_API_KEY, USER_ACCESS_KEY_ENCODED_LENGTH only into requests to bridgegpt-api.com (and its subdomains) and refuses the rest.
$vet-skills run --secrets BAPI_API_KEY=bridgegpt-api.com,CLAIM_TOKEN=bridgegpt-api.com,EXECUTOR_UNIT_CREDENTIAL_DIAGNOSTIC_NAME=bridgegpt-api.com,INSTALL_BRIDGE_EMAIL_OR_TOKEN_PROMPT=bridgegpt-api.com,MAX_MCP_OUTPUT_TOKENS=bridgegpt-api.com,MERGE_WORKFLOW_API_KEY_SECRET_NAME=bridgegpt-api.com,REDACTED_API_KEY=bridgegpt-api.com,USER_ACCESS_KEY_ENCODED_LENGTH=bridgegpt-api.com -- npx -y @bridge_gpt/mcp-server
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-13 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Destructive command against a filesystem root or device. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
HIGH
Access to sensitive file pathsbuild/env-file-link.js:6 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* `copy-ignored` step had placed a COPY of the operator's `.env` inside theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbuild/install-bridge.js:3581 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const existingRoot = asRecord(asRecord(topLevel[registrationKey])?.env)?.BAPI_PROJECT_ROOT;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.CRITICAL
Destructive command against a filesystem root or devicebuild/merge-workflow.js:695 · Destructive command against a filesystem root or device
AST05" trap 'rm -f \"$curlrc\" \"$reqbody\" \"$respbody\"' EXIT",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsbuild/doctor.js:2056 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const versionEnv = overrides.version?.env ?? deps.env;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.CRITICAL
Pipe-to-shell patternbuild/agent-registry.js:103 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06linux: "curl https://cursor.com/install -fsSL | bash",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Destructive file system command detectedbuild/merge-workflow.js:347 · Destructive file system command detected
AST05" trap 'rm -f \"$curlrc\" \"$reqbody\" \"$respbody\"' EXIT",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsbuild/install-bridge.js:1352 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const sanitized = { ...env };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbuild/doctor.js:2126 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05env: overrides.projectIdentity?.env ?? deps.env,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbuild/executor/deps.js:74 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05env: options?.env,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbuild/doctor.js:2081 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05env: overrides.installStatus?.env ?? deps.env,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.CRITICAL
Pipe-to-shell patternbuild/agent-registry.js:102 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06darwin: "curl https://cursor.com/install -fsSL | bash",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathsbuild/install-bridge.js:7493 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05? binding?.env && !Object.prototype.hasOwnProperty.call(binding.env, "BAPI_API_KEY")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.CRITICAL
Agent configured for autonomous execution without human approvalbuild/docs.generated.js:6 · Agent configured for autonomous execution without human approval
AST02…ntry point would duplicate it. More\nimportantly, `write-ticket.md` is today an autonomous, single-ticket, no-halt\npipeline (\"No human confirmation gates — run end-to-end\") with no decomposition\nstep and no approval gate — it cannot ho…Fix: Declare and request only the permissions the task needs.HIGH
Access to sensitive file pathsbuild/env-file-link.js:7 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* worker's worktree. BAPI-1019 removes `.env*` from that copy step at sourceFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbuild/install-bridge.js:2253 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const env = asRecord(asRecord(top?.[registration.key])?.env);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.CRITICAL
Destructive command against a filesystem root or devicebuild/merge-workflow.js:806 · Destructive command against a filesystem root or device
AST05" trap 'rm -f \"$curlrc\" \"$reqbody\"' EXIT",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsbuild/executor/env.js:44 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* database; it could name that database because a copied `.env` reached itsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.CRITICAL
Destructive command against a filesystem root or devicebuild/merge-workflow.js:572 · Destructive command against a filesystem root or device
AST05" trap 'rm -f \"$curlrc\" \"$reqbody\"' EXIT",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsbuild/doctor.js:136 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"checkout's .env* files from a worker's worktree as the last step before spawn",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbuild/install-reexec.js:245 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const childEnv = { ...env, ...secretEnv, ...provenanceEnv };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbuild/doctor.js:2172 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05env: overrides.executorAdapter?.env ?? deps.env,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.CRITICAL
