Skills/npm/mcp-server

mcp-server@0.57.0

VERIFIED

Publisher claims: "MCP server for Clipwright: generate UGC videos from your coding agent" Observed in sandbox: calls api.clipwright.io only, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher clipwright · publishing for 111 daysInstalls 7,390Last detonated 26 h ago
$claude mcp add mcp-server -- npx -y @clipwright/mcp-server
WatchReport an issue

Coverage

Started with a decoy CLIPWRIGHT_API_KEY; tool list observed. Tool calls with a real credential not tested.
Tested
server startup with a tagged decoy in CLIPWRIGHT_API_KEY · MCP initialize and tools/list · every tool description, for hidden instructions · where the decoy credential went · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with a real credential
Needs
CLIPWRIGHT_API_KEY — give it to the server where it runs, through vet-skills run --secrets, so the value never enters the server's environment. Never paste a credential into a chat, a ticket or a report.

Before you give it your token

It will ask for
CLIPWRIGHT_API_KEYConfiguration, not credentials: CLIPWRIGHT_API_URL
Where it talks to
no vendor host named in the codeAlso unused.invalid — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · reached only api.clipwright.io (its own)
What we could not test
what the tools do when called with a real credential

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names unused.invalid as well as its own vendor. The guard injects CLIPWRIGHT_API_KEY only into requests to clipwright.io (and its subdomains) and refuses the rest.

$vet-skills run --secrets CLIPWRIGHT_API_KEY=clipwright.io -- npx -y @clipwright/mcp-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-13 and scored it 89/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: calls api.clipwright.io only, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 47 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
7.2sprocessdependency install exit 0
27sprocessrelaunched with a decoy CLIPWRIGHT_API_KEY (tagged; nothing real)
47snetworkCONNECT tcp://api.clipwright.io:443
47snetworkCONNECT tcp://api.clipwright.io:443
47sclaimed58 tools with a decoy CLIPWRIGHT_API_KEY: list_workflows, get_workflow, prepare_workflow_plan, plan_reference_remake, get_workflow_plan, approve_workflow_plan, quote_workflow_plan, run_workflow_plan, make_ugc, get_run, get_run_shots, delete_run_media, quote_revision, revise_run, quote_candidate, create_candidate, list_generation_models, quote_image, generate_image, quote_video, generate_video, quote_ugc, upload_image, create_upload, get_upload
47stools1741849627adfc52
47stoolsc8e2af1d228c6c32
47stools6328467b21127e0a
47stoolsd56ea7948d1d537e
47stools75f408cd69fe171e
47stoolsa9f22348b4fce270
47stoolsf7ef397fbdcb3364
47stools5003f0ff16a65c60
47stools031b89f0274fe841
47stools99b0b06098b15966
47stools5ba4f8eb4e0e9959
47stools259fc9b23766f7e9
47stools9fde0c961b48f3bc
47stools53f6bc85a2d6d058
47stoolsf9d4bd584bc09a48
47stools33e80d5e7b37c4b4
47stoolsed6cd8c5b7fc8150
47stools4b348ec2fb7d5c72
47stoolsc09ea8e41e94dfc6
47stoolsa9797943b0d5c3c6
47stools35f50a92d0419340
47stools8bc8dbac0af4958b
47stoolsdb8ecd17a0788ffc
47stools60624f1c33561e87
47stoolse80994443dd7249a
47stools2a59165e1d908627
47stoolsf5a84cb0ad9a3c8e
47stools6b0a8f8c2b5b1db5
47stools325b4d7f0ac0a088
47stools9e435199e2e97f67
47stools5737ff7d88d2f1c8
47stoolsd8a2a75e81d6661c
47stools9459d4a6ae220a95
47stoolsba83a87c6ab57ac8
47stools819f6b85986d171d
47stools6274ff40fad07ac9
47stoolsff255acdb3923f2c
47stools4f66da6f9d82385d
47stoolsb0b80c1ffad18c09
47stools2da41c2241d2ff8e
47stoolsb85ec71659f471c6
47stools9d38963b7140ed1b
47stoolse41ae030f4e5ea4f
47stoolsa7447afeebaddb84
47stools3fd430b0971a8768
47stools03e24eea32a0f285
47stools1ceec12c62c88a42
47stools1f4c9ee6f80d9fab
47stoolsb03cab42217209d9
47stools65cfa005a674ee09
47stools4bea0fa8b1da8526
47stools549610af097e073b
47stools1a59a62f22df4f7c
47stoolsb6b714ad3defe921
47stools080524fa2ee63b93
47stoolsd7696c707da46e17
47stools9fc915c097ecbc99
47stoolse3adec4432ba1d17
47sprocessscript backend runs setup only
47sprocessno install scripts to re-run

Static findings

MEDIUM
MCP server using network transport (SSE/HTTP)SKILL.md:143 · MCP server using network transport (SSE/HTTP) — data sent over network| VS Code | `.mcp.json`: `{"mcpServers": {"clipwright": {"type": "http", "url": "https://mcp.clipwright.io/mcp"}}}` | from the client's docs |Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
npx invocation of non-well-known packageSKILL.md:196 · npx invocation of non-well-known package — may execute untrusted code-- npx -y -p @clipwright/mcp-server@latest clipwright-mcpFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:158 · npx invocation of non-well-known package — may execute untrusted codenpx -y -p @clipwright/mcp-server@latest clipwright-mcpFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
MCP server using network transport (SSE/HTTP)SKILL.md:142 · MCP server using network transport (SSE/HTTP) — data sent over network| Cursor | `~/.cursor/mcp.json`: `{"mcpServers": {"clipwright": {"url": "https://mcp.clipwright.io/mcp"}}}` | from the client's docs |Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)dist/server.js:8 · MCP server using network transport (SSE/HTTP) — data sent over network…KE_UGC_AGENT_PROTOCOL, MAKE_FACELESS_DESCRIPTION, MAKE_FACELESS_AGENT_PROTOCOL, mcpServerInstructions, makeFacelessInput, offeredFacelessInput, REVISION_CHARGE_TEXT, revisionRequest, UPLOAD_IMAGE_DESCRIPTION, UPLOAD_MAX_BYTES, UPLOAD_MEDIA…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04

Cost to the agent

Instructions loaded
≈9,204 tok
1 file · 26 in bundle
Tool list per prompt
≈17,720 tok
58 tools · 306 per tool
Handshake
3521 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 322

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @clipwright/mcp-server@0.57.0 as of 26 h ago. This is the package itself, not its dependencies.