Skills/npm/mcp-server

mcp-server@4.12.0

CAUTION

Publisher claims: "MCP server for interacting with Runpod API" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher runpod · publishing for 368 daysInstalls 48,863Last detonated 39 h ago
What would fix thisWatchDispute verdict

Coverage

Started with a decoy RUNPOD_API_KEY; tool list observed. Tool calls with a real credential not tested.
Tested
server startup with a tagged decoy in RUNPOD_API_KEY · MCP initialize and tools/list · every tool description, for hidden instructions · where the decoy credential went · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with a real credential
Needs
RUNPOD_API_KEY — give it to the server where it runs, through vet-skills run --secrets, so the value never enters the server's environment. Never paste a credential into a chat, a ticket or a report.

Before you give it your token

It will ask for
ALP_SINK_SECRETAPI_KEYS_URLMCP_SKIP_CREDENTIAL_CHECKPOSTHOG_API_KEYRUNPOD_API_KEYRUNPOD_ASSISTANT_API_KEYRUNPOD_AUTHED_GRAPHQL_URLConfiguration, not credentials: ALP_SINK_URL, CLAUDE_CONFIG_DIR, ID_PATTERN, KNOWLEDGE_HIDDEN_RULES, KNOWLEDGE_SEARCH_URL, MCP_ANALYTICS_SALT, MCP_REQUEST_LOG_SAMPLE_RATE, MCP_SCHEMA_VALIDATION, MCP_VERBOSE_LOGS, PI_CODING_AGENT_DIR, POSTHOG_HOST, RUNPOD_API_BASE_URL, RUNPOD_MCP_URL, RUNPOD_PUBLIC_GRAPHQL_URL, RUNPOD_SERVERLESS_API_URL, VERCEL
Where it talks to
runpod.io, runpod.ai (its own)Also posthog.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
what the tools do when called with a real credential

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names posthog.com as well as its own vendor. The guard injects ALP_SINK_SECRET, API_KEYS_URL, MCP_SKIP_CREDENTIAL_CHECK, POSTHOG_API_KEY, RUNPOD_API_KEY, RUNPOD_ASSISTANT_API_KEY, RUNPOD_AUTHED_GRAPHQL_URL only into requests to runpod.io (and its subdomains) and refuses the rest.

$vet-skills run --secrets ALP_SINK_SECRET=runpod.io,API_KEYS_URL=runpod.io,MCP_SKIP_CREDENTIAL_CHECK=runpod.io,POSTHOG_API_KEY=runpod.io,RUNPOD_API_KEY=runpod.io,RUNPOD_ASSISTANT_API_KEY=runpod.io,RUNPOD_AUTHED_GRAPHQL_URL=runpod.io -- npx -y @runpod/mcp-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-12 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Credential pass-through configuration; References a credential file in the home directory; References a credential file in the home directory. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 54 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
14sprocessdependency install exit 0
34sprocessrelaunched with a decoy RUNPOD_API_KEY (tagged; nothing real)
54sclaimed120 tools with a decoy RUNPOD_API_KEY: list-endpoints, list-templates, run-endpoint, runsync-endpoint, get-job-status, stream-job, cancel-job, retry-job, endpoint-health, purge-endpoint-queue, stream-pod-logs, stream-worker-logs, get-capacity, list-hub-repos, deploy-hub-repo, set-endpoint-gpus, list-public-endpoints, list-guides, read-guide, lookup-concept, search-concepts, search-docs, describe-tool, add-organization-group-member, attach-cost-center-resource
54sprocessscript backend runs setup only
54sprocessno install scripts to re-run