Destructive command against a filesystem root or devicebuild/merge-workflow.js:624 · Destructive command against a filesystem root or device
AST05" trap 'rm -f \"$curlrc\" \"$reqbody\"' EXIT",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsbuild/env-file-link.js:25 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* the operator's real `.env` exactly as a copy did.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbuild/install-doctor.js:93 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const envBlock = servers[registrationKey]?.env;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
URL with embedded credentialsbuild/base-url.js:37 · URL with embedded credentials — may be phishing or credential leaking
AST07* `https://user:secret@host` can never reach an error string, usage text, or log.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbuild/env-file-link.js:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* worktree must hold neither a copy nor a link — but it also takes `.env` awayFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbuild/install-bridge.js:3377 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const env = asRecord(asRecord(top?.[registration.key])?.env);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.CRITICAL
Destructive command against a filesystem root or devicebuild/merge-workflow.js:347 · Destructive command against a filesystem root or device
AST05" trap 'rm -f \"$curlrc\" \"$reqbody\" \"$respbody\"' EXIT",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsbuild/env-file-link.js:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* editing the operator's `.env` is immediately visible everywhere instead ofFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbuild/executor/env.js:50 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* value already in the environment WINS over a `.env` entry, which is what makesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagebuild/drive-epic.js:1647 · npx invocation of non-well-known package — may execute untrusted code
AST06: `npx -y ${MCP_PACKAGE_NAME} epic-plan save --epic-key ${epicKey}`;Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandbuild/executor/deps.js:26 · Process kill command — agent can terminate processes
AST05* 2-minute self-kill invariant is defeated. 30s is well under the 60s heartbeatFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandbuild/doctor.js:162 · Process kill command — agent can terminate processes
AST05"one read-only GET to /jira/mcp/tool-surface (none under the kill switch) and",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Remote installer piped to shellbuild/agent-registry.js:102 · Remote installer piped to shell
AST07darwin: "curl https://cursor.com/install -fsSL | bash",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packagebuild/install-bridge.js:247 · npx invocation of non-well-known package — may execute untrusted code
AST06"(the initial npx package resolution/download can exceed a short connect timeout).";Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Destructive file system command detectedbuild/merge-workflow.js:572 · Destructive file system command detected
AST05" trap 'rm -f \"$curlrc\" \"$reqbody\"' EXIT",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagebuild/authored-plan.js:167 · npx invocation of non-well-known package — may execute untrusted code
AST06const launcher = resolveDriverLauncher(env) ?? `npx -y ${MCP_PACKAGE_NAME}`;Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
MCP server using network transport (SSE/HTTP)build/docs.generated.js:7 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04… also carries `db/alembic/`, which is already a single-trigger path above):\n `mcp_server/src/executor/`, `mcp_server/src/agent-launchers/`,\n `mcp_server/src/claude-settings.ts`, `.github/workflows/`,\n `tests/integration/conductor_harnes…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
npx invocation of non-well-known packagebuild/doctor.js:841 · npx invocation of non-well-known package — may execute untrusted code
AST06`Warm it with: npx ${spec} --version, or raise MCP_TIMEOUT for the first launch.`,Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Destructive file system command detectedbuild/merge-workflow.js:695 · Destructive file system command detected
AST05" trap 'rm -f \"$curlrc\" \"$reqbody\" \"$respbody\"' EXIT",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagebuild/cli-help.js:3 · npx invocation of non-well-known package — may execute untrusted code
AST06export const INSTALL_RECOVERY_COMMAND = `npx -y ${MCP_PACKAGE_NAME} install`;Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/doctor.js:693 · npx invocation of non-well-known package — may execute untrusted code
AST06* Default read-only cache probe. Spawns `npx --no-install <spec> --version`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/docs.generated.js:14 · npx invocation of non-well-known package — may execute untrusted code
