mcp-server@1.24.9
VERIFIEDPublisher claims: "Contentful MCP Server - Model Context Protocol server for Contentful" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher contentful · publishing for 478 daysInstalls 41,657Last detonated 25 min ago
Coverage
Started with a decoy CONTENTFUL_MANAGEMENT_ACCESS_TOKEN; tool list observed. Tool calls with a real credential not tested.- Tested
- server startup with a tagged decoy in CONTENTFUL_MANAGEMENT_ACCESS_TOKEN · MCP initialize and tools/list · every tool description, for hidden instructions · where the decoy credential went · every file read, file written and host contacted by what ran
- Not tested
- what the tools do when called with a real credential
- Needs
- CONTENTFUL_MANAGEMENT_ACCESS_TOKEN — give it to the server where it runs, through vet-skills run --secrets, so the value never enters the server's environment. Never paste a credential into a chat, a ticket or a report.
Before you give it your token
- It will ask for
- no credential variables read in the code; at startup it asked for CONTENTFUL_MANAGEMENT_ACCESS_TOKEN
- Where it talks to
- no vendor host named in the code
- What the honeypot saw
- no credential files read · no network
- What we could not test
- what the tools do when called with a real credential
Reasonable to connect. No credential asked for, no third-party host named, Started with a decoy CONTENTFUL_MANAGEMENT_ACCESS_TOKEN; tool list observed. Tool calls with a real credential not tested.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-15 and scored it 95/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 83 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
42sprocessdependency install exit 0
62sprocessrelaunched with a decoy CONTENTFUL_MANAGEMENT_ACCESS_TOKEN (tagged; nothing real)
82sclaimed88 tools with a decoy CONTENTFUL_MANAGEMENT_ACCESS_TOKEN: create_ai_action, invoke_ai_action, get_ai_action_invocation, delete_ai_action, get_ai_action, list_ai_actions, publish_ai_action, unpublish_ai_action, update_ai_action, upload_asset, list_assets, get_asset, update_asset, delete_asset, publish_asset, unpublish_asset, archive_asset, unarchive_asset, list_content_previews, get_entry_preview_url, get_content_type, list_content_types, create_content_type, update_content_type, delete_content_type
82stoolscc39dc37ece64920
82stools0a3fd68aa166944f
82stools25e90805fbcceb74
82stoolscef0a3ec89724b1f
82stools5b19dc9fcf785355
82stools7828a1e86571004c
82stools5c7aa9ecfa648758
82stools442bf9efb60d0054
82stoolsb40c9fbb5ec440f0
82stoolsc4d5a76fb36d3e1b
82stoolse581af71b36c6f62
82stools4ceeb582a4c8974d
82stools817aef63ca99197a
82stoolsfeccecc043c75d81
82stools2f0d5f063403da8e
82stools834314f222779278
82stools782e27f26b2cccf9
82stools65bd4f889622c797
82stools26b25b411d6bae2f
82stools296c18a6344b514a
82stools599a819a20fac65d
82stools489dbe656558a8cf
82stoolsa648a637cfe0db36
82stoolsb5d50501e56032a4
82stoolscf8b0fcff2d8ecc7
82stools46a4033cf090b5fa
82stools949371219b4fb0f3
82stoolsf6fa178cf7bc1f9d
82stoolsda9ea6a102564cd6
82stools39d985484b9553ab
82stools0d7aea82dffbb7c9
82stoolseb33a8cacfa3a2be
82stools8a1a4979bd340ba6
82stools2c215ad500863733
82stools60bb84dbcab25cbb
82stools29cbe549c11d4457
82stools5833e29dad35644c
82stoolsc3e57015ab631f5c
82stoolsf9c8f610d57a4be7
82stools88b7233bb9f18191
82stoolsbc65de3e84b60b72
82stools2e873d8e1bb119e7
82stools8732b81a22ed40a9
82stools008c6f99fb319621
82stools8579af19821b919d
82stoolsebbf101d7491cfdc
82stools7cc25120265efc97
82stools7aea5792a27e77c8
82stoolsac8b9bd68c523ce9
82stoolsf72198964e4bf3c3
82stoolsc472e5d96ffcdaf9
82stools4ba9cac8b227024b
82stoolsf95e515882f5efa8
82stools270a7fcd9f03d966
82stoolsa8cacac19ab1a44d
82stools137e580e13de9344
82stoolse67d4265d94eeda8
82stoolsa30e08aea680b0a2
82stools3003c4550e633b3f
82stools4bcfda22df370ab4
82stoolscbcfea0af7111fa3
82stoolsf644dba71c96b7f9
82stoolsf296e1ed81324aa5
82stools381af7846e72dd1d
82stools800b2b2d3ecf31b3
82stools967eba04ef055444
82stoolsdad806338f2840f1
82stools2e72565118083071
82stools50a97ac482429ecb
82stoolsadd1a80e7e6269bc
82stools0da41a13d9bf424b
82stools1ef067fb1cff17af
82stools09690992465977c1
82stools278b78a56772e6b9
82stoolsf8663e1ba20004d5
82stoolsfed50f31d8e99a41
82stools98ac0dcf1f84bb79
82stoolsf996ab9537c38d9e
82stools3c7c7183c3415929
82stoolsf6027e043a080a8d
82sprocessscript backend runs setup only
82sprocessno install scripts to re-run
Static findings
HIGH
Tool description instructs the agent: section addressed to the agentmcp:tools/update_ai_action:2 · Instruction aimed at the agent: section addressed to the agent
AST01nalProperties":false,"description":"The instruction for the AI action"},"configuration":{"type":"object","properties":{"moFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: section addressed to the agentmcp:tools/create_ai_action:2 · Instruction aimed at the agent: section addressed to the agent
AST01nalProperties":false,"description":"The instruction for the AI action"},"configuration":{"type":"object","properties":{"moFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.Cost to the agent
Instructions loaded
≈55 tok
1 file · 7 in bundle
Tool list per prompt
≈36,634 tok
88 tools · 416 per tool
Handshake
7061 ms
launch to tools/list, stdio
Undocumented tools
3
description under 20 chars · avg 239
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
Not checked against OSV yet; the weekly check has not reached this version.