Static findings

MEDIUM
Unicode escape sequence detecteddist/chunk-LVRT6ZRI.mjs:1383 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Credential pass-through configurationdist/hosted.cjs:10216 · Credential pass-through configuration — agent relays sensitive credentialsthrow new Error("runpod: API key required (set RUNPOD_API_KEY or pass apiKey)");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Unicode escape sequence detecteddist/chunk-LVRT6ZRI.mjs:6121 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-LVRT6ZRI.mjs:2828 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "^[^\\x00]*[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000\\x00][^\\x00]*$"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/hosted.cjs:1660 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/chunk-LVRT6ZRI.mjs:1615 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
References a credential file in the home directorydist/http.cjs:6776 · References a credential file in the home directory…y is an authorized_keys-style line: `<type> <base64-key> [comment]`, e.g. from `~/.ssh/id_ed25519.pub`. Send `[]` to remove all keys.", examples: [ …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Unicode escape sequence detecteddist/hosted.cjs:1538 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
References a credential file in the home directorydist/stdio.cjs:7851 · References a credential file in the home directory…y is an authorized_keys-style line: `<type> <base64-key> [comment]`, e.g. from `~/.ssh/id_ed25519.pub`. Send `[]` to remove all keys.", examples: [ …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Credential pass-through configurationdist/http.cjs:10213 · Credential pass-through configuration — agent relays sensitive credentialsthrow new Error("runpod: API key required (set RUNPOD_API_KEY or pass apiKey)");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathsdist/chunk-LVRT6ZRI.mjs:6734 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…y is an authorized_keys-style line: `<type> <base64-key> [comment]`, e.g. from `~/.ssh/id_ed25519.pub`. Send `[]` to remove all keys.", examples: [ …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
References a credential file in the home directorydist/chunk-LVRT6ZRI.mjs:6734 · References a credential file in the home directory…y is an authorized_keys-style line: `<type> <base64-key> [comment]`, e.g. from `~/.ssh/id_ed25519.pub`. Send `[]` to remove all keys.", examples: [ …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
References a credential file in the home directorydist/hosted.cjs:6779 · References a credential file in the home directory…y is an authorized_keys-style line: `<type> <base64-key> [comment]`, e.g. from `~/.ssh/id_ed25519.pub`. Send `[]` to remove all keys.", examples: [ …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Unicode escape sequence detecteddist/hosted.cjs:1428 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathsdist/http.cjs:6776 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…y is an authorized_keys-style line: `<type> <base64-key> [comment]`, e.g. from `~/.ssh/id_ed25519.pub`. Send `[]` to remove all keys.", examples: [ …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Unicode escape sequence detecteddist/chunk-LVRT6ZRI.mjs:1493 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Credential pass-through configurationdist/stdio.cjs:11267 · Credential pass-through configuration — agent relays sensitive credentialsthrow new Error("runpod: API key required (set RUNPOD_API_KEY or pass apiKey)");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathsdist/stdio.mjs:6686 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…y is an authorized_keys-style line: `<type> <base64-key> [comment]`, e.g. from `~/.ssh/id_ed25519.pub`. Send `[]` to remove all keys.", examples: [ …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configurationdist/stdio.mjs:10099 · Credential pass-through configuration — agent relays sensitive credentialsthrow new Error("runpod: API key required (set RUNPOD_API_KEY or pass apiKey)");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathsdist/stdio.cjs:7851 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…y is an authorized_keys-style line: `<type> <base64-key> [comment]`, e.g. from `~/.ssh/id_ed25519.pub`. Send `[]` to remove all keys.", examples: [ …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configurationdist/chunk-LVRT6ZRI.mjs:9996 · Credential pass-through configuration — agent relays sensitive credentialsthrow new Error("runpod: API key required (set RUNPOD_API_KEY or pass apiKey)");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
File type combined with upload actiondist/chunk-LVRT6ZRI.mjs:11662 · File type combined with upload action — agent may exfiltrate local data files…xpose, use the machine-readable OpenAPI spec at https://api.runpod.io/v2/openapi.json or the API reference at https://docs.runpod.io/api-reference-v2/overview. Prefer the MCP tools for reads because their results redact secret environment …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsdist/hosted.cjs:6779 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…y is an authorized_keys-style line: `<type> <base64-key> [comment]`, e.g. from `~/.ssh/id_ed25519.pub`. Send `[]` to remove all keys.", examples: [ …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
References a credential file in the home directorydist/stdio.mjs:6686 · References a credential file in the home directory…y is an authorized_keys-style line: `<type> <base64-key> [comment]`, e.g. from `~/.ssh/id_ed25519.pub`. Send `[]` to remove all keys.", examples: [ …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
File type combined with upload actiondist/stdio.mjs:11925 · File type combined with upload action — agent may exfiltrate local data files…xpose, use the machine-readable OpenAPI spec at https://api.runpod.io/v2/openapi.json or the API reference at https://docs.runpod.io/api-reference-v2/overview. Prefer the MCP tools for reads because their results redact secret environment …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detecteddist/stdio.mjs:1567 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
npx invocation of non-well-known packagedist/wizard-NVV3UNOG.mjs:834 · npx invocation of non-well-known package — may execute untrusted code" npx @runpod/mcp-server@latest add --client <ids> no prompts: configure these clients",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/stdio.cjs:1149 · npx invocation of non-well-known package — may execute untrusted codeTo run it without prompts, name the clients: npx @runpod/mcp-server@latest ${subcommand2} --client <ids>Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Unicode escape sequence detecteddist/http.cjs:1535 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
