mcp-server@1.57.0
VERIFIEDPublisher claims: "MCP server for OmniSocials API - manage social media posts, media, accounts, analytics, webhooks, inbox, and ads" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher omnisocials · publishing for 251 daysInstalls 3,343Last detonated 5d ago
Coverage
Started with a decoy OMNISOCIALS_API_KEY; tool list observed. Tool calls with a real credential not tested.- Tested
- server startup with a tagged decoy in OMNISOCIALS_API_KEY · MCP initialize and tools/list · every tool description, for hidden instructions · where the decoy credential went · every file read, file written and host contacted by what ran
- Not tested
- what the tools do when called with a real credential
- Needs
- OMNISOCIALS_API_KEY — give it to the server where it runs, through vet-skills run --secrets, so the value never enters the server's environment. Never paste a credential into a chat, a ticket or a report.
Before you give it your token
- It will ask for
OMNISOCIALS_API_KEYConfiguration, not credentials: OMNISOCIALS_BASE_URL- Where it talks to
- omnisocials.com (its own)Also pinterest.com, google.com — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- what the tools do when called with a real credential
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names pinterest.com, google.com as well as its own vendor. The guard injects OMNISOCIALS_API_KEY only into requests to omnisocials.com (and its subdomains) and refuses the rest.
$vet-skills run --secrets OMNISOCIALS_API_KEY=omnisocials.com -- npx -y @omnisocials/mcp-server
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-09 and scored it 87/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 44 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
4.1sprocessdependency install exit 0
24sprocessrelaunched with a decoy OMNISOCIALS_API_KEY (tagged; nothing real)
44sclaimed122 tools with a decoy OMNISOCIALS_API_KEY: list_posts, get_post, create_post, create_and_publish_post, update_post, delete_post, publish_post, retry_post, list_approval_workflows, approve_post, reject_post, get_post_approval, search_locations, list_pinterest_products, search_instagram_audio, get_recent_platform_posts, list_media, upload_media, check_media_compatibility, update_media, list_folders, create_folder, list_accounts, get_account, set_x_statistics
44sprocessscript backend runs setup only
44sprocessno install scripts to re-run
Static findings
HIGH
Tool description instructs the agent: credential exfiltration instructionmcp:tools/list_accounts:1 · Instruction aimed at the agent: credential exfiltration instruction
AST01create_post), supported content_types (post, story, reel), and `needs_reconnect` (true when the OAuth token has been revoked/expired and the user must reconnectFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/activate_ad_campaign:1 · Instruction aimed at the agent: "do not tell the user"
AST01ad_draft answers with the draft's page. Never tell the user the campaign started because of this call. ADS HERE ARE DRFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/create_post:53 · Instruction aimed at the agent: "do not tell the user"
AST01a link to https://app.omnisocials.com. Do NOT tell the user it's impossible — always save the draft so their caption isFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/boost_post_multi:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/boost_post:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "without asking the user"mcp:tools/activate_ad_campaigns_multi:4 · Instruction aimed at the agent: "without asking the user"
AST01nt. Never fill it in from campaign data without asking the user."}},"required":["campaign_ids","confirm_budget_amount"]}Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/set_ad_object_budget:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/activate_ad_object:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/undo_ad_rule_change:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/create_ad_draft:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "without asking the user"mcp:tools/activate_ad_campaign:4 · Instruction aimed at the agent: "without asking the user"
AST01Never fill it in from the campaign data without asking the user."}},"required":["id","confirm_budget_amount"]}Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/plan_budget_increase:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/reserve_reach_frequency:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/activate_campaign_ad:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/activate_ad_campaigns_multi:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/launch_ad_draft:1 · Instruction aimed at the agent: "do not tell the user"
AST01and starts it. Give the user that link. Never tell the user the ad started because of this call; the answer says per neFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/resume_ad_campaigns_multi:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/update_ad_rule:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/update_ad_draft:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/create_ad_rule:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/set_ad_account_spend_cap:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.Cost to the agent
Instructions loaded
≈67 tok
1 file · 41 in bundle
Tool list per prompt
≈103,272 tok
122 tools · 846 per tool
Handshake
5983 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 884
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for @omnisocials/mcp-server@1.57.0 as of 5d ago. This is the package itself, not its dependencies.