Skills/npm/mcp-server

mcp-server@1.3.3

VERIFIED

Publisher claims: "CAVDAX Enclosed Model Context Protocol (MCP) Server backed by FalkorDB GraphBLAS" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher cavdax · publishing for 25 daysInstalls 2,358Last detonated 24 h ago
$claude mcp add mcp-server -- npx -y @cavdax/mcp-server
WatchReport an issue

Coverage

Server started and answered tools/list.
Tested
MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with real credentials

Before you give it your token

It will ask for
CAVDAX_API_KEYFALKORDB_PASSWORDGH_TOKENGITHUB_TOKENConfiguration, not credentials: CAVDAX_MODE, CAVDAX_REPO_ROOT, CAVDAX_SERVER_URL, FALKORDB_GRAPH_NAME, FALKORDB_HOST, FALKORDB_PORT, GITHUB_ACTIONS, GITHUB_REPOSITORY, GITHUB_SHA
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
what the tools do when called with real credentials

Connect it with a scoped credential, under the guard. It asks for CAVDAX_API_KEY, FALKORDB_PASSWORD, GH_TOKEN, GITHUB_TOKEN and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind.

$vet-skills run --net declared -- npx -y @cavdax/mcp-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-13 and scored it 84/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 26 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
6.2sprocessdependency install exit 0
26sclaimed10 tools: apply_code_change, revalidate_decision, check_intent_clearance, acquire_decision_lock, release_decision_lock, query_causal_graph, export_graph_image, list_active_decisions, explain_blast_radius, explain_architectural_impact
26stools01b975122709862d
26stools00f1aabe62a86294
26stools35c2428c63fe1fd2
26stoolse4a6f8e8773e4cc1
26stoolsb2dc5bdcda57daba
26stools32aab874b511ee81
26stoolsa08b5da2a6a3ba7d
26stools95f0c34b75f0ed0b
26stoolsa04bf975fd1c60fe
26stools4f853c984f8c7fd5
26sprocessscript backend runs setup only
26sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathssrc/checkCommand.js:32 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'.yaml', '.yml', '.toml', '.ini', '.env',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathscore/mcp/server.js:309 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileserror: 'Access denied: git internals, .env files and .github/ workflow files cannot be modified through the gate.'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagebin/cavdax.js:8 · npx invocation of non-well-known package — may execute untrusted code* npx cavdax mcp -> Launches stdio MCP server for Cursor / ClaudeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathscore/mcp/server.js:52 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif (segments.some((s) => s === '.env' || s.startsWith('.env.'))) return true;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/stdioServer.js:292 · npx invocation of non-well-known package — may execute untrusted code'Start FalkorDB (docker run -d -p 6379:6379 falkordb/falkordb:latest) and run "npx cavdax doctor".',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/impactCommand.js:7 · npx invocation of non-well-known package — may execute untrusted codeconsole.log('Usage: npx cavdax impact <node-id> (e.g. npx cavdax impact DEC-101)\n');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/initCommand.js:104 · npx invocation of non-well-known package — may execute untrusted codelog(` Run: claude mcp add cavdax -- npx -y @cavdax/mcp-server@latest mcp\n`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/doctorCommand.js:4 · npx invocation of non-well-known package — may execute untrusted code* npx cavdax doctorFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/initCommand.js:108 · npx invocation of non-well-known package — may execute untrusted codelog(` Run: npx cavdax doctor\n`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/checkCommand.js:12 · npx invocation of non-well-known package — may execute untrusted code* - CAVDAX CI Gate: `npx cavdax gate --sha <sha>`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/simulation.js:5 · npx invocation of non-well-known package — may execute untrusted code* with `npx @cavdax/mcp-server` and no Docker. It is NOT a substitute for theFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/decisionsCommand.js:26 · npx invocation of non-well-known package — may execute untrusted codeconsole.log('\nUse "npx cavdax blast <id>" to inspect downstream blast radius of any decision.\n');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/doctorCommand.js:43 · npx invocation of non-well-known package — may execute untrusted codeconsole.log(`${PASS} Graph '${cfg.graphName}' query OK: ${count} node(s)${count === 0 ? ' (run "npx cavdax ingest" in your repo)' : ''}`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/initCommand.js:110 · npx invocation of non-well-known package — may execute untrusted codelog(` Run: npx cavdax ingest --type adr --repo .\n`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/cavdax.js:11 · npx invocation of non-well-known package — may execute untrusted code* npx cavdax gate -> Enforces PR / commit architectural invariants in CIFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/initCommand.js:48 · npx invocation of non-well-known package — may execute untrusted code4. Pre-commit hooks run \`npx cavdax check --staged\` to verify causal provenance.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/cavdax.js:12 · npx invocation of non-well-known package — may execute untrusted code* npx cavdax doctor -> Runs connectivity and health checksFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/simulation.js:19 · npx invocation of non-well-known package — may execute untrusted code'Start FalkorDB and run "npx cavdax ingest" for real enforcement.';Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/ingestCommand.js:4 · npx invocation of non-well-known package — may execute untrusted code* npx cavdax ingest [--type <type>] [--repo <path>] [--host <host>] [--port <port>]Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/checkCommand.js:10 · npx invocation of non-well-known package — may execute untrusted code* - git pre-commit hooks: `npx cavdax check --staged`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/gateCommand.js:4 · npx invocation of non-well-known package — may execute untrusted code* npx @cavdax/mcp-server gate --repo=<owner/repo> --sha=<commit_sha> [--strict]Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/checkCommand.js:4 · npx invocation of non-well-known package — may execute untrusted code* npx cavdax check [--staged] [--pr <number>]Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/cavdax.js:10 · npx invocation of non-well-known package — may execute untrusted code* npx cavdax check -> Validates staged files against causal graphFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/cavdax.js:9 · npx invocation of non-well-known package — may execute untrusted code* npx cavdax ingest -> Ingests local ADRs and git history into FalkorDBFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/checkCommand.js:11 · npx invocation of non-well-known package — may execute untrusted code* - GitHub Actions CI: `npx cavdax check --pr ${{ github.event.pull_request.number }}`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/checkCommand.js:288 · npx invocation of non-well-known package — may execute untrusted codeconsole.log(' Usage: npx cavdax check --staged OR npx cavdax check --pr <number>');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈57 tok
1 file · 24 in bundle
Tool list per prompt
≈1,424 tok
10 tools · 142 per tool
Handshake
295 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 139

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @cavdax/mcp-server@1.3.3 as of 24 h ago. This is the package itself, not its dependencies.