Skills/npm/mcp-server

mcp-server@1.0.32

CAUTION

Publisher claims: "Official Model Context Protocol (MCP) server & Orchestrator for Agile Monster (Cursor, Claude Code, Antigravity, Codex, Hermes, Windsurf)" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher agilemonster · publishing for 10 daysInstalls 5,390Last detonated 1 h ago
What would fix thisWatchDispute verdict

Coverage

Server started and answered tools/list.
Tested
MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with real credentials

Before you give it your token

It will ask for
AGILEMONSTER_API_KEYAM_API_KEYANTHROPIC_API_KEYCLAUDE_CODE_OAUTH_TOKENCODEX_API_KEYCURSOR_API_KEY or --max-tokensConfiguration, not credentials: AGILEMONSTER_AGENT_COMMAND, AGILEMONSTER_AGENT_ENGINE, AGILEMONSTER_AGENT_TIMEOUT_MINUTES, AGILEMONSTER_API_URL, AGILEMONSTER_HOME, AGILEMONSTER_ISOLATE, AGILEMONSTER_NO_LOGIN, AGILEMONSTER_NO_NOTIFY, AGILEMONSTER_NO_SERVICE, AGILEMONSTER_REPORT, ANTIGRAVITY_APP_DATA_DIR, GEMINI_CLI
Where it talks to
agilemonster.com (its own)Also cursor.com, apple.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names cursor.com, apple.com as well as its own vendor. The guard injects AGILEMONSTER_API_KEY, AM_API_KEY, ANTHROPIC_API_KEY, CLAUDE_CODE_OAUTH_TOKEN, CODEX_API_KEY, CURSOR_API_KEY only into requests to agilemonster.com (and its subdomains) and refuses the rest.