AST06…ork with Bridge's own ticket storage and with Jira.\n\nIn every command below, `npx -y @bridge_gpt/mcp-server` is the launcher. Keep the `-y`; without it, `npx` stops…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/init.js:49 · npx invocation of non-well-known package — may execute untrusted code
AST06// `--prefer-offline` makes npx resolve the (immutable, exact-pinned) versionFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Remote installer piped to shellbuild/agent-registry.js:103 · Remote installer piped to shell
AST07linux: "curl https://cursor.com/install -fsSL | bash",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Destructive file system command detectedbuild/merge-workflow.js:806 · Destructive file system command detected
AST05" trap 'rm -f \"$curlrc\" \"$reqbody\"' EXIT",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Destructive file system command detectedbuild/merge-workflow.js:624 · Destructive file system command detected
AST05" trap 'rm -f \"$curlrc\" \"$reqbody\"' EXIT",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagebuild/init.js:876 · npx invocation of non-well-known package — may execute untrusted code
AST06warn(` Fix with: npx -y ${MCP_PACKAGE_NAME} install (or set BAPI_REPO_NAME and store a key with the install flow)`);Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
MCP server using network transport (SSE/HTTP)build/docs.generated.js:15 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04…this\n (\"Qualify gate now?\"). Later, the human runs\n `npx -y @bridge_gpt/mcp-server install epic-implementer --qualify-gate`.\n A failed qualification does not fail the install. The gate simply stays\n unqualified, and readiness shows `…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
npx invocation of non-well-known packagebuild/init.js:43 · npx invocation of non-well-known package — may execute untrusted code
AST06// rather than the unpinned name. An unpinned `npx -y @bridge_gpt/mcp-server`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/doctor.js:82 · npx invocation of non-well-known package — may execute untrusted code
AST06` npx -y ${MCP_PACKAGE_NAME} doctor --stale-branch <KEY> [--stale-branch <KEY> ...] \\`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandbuild/doctor.js:1093 · Process kill command — agent can terminate processes
AST05* Collect the read-only tool-surface diagnostic. Evaluates the kill switch firstFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandbuild/executor/cli.js:93 · Process kill command — agent can terminate processes
AST05" --deadman-ms <n> Dead-man self-kill window (default 120000).",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File type combined with upload actionbuild/docs.generated.js:7 · File type combined with upload action — agent may exfiltrate local data files
AST07…y.\n `epic-coherence.md`, the JSON fields and verdict values in `epic-coherence.json`, the agent\n name, and the parent ticket's `## Epic coverage map` section keep their technical wording.\n- Write new passages with words such as `ticket …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagebuild/doctor.js:81 · npx invocation of non-well-known package — may execute untrusted code
AST06` npx -y ${MCP_PACKAGE_NAME} doctor [--agent <name>]`,Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathsbuild/start-tickets.js:1330 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* checkouts have `.env` and no `.env.test`. There is no `readFile` here and thereFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Process kill commandbuild/doctor.js:2356 · Process kill command — agent can terminate processes
AST05// one 500 ms GET (or none, under the kill switch). Any timeout, malformedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File type combined with upload actionbuild/docs.generated.js:5 · File type combined with upload action — agent may exfiltrate local data files
AST07…n> Bridge validates the hostname your credentials actually resolve to — from `dw.json`\n> or `SFCC_*` — against the sandbox forms listed below. An unrecognized host is refused\n> with a `403` (`error.code: \"TARGET_NOT_SANDBOX\"`) before a…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Access to sensitive file pathsbuild/start-tickets.js:1210 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// BAPI-1019: interactive worktrees get the operator's `.env`/`.env.test` back asFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsbuild/start-tickets.js:1293 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// `.config/wt.toml` no longer copies `.env*` into any worktree, which is whatFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
MCP server using network transport (SSE/HTTP)build/docs.generated.js:6 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04…commands/src/define-tickets.md` — Stage 9, the most-used authoring surface.\n- `mcp_server/instructions/decompose-epic-candidate.md` — the `idea-to-ticket`\n decomposition step.\n- `mcp_server/instructions/decompose-epic.md` — the `plan-ep…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
