mcp-teams@0.3.70
VERIFIED· startup onlyPublisher claims: "MCP server that lets AI assistants work with Microsoft Teams (web) through a Chrome/Edge extension bridge" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher heeyuncho · publishing for 35 daysInstalls 13,877Last detonated 32 h ago
Coverage
Startup only; authenticated tool behavior not tested.- Tested
- server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
- Not tested
- the tool list (the server exited before answering) · what the tools do when called with real credentials
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
- no credential variables read in the code
- Where it talks to
- no vendor host named in the codeAlso cloud.microsoft, microsoft.com, office.com, cursor.invalid — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- the tool list (the server exited before answering) · what the tools do when called with real credentials
Connect it under the guard. Startup only; authenticated tool behavior not tested. The code names no credential variable; the guard pins the network to what the honeypot saw and logs every call.
$vet-skills run --net declared -- npx -y mcp-teams
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-13 and scored it 81/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 34 s · 2 scenariost+CategoryObserved action
0.0sprocessno install scripts in bundle
13sprocessdependency install exit 0
33sfilesystemread ~/.mcp-teams/extension/manifest.json outside project
33sfilesystemwrote ~/.mcp-teams/server.log · ~/.mcp-teams/config.json
33sclaimedstartup only: exited (0) before answering · code: 'ENOENT', syscall: 'open', path: '/tmp/ks-detonate-a3aXz8/task/home/work/acme-api/.claude/skills/mcp-teams/extension/icons/icon.svg' }
33sprocessscript backend runs setup only
33sprocessno install scripts to re-run
Static findings
LOW
Authorization escalation languageREADME.md:122 · Authorization escalation language · informational: not an instruction file
AST01- It opens the Extensions page of Chrome and/or Edge, and that folder. The one manual step is in the browser you use Teams in: turn on *Developer mode* and click *Load unpacked* on the folder.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
npx invocation of non-well-known packagedist/index.js:45 · npx invocation of non-well-known package — may execute untrusted code
AST06// release (npx fetches it on start) updates the installed folder, never downgrading it (anFix: Pin versions and sources; vendor anything fetched at install time.LOW
Prompt injectionREADME.md:122 · Prompt injection — known jailbreak technique reference · informational: not an instruction file
AST01- It opens the Extensions page of Chrome and/or Edge, and that folder. The one manual step is in the browser you use Teams in: turn on *Developer mode* and click *Load unpacked* on the folder.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
npx invocation of non-well-known packagedist/setup.js:46 · npx invocation of non-well-known package — may execute untrusted code
AST06/** The package from npm, always the latest release (npx keeps it cached). */Fix: Pin versions and sources; vendor anything fetched at install time.LOW
Collapsed <details> block carrying instructionsextension/popup.html:24 · Collapsed <details> block carrying instructions · informational: not an instruction file
AST01<summary class="muted">Advanced</summary> <div class="row"> <label for="token">Pairing token (only for a copy not loaded from the folder setup shows)</label> <iFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
npx invocation of non-well-known packagedist/nativehost.js:259 · npx invocation of non-well-known package — may execute untrusted code
AST06hint: `${why.join("; ")}, so the browser can't start it and the extension uses the local port. Run \`npx mcp-teams setup\` again.`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/bridge.js:1194 · npx invocation of non-well-known package — may execute untrusted code
AST06this.listenError = "The mcp-teams native host on the hub socket rejected this server's token (run `npx mcp-teams setup` again).";Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/nativehost.js:249 · npx invocation of non-well-known package — may execute untrusted code
AST06...(hubMissing.length ? [`The native host runs ${hubMissing.join(" and ")}, which no longer exists (an npx cache cleared, or the copy moved)`] : []),Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actiondist/setup.js:190 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log("AI apps on this computer:");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagedist/setup.js:49 · npx invocation of non-well-known package — may execute untrusted code
AST06* How AI apps start this server. Installed from npm (`npx mcp-teams setup`, or aFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commanddist/bridge.js:96 · Process kill command — agent can terminate processes
AST05* The AI app may kill the process soon after, so this stays short, and is not made longer for aFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packageextension/background.js:2248 · npx invocation of non-well-known package — may execute untrusted code
AST06const noPairing = "This copy of the extension has no pairing file. Run `npx mcp-teams setup` and load the extension from the folder it shows.";Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageextension/background.js:2344 · npx invocation of non-well-known package — may execute untrusted code
AST06lastError = "The MCP server refused this extension. Run `npx mcp-teams setup` and load the extension from the folder it shows.";Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/bridge.js:81 · npx invocation of non-well-known package — may execute untrusted code
AST06…h reload_extension (it loads the version mcp-teams put in its folder), or run \`npx mcp-teams setup\` if it was loaded from another folder, then send again.`, }); /** True w…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/nativehost.js:242 · npx invocation of non-well-known package — may execute untrusted code
AST06return { registered, hint: "The native host isn't registered with any browser, so the extension uses the local port. Run `npx mcp-teams setup` to register it." };Fix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Instructions loaded
≈61 tok
1 file · 29 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for mcp-teams@0.3.70 as of 30 h ago. This is the package itself, not its dependencies.