$vet-skills run --secrets AGILEMONSTER_API_KEY=agilemonster.com,AM_API_KEY=agilemonster.com,ANTHROPIC_API_KEY=agilemonster.com,CLAUDE_CODE_OAUTH_TOKEN=agilemonster.com,CODEX_API_KEY=agilemonster.com,CURSOR_API_KEY=agilemonster.com -- npx -y @agilemonster/mcp-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-15 and scored it 58/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Pipe-to-shell pattern; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 29 s · 2 scenarios
t+CategoryObserved action
0.0sprocessno install scripts in bundle
8.7sprocessdependency install exit 0
29sfilesystemread ~/.bash_profile · ~/.bash_login · ~/.profile outside project
29sprocessexec /usr/bin/id
29sclaimed14 tools: agilemonster_get_context, agilemonster_init_project, agilemonster_list_my_tasks, agilemonster_claim_task, agilemonster_ask_question, agilemonster_add_progress, agilemonster_record_spend, agilemonster_set_budget, agilemonster_submit_for_review, agilemonster_create_followup_tasks, agilemonster_block_task, agilemonster_complete_task, agilemonster_get_deploy_profile, agilemonster_record_deployment
29stools8be1d40323fa1ad4
29stoolsb0cebe921ed63ba5
29stools8efa64f1808c5f68
29stoolsfcb3b1f772e08de3
29stoolsa69338d993b6472d
29stoolse994659012c75a18
29stools5b2b10d7b16e686c
29stools1ff9d06fa19d77c5
29stoolsbd32f607f42a036c
29stoolsbdd94dfd239463b4
29stools2804f43aca2a5820
29stools14bc4f134233596d
29stools01a1abab5a0bd224
29stoolsb12113965709d740
29sprocessscript backend runs setup only
29sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsdist/agent-engine.js:398 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { ...env, AGILEMONSTER_PROMPT_FILE: promptFile, AGILEMONSTER_PROJECT_PATH: opts.projectPath },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Pipe-to-shell patterndist/agent-engine.js:105 · Pipe-to-shell pattern — downloads and immediately executes remote codeinstallHint: 'curl https://cursor.com/install -fsS | bash',Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file pathsdist/ide-config.js:158 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files`[mcp_servers.${SERVER_NAME}.env]`,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/client.js:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// 3. Local .env file in cwdFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Hidden zero-width characters detecteddist/ide-config.js:87 · Hidden zero-width characters detected — may conceal contentconst text = raw.replace(/^/, '');Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Access to sensitive file pathsdist/deploy-runner.js:140 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst isEnvTemplate = /(^|\/)\.env\.(example|sample|template|dist)$/i.test(rel);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/deploy-runner.js:133 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst NEVER_COMMIT_RE = /(^|\/)(\.agilemonster\.json|\.mcp\.json|\.cursor\/mcp\.json|\.vscode\/mcp\.json|\.env(\.[\w.-]+)?|id_rsa|id_ed25519|.*\.pem|.*\.p12|\.agilemonster\/.*|\.git\/.*)$/i;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
URL with embedded credentialsdist/redact.d.ts:12 · URL with embedded credentials — may be phishing or credential leaking* A git remote as it may leave this machine: `https://user:token@host/...` and `https://token@host/...`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
URL with embedded credentialsdist/redact.js:9 · URL with embedded credentials — may be phishing or credential leaking/** Credentials embedded in a URL: https://user:token@host/... (a git remote with a personal access token). */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Access to sensitive file pathsdist/client.js:58 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Ignore .env read errorFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/deploy-profile.js:603 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfor (const envFile of ['.env.production', '.env.example', '.env']) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/client.js:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst envPath = path.join(this.cwd, '.env');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/agent-signin.js:80 · npx invocation of non-well-known package — may execute untrusted codedeps.print('Finish this any time with: npx -y @agilemonster/mcp-server agents login');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/deploy-profile.js:754 · npx invocation of non-well-known package — may execute untrusted code[['wrangler.toml', 'wrangler.jsonc', 'wrangler.json'], 'npx wrangler deploy', 'Cloudflare Wrangler config'],Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/orchestrator.js:50 · npx invocation of non-well-known package — may execute untrusted codeconsole.log(' Run "npx -y @agilemonster/mcp-server bootstrap" in this folder first!\n');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
URL with embedded credentialsdist/redact.js:48 · URL with embedded credentials — may be phishing or credential leaking* A git remote as it may leave this machine: `https://user:token@host/...` and `https://token@host/...`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
npx invocation of non-well-known packagedist/server.js:3401 · npx invocation of non-well-known package — may execute untrusted codelog.warn('daemon.no_api_key', { hint: 'run `npx -y @agilemonster/mcp-server bootstrap` in a project folder' });Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/server.js:1016 · Process kill command — agent can terminate processes// Never kill a half-applied edit or a running deployment; give up waiting after 30 minutes.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/server.js:2441 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// The model may only choose from the files it was offered: a path it made up (../../.ssh/…, .env) is droppedFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/service.js:321 · npx invocation of non-well-known package — may execute untrusted codereturn 'Background runner: not installed. Cards are worked only while your AI coding tool is open in the project folder.\nInstall it: npx -y @agilemonster/mcp-server service install';Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/agent-engine.js:278 · npx invocation of non-well-known package — may execute untrusted codelines.push('', 'To sign in the agents that are installed: npx -y @agilemonster/mcp-server agents login');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/agent-signin.js:21 · npx invocation of non-well-known package — may execute untrusted codedeps.print(ok ? `✅ ${name(s)} is signed in and can work cards.