File type combined with upload actionbuild/docs.generated.js:9 · File type combined with upload action — agent may exfiltrate local data files
AST07…nputs\n\n- Run manifest: `{docs_dir}/idea-to-ticket/{slug}-{run_id}/run-manifest.json`.\n- Research pack: `{docs_dir}/idea-to-ticket/{slug}-{run_id}/research-pack.md` (if produced).\n- Pipeline variable `allow_duplicate` controls override …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagebuild/install-bridge.js:11 · npx invocation of non-well-known package — may execute untrusted code
AST06* npx -y @bridge_gpt/mcp-server install [--repo <name>] [--api-key <key>] [--force] [--dry-run] [--agent <name>]Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionbuild/docs.generated.js:6 · File type combined with upload action — agent may exfiltrate local data files
AST07…mcp_server/instructions/review-epic-coherence.md),\nwhich writes `epic-coherence.json` (the record) and `epic-coherence.md` (a short\nsummary) beside the frozen manifest.\n\n**Where it runs.** Four call sites run the check:\n\n- `/define-t…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagebuild/init.js:44 · npx invocation of non-well-known package — may execute untrusted code
AST06// lets npx silently reuse a stale local copy of the server (a verified bugFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Hidden zero-width characters detectedbuild/plane/defaults.js:431 · Hidden zero-width characters detected — may conceal content
AST07* - executor → `body.executor.process_heartbeat.state` / `….last_seen_at`Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
File type combined with upload actionbuild/docs.generated.js:8 · File type combined with upload action — agent may exfiltrate local data files
AST07…un directory, and write the readiness artifact there. Do not write `run-manifest.json`, do not compute or look up any label, and do not query Jira. Classify readiness and scope exac…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagebuild/install-bridge.js:409 · npx invocation of non-well-known package — may execute untrusted code
AST06` npx -y ${MCP_PACKAGE_NAME} install [flags]`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
MCP server using network transport (SSE/HTTP)build/docs.generated.js:14 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04…wn ticket storage and with Jira.\n\nIn every command below, `npx -y @bridge_gpt/mcp-server` is the launcher. Keep the `-y`; without it, `npx` stops to ask before it installs the package.\n\n## Prerequisites\n\nSetup checks every item below…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
npx invocation of non-well-known packagebuild/drive-epic.js:833 · npx invocation of non-well-known package — may execute untrusted code
AST06: `npx -y ${MCP_PACKAGE_NAME} drive-epic ${epicKey} --plan-file <path>${handoffSuffix}`;Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/bridge-config.js:331 · npx invocation of non-well-known package — may execute untrusted code
AST06`# "npx -y ${MCP_PACKAGE_NAME} install" once in this folder.`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/install-bridge.js:258 · npx invocation of non-well-known package — may execute untrusted code
AST06return `npx ${buildPrewarmArgs().join(" ")}`;Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/doctor.js:8 · npx invocation of non-well-known package — may execute untrusted code
AST06* npx -y @bridge_gpt/mcp-server doctor [--agent <name>]Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/docs.generated.js:12 · npx invocation of non-well-known package — may execute untrusted code
AST06…Claude Code or Cursor:** `/drive-epic-run {EPIC-KEY}`\n- **Codex or Copilot:** `npx -y @bridge_gpt/mcp-server drive-epic {EPIC-KEY}`\n\nBoth launch through `drive-epi…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandbuild/plane/manifest.js:516 · Process kill command — agent can terminate processes
AST05* that a subsequent `plane down` would read as a kill list.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagebuild/mcp-invoke.js:51 · npx invocation of non-well-known package — may execute untrusted code
AST06` npx -y ${MCP_PACKAGE_NAME}@latest mcp-invoke --target <target> --project-root <ABS_WORKTREE_PATH>)`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/upgrade-cli.js:285 · npx invocation of non-well-known package — may execute untrusted code
AST06// No reliable way exists to observe from inside the process whether npxFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/review-tickets.js:69 · npx invocation of non-well-known package — may execute untrusted code
AST06` npx -y ${MCP_PACKAGE_NAME} review-tickets BAPI-1 BAPI-2`,Fix: Pin versions and sources; vendor anything fetched at install time.LOW
Instructs the agent to modify its persistent memory or instruction filesbuild/agent-notes.js:106 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01targets.add("CLAUDE.md");Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Instructs the agent to modify its persistent memory or instruction filesbuild/agent-notes.js:100 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01targets.add("AGENTS.md");Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
