Skills/npm/mcp-server

mcp-server@5.1.54

VERIFIED· startup only

Publisher claims: "Didit MCP Server - AI agent integration for identity verification APIs" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher didit-protocol · publishing for 259 daysInstalls 1,063Last detonated 20 h ago
$claude mcp add mcp-server -- npx -y @didit-protocol/mcp-server
WatchReport an issue

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
DIDIT_ACCESS_TOKENDIDIT_AUTH_BASE_URLDIDIT_AUTH_ISSUERDIDIT_MCP_CREDENTIALS_FILEDIDIT_OIDC_AUTHORIZE_URLDIDIT_OIDC_TOKEN_URLMCP_AUTHORIZATION_SERVER_ORIGINMCP_OAUTH_CLIENT_IDMCP_OAUTH_CLIENT_SECRETMCP_OAUTH_INTROSPECT_URLMCP_TOKEN_VERIFY_MODEMCP_WEBHOOK_POLL_MSConfiguration, not credentials: DIDIT_API_BASE_URL, DIDIT_DEVICE_NAME, DIDIT_DOCS_MCP_URL, DIDIT_JWKS_URL, DIDIT_OIDC_DISCOVERY_URL, DIDIT_OIDC_REGISTRATION_URL, DIDIT_READ_ONLY, DIDIT_TOOLSETS, MCP_DEFAULT_APP, MCP_DEFAULT_ORG, MCP_DEFAULT_TOOLSETS, MCP_INTROSPECTION_CACHE_TTL_MS, MCP_JSON_BODY_LIMIT, MCP_PERMISSION_MODE, MCP_PORT, MCP_PUBLIC_DISCOVERY, MCP_RESOURCE_URI, MCP_SCOPES_SUPPORTED
Where it talks to
didit.me (its own)
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard. It asks for DIDIT_ACCESS_TOKEN, DIDIT_AUTH_BASE_URL, DIDIT_AUTH_ISSUER, DIDIT_MCP_CREDENTIALS_FILE, DIDIT_OIDC_AUTHORIZE_URL, DIDIT_OIDC_TOKEN_URL, MCP_AUTHORIZATION_SERVER_ORIGIN, MCP_OAUTH_CLIENT_ID, MCP_OAUTH_CLIENT_SECRET, MCP_OAUTH_INTROSPECT_URL, MCP_TOKEN_VERIFY_MODE, MCP_WEBHOOK_POLL_MS and talks to didit.me. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --secrets DIDIT_ACCESS_TOKEN=didit.me,DIDIT_AUTH_BASE_URL=didit.me,DIDIT_AUTH_ISSUER=didit.me,DIDIT_MCP_CREDENTIALS_FILE=didit.me,DIDIT_OIDC_AUTHORIZE_URL=didit.me,DIDIT_OIDC_TOKEN_URL=didit.me,MCP_AUTHORIZATION_SERVER_ORIGIN=didit.me,MCP_OAUTH_CLIENT_ID=didit.me,MCP_OAUTH_CLIENT_SECRET=didit.me,MCP_OAUTH_INTROSPECT_URL=didit.me,MCP_TOKEN_VERIFY_MODE=didit.me,MCP_WEBHOOK_POLL_MS=didit.me -- npx -y @didit-protocol/mcp-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-13 and scored it 86/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 29 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
8.3sprocessdependency install exit 0
28sclaimedstartup only: exited (0) before answering · '/tmp/ks-detonate-KhkQ5r/task/home/work/acme-api/.claude/skills/mcp-server/dist/index.js' ] } Node.js v22.23.5
28sprocessscript backend runs setup only
28sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsdist/security.js:137 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* magic-bytes allow-list (a `.env` would also fail the sniff). MatchedFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Refusal suppressionREADME.md:808 · Refusal suppression — attempting to prevent safety responses · informational: not an instruction file…eps a user whose sign-in failed on the wallet step to try again: the session is never declined for it and no document is offered. | | `minimum_age` | integer \| null | integ…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsdist/tools/members.js:94 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileshint: "Say which application the key is for and where you will store it (a secret manager or the project's .env, never committed).",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/tools/members.js:124 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesnext_steps: "Store api_key now in the project's secret store or .env (never commit it, never repeat it in the chat): it is " +Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/index.js:3644 · npx invocation of non-well-known package — may execute untrusted code…ted connector - authentication is handled by OAuth. Use the local stdio server (npx @didit-protocol/mcp-server) for account setup.` }], isError: true, }; …Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/index.js:3661 · npx invocation of non-well-known package — may execute untrusted codetext: `Tool '${name}' is not available to a remote connector. Copy the API key from the application's page in the Didit console, or use the local stdio server (npx @didit-protocol/mcp-server).`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/security.js:141 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env", ".env.local", ".env.development", ".env.production", ".env.test",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/index.js:3226 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"ONCE: write it straight to the project's secret store or .env and never repeat it in the chat. Pick the " +Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/security.d.ts:54 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* (so `.env`, `package.json`, source, archives, executables can never be read).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈57 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @didit-protocol/mcp-server@5.1.54 as of 20 h ago. This is the package itself, not its dependencies.