mcp-server@1.57.1
VERIFIEDPublisher claims: "MCP server for OmniSocials API - manage social media posts, media, accounts, analytics, webhooks, inbox, and ads" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher omnisocials · publishing for 252 daysInstalls 4,224Last detonated 13 min ago
Coverage
Started with a decoy OMNISOCIALS_API_KEY; tool list observed. Tool calls with a real credential not tested.- Tested
- server startup with a tagged decoy in OMNISOCIALS_API_KEY · MCP initialize and tools/list · every tool description, for hidden instructions · where the decoy credential went · every file read, file written and host contacted by what ran
- Not tested
- what the tools do when called with a real credential
- Needs
- OMNISOCIALS_API_KEY — give it to the server where it runs, through vet-skills run --secrets, so the value never enters the server's environment. Never paste a credential into a chat, a ticket or a report.
Before you give it your token
- It will ask for
OMNISOCIALS_API_KEYConfiguration, not credentials: OMNISOCIALS_BASE_URL- Where it talks to
- omnisocials.com (its own)Also pinterest.com, google.com — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- what the tools do when called with a real credential
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names pinterest.com, google.com as well as its own vendor. The guard injects OMNISOCIALS_API_KEY only into requests to omnisocials.com (and its subdomains) and refuses the rest.
$vet-skills run --secrets OMNISOCIALS_API_KEY=omnisocials.com -- npx -y @omnisocials/mcp-server
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-15 and scored it 87/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 48 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
8.1sprocessdependency install exit 0
28sprocessrelaunched with a decoy OMNISOCIALS_API_KEY (tagged; nothing real)
48sclaimed122 tools with a decoy OMNISOCIALS_API_KEY: list_posts, get_post, create_post, create_and_publish_post, update_post, delete_post, publish_post, retry_post, list_approval_workflows, approve_post, reject_post, get_post_approval, search_locations, list_pinterest_products, search_instagram_audio, get_recent_platform_posts, list_media, upload_media, check_media_compatibility, update_media, list_folders, create_folder, list_accounts, get_account, set_x_statistics
48stoolsa1bd3dcb8984a9fa
48stoolsa4767d83b8e69fd2
48stools9f28133998a81619
48stools49fb231646d468ec
48stools75921e613bf0177a
48stoolsf5fe22eea09f551b
48stools67e66d41db915362
48stoolsf29e119f663ffca0
48stools48f34324d4d1f252
48stools8347f52787a79a27
48stools708eedd4cb28da45
48stoolsf7a3ad4c60f6c8b9
48stoolsf9ab6ee5244f4e0e
48stoolsc4d301f3d0b8eaf2
48stools084bd195b22066a1
48stoolsda1fccf9c85efd80
48stools268d5a8fba38d697
48stoolsa4c9f6e485473a78
48stools3a8511b76ab1b3a1
48stools962c74047a7725ee
48stoolsa47e94e19e0d2c11
48stools721c3e18260ac0d6
48stoolsdd60b67b97d876c4
48stoolsff9aa83c259c993f
48stools68cae6eb2e69701d
48stools61855cc6f35fcff4
48stools69281c9f77680bd9
48stools2e943597b47cf854
48stoolse9c326558d11af60
48stools1e7f2c57b4414cfa
48stoolsd74d5c9df1348009
48stools2fe5671ef91d265b
48stools22cac8a55a6df8e5
48stools0954236826506fcf
48stoolsf6b697eb28cdbf80
48stools4a18d806346018c9
48stoolsb6a7010ff2f02ea1
48stools4300b559778ec30c
48stoolscb70fd4cecda5cec
48stoolsbf484c59cf36e07e
48stools546be1d092e176e7
48stoolse7ea356652f89b38
48stoolsefb8e1dc11a40e11
48stoolsc425224f272cd52e
48stoolsa08a051ddce796b3
48stools4b59ab0a4f81a102
48stools4b6741290c95ee0c
48stoolsa13191d36ad5c867
48stools461754b5678275be
48stoolsf83edc6e7a3f991c
48stools312d4f60e12b0413
48stools1bfd045b83fef582
48stools7520ebefd01de217
48stools5a1e817f97631ac5
48stools46c90a38ae4af835
48stoolse791bbd390651345
48stools4c707e3aa54465fa
48stools4509159fd779f482
48stoolsaddc51b5e59c5c0b
48stoolsd7d5f4c639b5c0b3
48stoolsf2b75f1b91788e2e
48stools11831dd3d45c32b5
48stoolsbad8fc5f79052f11
48stools433f152a793b4855
48stools7dc9df9d438a56ed
48stools6b5d48be8b9b11df
48stoolse1950e07815b4c26
48stoolsb0f01556230b86c1
48stoolsb6f85cdc563f07df
48stoolsed579857973d7607
48stools9c8df2224b53bc74
48stools3843f62dac1dd4c2
48stoolsd439b93d8bd86b2e
48stools350da2e5358f16c4
48stoolse03ff3a47185b155
48stools9093a086c477f060
48stoolsdb3ce6836cfe6652
48stools3d9db5ed54745eca
48stools68ed25e74750cff8
48stools3a7f778cd3f67035
48sprocessscript backend runs setup only
48sprocessno install scripts to re-run
Static findings
HIGH
Tool description instructs the agent: credential exfiltration instructionmcp:tools/list_accounts:1 · Instruction aimed at the agent: credential exfiltration instruction
AST01create_post), supported content_types (post, story, reel), and `needs_reconnect` (true when the OAuth token has been revoked/expired and the user must reconnectFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/create_post:53 · Instruction aimed at the agent: "do not tell the user"
AST01a link to https://app.omnisocials.com. Do NOT tell the user it's impossible — always save the draft so their caption isFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "without asking the user"mcp:tools/activate_ad_campaign:4 · Instruction aimed at the agent: "without asking the user"
AST01Never fill it in from the campaign data without asking the user."}},"required":["id","confirm_budget_amount"]}Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "without asking the user"mcp:tools/activate_ad_campaigns_multi:4 · Instruction aimed at the agent: "without asking the user"
AST01nt. Never fill it in from campaign data without asking the user."}},"required":["campaign_ids","confirm_budget_amount"]}Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/launch_ad_draft:1 · Instruction aimed at the agent: "do not tell the user"
AST01and starts it. Give the user that link. Never tell the user the ad started because of this call; the answer says per neFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/create_ad_rule:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/boost_post_multi:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/update_ad_rule:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/update_ad_draft:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/undo_ad_rule_change:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/activate_ad_campaign:1 · Instruction aimed at the agent: "do not tell the user"
AST01ad_draft answers with the draft's page. Never tell the user the campaign started because of this call. ADS HERE ARE DRFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/plan_budget_increase:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/activate_ad_campaigns_multi:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/resume_ad_campaigns_multi:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/boost_post:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/activate_campaign_ad:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/create_ad_draft:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/activate_ad_object:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/set_ad_object_budget:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/set_ad_account_spend_cap:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: "do not tell the user"mcp:tools/reserve_reach_frequency:3 · Instruction aimed at the agent: "do not tell the user"
AST01with the page where the person does it. Never tell the user an ad started, runs or spends more because of a tool call.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.Cost to the agent
Instructions loaded
≈67 tok
1 file · 41 in bundle
Tool list per prompt
≈103,295 tok
122 tools · 847 per tool
Handshake
16828 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 884
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
Not checked against OSV yet; the weekly check has not reached this version.