npx invocation of non-well-known packagebuild/mcp-presets.js:5 · npx invocation of non-well-known package — may execute untrusted code
AST06* `npx -y` with `--headless --isolated`. The `mcp-invoke` shim adds exactly oneFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/review-tickets.js:72 · npx invocation of non-well-known package — may execute untrusted code
AST06` npx -y ${MCP_PACKAGE_NAME} review-tickets --dry-run BAPI-1 BAPI-2`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/setup-epic.js:2981 · npx invocation of non-well-known package — may execute untrusted code
AST06return (`npx -y ${MCP_PACKAGE_NAME} drive-epic ${epicKey} --repo ${access.repoName} ` +Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/visual-diff.js:254 · npx invocation of non-well-known package — may execute untrusted code
AST06* A bare `npx playwright install chromium` fetches whatever Playwright isFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/setup-epic.js:1872 · npx invocation of non-well-known package — may execute untrusted code
AST06`Run \`npx -y ${MCP_PACKAGE_NAME} epic-implementer readiness\` to see what; fix it, or pass \`--attended\`.`;Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/install-bridge.js:959 · npx invocation of non-well-known package — may execute untrusted code
AST06export const INSTALL_BRIDGE_CONNECT_GITHUB_COMMAND = `npx -y ${MCP_PACKAGE_NAME} connect-github`;Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/visual-diff.js:579 · npx invocation of non-well-known package — may execute untrusted code
AST06return errorContent("BROWSER_UNAVAILABLE", 503, 'The optional Playwright browser runtime is not available. Install it with "npm i playwright && npx playwright install chromium".');Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandbuild/plane/restart.js:51 · Process kill command — agent can terminate processes
AST05* - `server` — stop grace (10s) + kill wait (3s) + the TCP readiness budget (60s).Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandbuild/plane/shutdown.js:16 · Process kill command — agent can terminate processes
AST05* not acted on. A kill list is the last thing that should be parsed loosely.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagebuild/install-doctor.js:616 · npx invocation of non-well-known package — may execute untrusted code
AST06remediation: `run 'npx -y ${MCP_PACKAGE_NAME}@latest connect-github --repo ${target.repoName}'.`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandbuild/plane/restart.js:28 · Process kill command — agent can terminate processes
AST05* terminates a process that does not, so signalling an older runtime would killFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File type combined with upload actionbuild/install-bridge.js:8125 · File type combined with upload action — agent may exfiltrate local data files
AST07const prompted = await promptForVerificationCode(deps, deps.log, 3, { allowResend: true });Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagebuild/visual-diff.js:269 · npx invocation of non-well-known package — may execute untrusted code
AST06return "npx playwright install chromium";Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/install-reexec.js:5 · npx invocation of non-well-known package — may execute untrusted code
AST06* (`npx -y @bridge_gpt/mcp-server install`), and an UNPINNED npx spec silentlyFix: Pin versions and sources; vendor anything fetched at install time.LOW
Unpinned dependencybuild/project-root.js:6 · Unpinned dependency
AST06* `--upgrade`, which genuinely ran `npm i @bridge_gpt/mcp-server@latest` and soFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.MEDIUM
MCP server using network transport (SSE/HTTP)build/merge-workflow.js:13 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04* `mcp_server/scripts/bundle-assets.js`. The review rejected that in favour ofFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
File permission modification commandbuild/setup-epic.js:1790 · File permission modification command — agent changes file ownership/permissions
AST05`machine can read it. Restrict it with: chmod 600 '${policyPath}'`);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
npx invocation of non-well-known packagebuild/visual-diff.js:263 · npx invocation of non-well-known package — may execute untrusted code
AST06return `npx playwright@${version} install chromium`;Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandbuild/plane/manifest.js:434 · Process kill command — agent can terminate processes
AST05* validation must not hand the caller an actionable kill target.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagebuild/start-tickets.js:140 · npx invocation of non-well-known package — may execute untrusted code
AST06` npx -y ${MCP_PACKAGE_NAME} start-tickets [flags] KEY [KEY ...]`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandbuild/visual-diff.js:344 · Process kill command — agent can terminate processes
AST05// Deterministic settling: kill animations/transitions/caret, then wait fonts.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagebuild/review-tickets.js:71 · npx invocation of non-well-known package — may execute untrusted code
