mcp-server@1.0.65
CAUTIONPublisher claims: "Verified npm launcher for the open-source ContextStream Rust MCP server" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher contextstream · joined 9 days agoInstalls 11,761Last detonated 58 min ago
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-04 and scored it 79/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 3 s · 2 scenariost+CategoryObserved action
0.0sprocessno install scripts in bundle
2.7sfilesystemread ~/.cache/contextstream/mcp/v1.0.65/linux-x64/metadata.json · ~/.cache/contextstream/mcp/v1.0.65/linux-x64/contextstream-mcp outside project
2.7sfilesystemwrote ~/.cache/contextstream/mcp/v1.0.65/linux-x64/.install.lock · ~/.cache/contextstream/mcp/v1.0.65/linux-x64/contextstream-mcp.149-ef6ffcbe-261e-429e-a277-7be0fda7fbae.tmp · ~/.cache/contextstream/mcp/v1.0.65/linux-x64/metadata.json.149-ef6ffcbe-261e-429e-a277-7be0fda7fbae.tmp
2.7sprocessexec /usr/bin/timeout
2.7sprocessexec /tmp/ks-detonate-vtjJOd/task/home/.cache/contextstream/mcp/v1.0.65/linux-x64/contextstream-mcp
2.7sprocessexited 1: /tmp/ks-detonate-vtjJOd/task/home/.cache/contextstream/mcp/v1.0.65/linux-x64/contextstream-mcp: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.39' not found (required by /tmp/ks-detonate-
2.7sclaimedno tools/list reply (exit 1)
2.7sprocessscript backend runs setup only
Static findings
HIGH
Access to sensitive file pathsnpm/launcher.mjs:367 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05No other findings across 843 lines in 9 files.
What would make this Verified
1 point to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim contextstream: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim contextstream