npx invocation of non-well-known packagedist/stdio.cjs:897 · npx invocation of non-well-known package — may execute untrusted code" npx @runpod/mcp-server@latest add --list list clients, whether each is detected, and its config file",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/stdio.cjs:896 · npx invocation of non-well-known package — may execute untrusted code" npx @runpod/mcp-server@latest remove --client <ids> no prompts: remove Runpod from them",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Unicode escape sequence detecteddist/stdio.mjs:2780 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "^[^\\x00]*[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000\\x00][^\\x00]*$"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
npx invocation of non-well-known packagedist/stdio.cjs:895 · npx invocation of non-well-known package — may execute untrusted code" npx @runpod/mcp-server@latest add --client <ids> no prompts: configure these clients",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/wizard-NVV3UNOG.mjs:836 · npx invocation of non-well-known package — may execute untrusted code" npx @runpod/mcp-server@latest add --list list clients, whether each is detected, and its config file",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Unicode escape sequence detecteddist/stdio.cjs:2732 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/stdio.mjs:6073 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/stdio.cjs:2610 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actiondist/http.cjs:11787 · File type combined with upload action — agent may exfiltrate local data files…xpose, use the machine-readable OpenAPI spec at https://api.runpod.io/v2/openapi.json or the API reference at https://docs.runpod.io/api-reference-v2/overview. Prefer the MCP tools for reads because their results redact secret environment …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/wizard-NVV3UNOG.mjs:833 · npx invocation of non-well-known package — may execute untrusted code" npx @runpod/mcp-server@latest add interactive setup (needs a terminal)",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/stdio.cjs:894 · npx invocation of non-well-known package — may execute untrusted code" npx @runpod/mcp-server@latest add interactive setup (needs a terminal)",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Unicode escape sequence detecteddist/stdio.cjs:2500 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/stdio.cjs:7238 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
npx invocation of non-well-known packagedist/wizard-NVV3UNOG.mjs:1085 · npx invocation of non-well-known package — may execute untrusted codeTo run it without prompts, name the clients: npx @runpod/mcp-server@latest ${subcommand} --client <ids>Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/stdio.mjs:12252 · npx invocation of non-well-known package — may execute untrusted code" RUNPOD_API_KEY=<key> npx @runpod/mcp-server@latest run the MCP server over stdio",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/hosted.cjs:11880 · File type combined with upload action — agent may exfiltrate local data files…xpose, use the machine-readable OpenAPI spec at https://api.runpod.io/v2/openapi.json or the API reference at https://docs.runpod.io/api-reference-v2/overview. Prefer the MCP tools for reads because their results redact secret environment …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detecteddist/http.cjs:1657 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/stdio.mjs:1335 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/hosted.cjs:6166 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/http.cjs:1425 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/http.cjs:6163 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
npx invocation of non-well-known packagedist/stdio.mjs:12254 · npx invocation of non-well-known package — may execute untrusted code" npx @runpod/mcp-server@latest remove --client <ids> remove Runpod from your agents"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Unicode escape sequence detecteddist/stdio.cjs:3945 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "^[^\\x00]*[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000\\x00][^\\x00]*$"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
npx invocation of non-well-known packagedist/stdio.mjs:12253 · npx invocation of non-well-known package — may execute untrusted code" npx @runpod/mcp-server@latest add [--client <ids>] configure your agents (see add --help)",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Unicode escape sequence detecteddist/hosted.cjs:2873 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "^[^\\x00]*[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000\\x00][^\\x00]*$"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detecteddist/stdio.mjs:1445 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actiondist/stdio.cjs:13092 · File type combined with upload action — agent may exfiltrate local data files…xpose, use the machine-readable OpenAPI spec at https://api.runpod.io/v2/openapi.json or the API reference at https://docs.runpod.io/api-reference-v2/overview. Prefer the MCP tools for reads because their results redact secret environment …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detecteddist/http.cjs:2870 · Unicode escape sequence detected — may contain obfuscated payloadspattern: "^[^\\x00]*[^\\t-\\r \x85\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000\\x00][^\\x00]*$"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
npx invocation of non-well-known packagedist/wizard-NVV3UNOG.mjs:835 · npx invocation of non-well-known package — may execute untrusted code" npx @runpod/mcp-server@latest remove --client <ids> no prompts: remove Runpod from them",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈48 tok
1 file · 29 in bundle
Tool list per prompt
≈29,396 tok
120 tools · 245 per tool
Handshake
3783 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 401

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @runpod/mcp-server@4.12.0 as of 38 h ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim runpod: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. References a credential file in the home directory≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Unicode escape sequence detected≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim runpodPropose a patch to the maintainer