` : `⚠️ ${name(s)} is still not signed in. You can try again later with: npx -y @agilemonster/mcp-server agents login`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/server.js:2655 · File type combined with upload action — agent may exfiltrate local data files… ...filesPayload, '__COMPILER_ERROR_TO_FIX__.txt': `Your previous edits were reverted because the project no longer built:\n${buildErrorExcerpt(buildCheck.errorOutput || '', 40, 3500)}\nReturn the complete set of edits again with this fixe…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/deploy-profile.js:758 · npx invocation of non-well-known package — may execute untrusted code[['netlify.toml'], 'npx netlify deploy --prod', 'Netlify config (netlify.toml)'],Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/service.d.ts:9 · npx invocation of non-well-known package — may execute untrusted code* The service runs its own copy of the package from ~/.agilemonster/runner, so it does not depend on an npxFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/deploy-profile.js:756 · npx invocation of non-well-known package — may execute untrusted code[['firebase.json'], 'npx firebase deploy', 'Firebase config (firebase.json)'],Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/server.js:652 · npx invocation of non-well-known package — may execute untrusted code`Run "npx -y @agilemonster/mcp-server bootstrap" first so we verify this folder matches the card's board.`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Unpinned dependencydist/server.js:1057 · Unpinned dependency: spawn('sh', ['-c', 'npm install -g @agilemonster/mcp-server@latest >/dev/null 2>&1 || npx -y @agilemonster/mcp-server@latest --version >/dev/null 2>&1'], {Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
MEDIUM
npx invocation of non-well-known packagedist/server.js:1057 · npx invocation of non-well-known package — may execute untrusted code: spawn('sh', ['-c', 'npm install -g @agilemonster/mcp-server@latest >/dev/null 2>&1 || npx -y @agilemonster/mcp-server@latest --version >/dev/null 2>&1'], {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/service.js:186 · npx invocation of non-well-known package — may execute untrusted codemessage: 'No API key is saved on this computer yet. Run `npx -y @agilemonster/mcp-server bootstrap` in your project folder first.',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/guidelines.d.ts:1 · File type combined with upload action — agent may exfiltrate local data files…working on any task:\n\n1. **Context & Discovery**:\n - Inspect `.agilemonster.json` in the project root if present.\n - Run `agilemonster_get_context` to retrieve the board ID, list columns (`Backlog`, `In Progress`, `Review`, `Done`), an…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/deploy-profile.js:757 · npx invocation of non-well-known package — may execute untrusted code[['vercel.json'], 'npx vercel --prod', 'Vercel config (vercel.json)'],Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/orchestrator.js:362 · npx invocation of non-well-known package — may execute untrusted code? '2. Add a card that says what you want. No coding agent is ready on this computer yet, so finish that first: npx -y @agilemonster/mcp-server agents login'Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Remote installer piped to shelldist/agent-engine.js:105 · Remote installer piped to shellinstallHint: 'curl https://cursor.com/install -fsS | bash',Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
npx invocation of non-well-known packagedist/service.js:12 · npx invocation of non-well-known package — may execute untrusted code* The service runs its own copy of the package from ~/.agilemonster/runner, so it does not depend on an npxFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionbin/orchestrator.js:82 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`✅ Question posted to task: ${result.title}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/agent-signin.js:76 · npx invocation of non-well-known package — may execute untrusted codedeps.print(`Not signed in: ${signedOut.join(', ')}. A card assigned to ${signedOut.length === 1 ? 'it' : 'one of them'} waits until you sign in (npx -y @agilemonster/mcp-server agents login).`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/server.js:1052 · npx invocation of non-well-known package — may execute untrusted code// updates its own copy in place; a runner started any other way refreshes the global install / npx cache.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/server.js:619 · npx invocation of non-well-known package — may execute untrusted code`Please run "npx -y @agilemonster/mcp-server bootstrap" in this folder or call agilemonster_get_context first to bind the right board.`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/service.js:172 · npx invocation of non-well-known package — may execute untrusted codeconst KEEP_OPEN_HINT = 'Until then, cards are worked while your AI coding tool is open in the project folder, or while this runs in a terminal: npx -y @agilemonster/mcp-server pulse-daemon';Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/service.js:195 · npx invocation of non-well-known package — may execute untrusted code' To replace it with the standard one: npx -y @agilemonster/mcp-server service install --force',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/orchestrator.js:368 · npx invocation of non-well-known package — may execute untrusted codeconsole.log(' cd /path/to/other-project && npx -y @agilemonster/mcp-server bootstrap\n');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/orchestrator.js:255 · npx invocation of non-well-known package — may execute untrusted codeconsole.log('No board selected. Run "npx -y @agilemonster/mcp-server bootstrap" again to connect a board.');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈73 tok
1 file · 44 in bundle
Tool list per prompt
≈2,466 tok
14 tools · 176 per tool
Handshake
807 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 161

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @agilemonster/mcp-server@1.0.32 as of 43 min ago. This is the package itself, not its dependencies.

What would make this Verified

22 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Unclaimed publisher≈ +8 on the totalClaim agilemonster: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
  6. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim agilemonsterPropose a patch to the maintainer