Skills/npm/mcp-server

mcp-server@1.0.55

CAUTION

Publisher claims: "Verified npm launcher for the open-source ContextStream Rust MCP server" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher contextstream · joined 8 days agoInstalls 11,447Last detonated 46 h ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-01 and scored it 79/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 2 s · 2 scenarios
t+CategoryObserved action
0.0sprocessno install scripts in bundle
1.8sfilesystemread ~/.cache/contextstream/mcp/v1.0.55/linux-x64/metadata.json · ~/.cache/contextstream/mcp/v1.0.55/linux-x64/contextstream-mcp outside project
1.8sfilesystemwrote ~/.cache/contextstream/mcp/v1.0.55/linux-x64/.install.lock · ~/.cache/contextstream/mcp/v1.0.55/linux-x64/contextstream-mcp.598-c6cbf805-149d-4af8-8ec4-eef84fbfca84.tmp · ~/.cache/contextstream/mcp/v1.0.55/linux-x64/metadata.json.598-c6cbf805-149d-4af8-8ec4-eef84fbfca84.tmp
1.8sprocessexec /usr/bin/timeout
1.8sprocessexec /tmp/ks-detonate-lTDrpr/task/home/.cache/contextstream/mcp/v1.0.55/linux-x64/contextstream-mcp
1.8sprocessexited 1: /tmp/ks-detonate-lTDrpr/task/home/.cache/contextstream/mcp/v1.0.55/linux-x64/contextstream-mcp: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.39' not found (required by /tmp/ks-detonate-
1.8sclaimedno tools/list reply (exit 1)
1.8sprocessscript backend runs setup only

Static findings

HIGH
Access to sensitive file pathsnpm/launcher.mjs:367 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

No other findings across 843 lines in 9 files.

What would make this Verified

1 point to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim contextstream: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim contextstream