Skills/npm/mcp-server

mcp-server@0.64.0

VERIFIED

Publisher claims: "Official Porkbun MCP server: domains, DNS, SSL, hosting and Cloudflare via the Porkbun API." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server) · listed in the official MCP RegistryPublisher porkbunllc · publishing for 191 daysInstalls 8,673Last detonated 3d ago
$claude mcp add mcp-server -- npx -y @porkbunllc/mcp-server
WatchReport an issue

Coverage

Server started and answered tools/list.
Tested
MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with real credentials

Before you give it your token

It will ask for
OAUTH_ISSUERPORKBUN_API_KEYPORKBUN_SECRET_API_KEYPORKBUN_X402_PRIVATE_KEYConfiguration, not credentials: MCP_PUBLIC_URL, OPENAI_APPS_CHALLENGE, PORKBUN_BASE_URL, PORKBUN_DOCS_BASE, PORKBUN_X402_MAX_CENTS
Where it talks to
porkbun.com (its own)
What the honeypot saw
no credential files read · no network
What we could not test
what the tools do when called with real credentials

Connect it with a scoped credential, under the guard. It asks for OAUTH_ISSUER, PORKBUN_API_KEY, PORKBUN_SECRET_API_KEY, PORKBUN_X402_PRIVATE_KEY and talks to porkbun.com. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind.

$vet-skills run --secrets OAUTH_ISSUER=porkbun.com,PORKBUN_API_KEY=porkbun.com,PORKBUN_SECRET_API_KEY=porkbun.com,PORKBUN_X402_PRIVATE_KEY=porkbun.com -- npx -y @porkbunllc/mcp-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-11 and scored it 84/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 38 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
17sprocessdependency install exit 0
37sclaimed154 tools: ping, check_domain, check_domains, get_registration_requirements, get_pricing, list_marketplace, list_domains, get_domain, get_balance, get_auto_topup, top_up_with_usdc, top_up_with_card_mpp, send_phone_verification_code, confirm_phone_verification, send_email_verification_code, confirm_email_verification, get_usdc_topup_status, list_invoices, get_invoice, get_invoice_pdf, configure_auto_topup, top_up_account_credit, get_api_settings, get_nameservers, list_dns_records
37sprocessscript backend runs setup only
37sprocessno install scripts to re-run

Static findings

MEDIUM
File type combined with upload actiondist/tools.js:1835 · File type combined with upload action — agent may exfiltrate local data files…tatic Hosting. TEXT FILES GO IN `text`, AS WRITTEN: for .html, .css, .js, .svg, .json, .txt and .xml send { path, text } with the file's contents exactly as you wrote them. Do NOT base64-encode text files; base64 is slow and error-prone fo…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/buy_closeout:1 · Instruction aimed at the agent: "do not tell the user"releases it over the following days, so do not tell the user it is in their account: poll list_domains or watch the domaFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packagedist/tools.js:89 · npx invocation of non-well-known package — may execute untrusted code… No shell? Link's own MCP server does the same where your client can run one (\`npx -y @stripe/link-cli --mcp\`, or \`link-cli mcp add\` to register it); without eith…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈74 tok
1 file · 11 in bundle
Tool list per prompt
≈52,819 tok
154 tools · 343 per tool
Handshake
3148 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 747

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @porkbunllc/mcp-server@0.64.0 as of 3d ago. This is the package itself, not its dependencies.