AST06` npx -y ${MCP_PACKAGE_NAME} review-tickets --review BAPI-1=auto,rounds=1 --review BAPI-2=rounds=2 BAPI-1 BAPI-2`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/review-tickets.js:70 · npx invocation of non-well-known package — may execute untrusted code
AST06` npx -y ${MCP_PACKAGE_NAME} review-tickets --auto --rounds=1 BAPI-1 BAPI-2`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/repair-assets.js:22 · npx invocation of non-well-known package — may execute untrusted code
AST06Unpinned npx -y ${MCP_PACKAGE_NAME} repair-assets intentionally selects the latestFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/upgrade-cli.js:6 · npx invocation of non-well-known package — may execute untrusted code
AST06* potentially-stale copy npx resolved at the call site.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionbuild/install-bridge.js:8174 · File type combined with upload action — agent may exfiltrate local data files
AST07deps.log(INSTALL_BRIDGE_REJECTED_RESEND_HINT);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagebuild/review-tickets.js:54 · npx invocation of non-well-known package — may execute untrusted code
AST06` npx -y ${MCP_PACKAGE_NAME} review-tickets [flags] KEY [KEY ...]`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/upgrade-cli.js:282 · npx invocation of non-well-known package — may execute untrusted code
AST06// construction — the parent resolved it through npx moments ago.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/upgrade-cli.js:686 · npx invocation of non-well-known package — may execute untrusted code
AST06stdout("Found a competing local installation in node_modules. Removing so npx resolves the pinned version...");Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandbuild/plane/manifest.js:10 · Process kill command — agent can terminate processes
AST05* attacker-controlled or corrupted manifest must not become a kill list.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagebuild/notifications.js:5 · npx invocation of non-well-known package — may execute untrusted code
AST06* npx -y @bridge_gpt/mcp-server notifications --repo <repo> --run <epic-key|run-id> [--follow]Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionbuild/install-bridge.js:8160 · File type combined with upload action — agent may exfiltrate local data files
AST07deps.log(` ${INSTALL_BRIDGE_RESEND_THROTTLED}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionbuild/install-bridge.js:8148 · File type combined with upload action — agent may exfiltrate local data files
AST07deps.log(` ${INSTALL_BRIDGE_RESEND_SENT}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagebuild/upgrade-cli.js:12 · npx invocation of non-well-known package — may execute untrusted code
AST06* is the version of the CLI process npx just resolved. Invoked the documentedFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/install-doctor.js:177 · npx invocation of non-well-known package — may execute untrusted code
AST06const PROJECT_INSTALL_COMMAND = `npx -y ${MCP_PACKAGE_NAME} install`;Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/setup-epic.js:591 · npx invocation of non-well-known package — may execute untrusted code
AST06` npx -y ${MCP_PACKAGE_NAME} executor --repo <name> --epic-run-id <run-id>`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/setup-epic.js:4862 · npx invocation of non-well-known package — may execute untrusted code
AST06say(` npx -y ${MCP_PACKAGE_NAME} executor --repo ${access.repoName} ` +Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebuild/mcp-presets.js:29 · npx invocation of non-well-known package — may execute untrusted code
AST06/** The pinned package spec `npx -y` launches. */Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionbuild/install-bridge.js:8152 · File type combined with upload action — agent may exfiltrate local data files
AST07deps.log(` ${INSTALL_BRIDGE_RESEND_COOLDOWN}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File permission modification commandbuild/mcp-grant.js:225 · File permission modification command — agent changes file ownership/permissions
AST05* chmod `0600`, atomic rename, then a best-effort directory fsync. TheFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Process kill commandbuild/plane/shutdown.js:8 · Process kill command — agent can terminate processes
AST05* The honest caveat this compensates for: a SIGKILLed supervisor cannot killFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.Cost to the agent
Instructions loaded
≈59 tok
1 file · 81 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
No advisories in OSV for @bridge_gpt/mcp-server@0.2.76 as of 22 h ago. This is the package itself, not its dependencies.
What would make this Verified
10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- Agent configured for autonomous execution without human approval≈ +9 on the totalDeclare and request only the permissions the task needs.
- Unclaimed publisher≈ +8 on the totalClaim bridge_gpt: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim bridge_gptPropose a patch to the maintainer