mcp@0.0.145
VERIFIED· startup onlyPublisher claims: "Tempo MCP server for Claude Code, Codex, Cursor, and any other MCP-compatible host. One server exposing Tempo's issues, docs, comments, agents, scripts, Slack, Linear, and canvas toolsets." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher tempo-ai · publishing for 81 daysInstalls 7,464Last detonated 1 h ago
Coverage
Startup only; authenticated tool behavior not tested.- Tested
- server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
- Not tested
- the tool list (the server exited before answering) · what the tools do when called with real credentials
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
TEMPO_AUTH_URLConfiguration, not credentials: BASE_URL, TEMPO, TEMPO_CONVEX_SITE_URL, TEMPO_CONVEX_URL, TEMPO_LOGIN_SITE_URL, TEMPO_MCP_HOME, TEMPO_MCP_NO_BROWSER, TEMPO_MCP_READONLY, TEMPO_MCP_SIGN_IN_WAIT_MS, TEMPO_MONOREPO_SDK_SOURCE, TEMPO_SDK_RUNTIME_PATH- Where it talks to
- no vendor host named in the codeAlso tempo.invalid, tempo.local, tempo.build, convex.site, convex.cloud — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- the tool list (the server exited before answering) · what the tools do when called with real credentials
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names tempo.invalid, tempo.local, tempo.build, convex.site, convex.cloud as well as its own vendor. The guard injects TEMPO_AUTH_URL only into requests to the host you bind (and its subdomains) and refuses the rest.
$vet-skills run --net declared -- npx -y @tempo-ai/mcp
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-15 and scored it 88/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 42 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
21sprocessdependency install exit 0
41sclaimedstartup only: exited (0) before answering · at onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:680:36) at TracingChannel.tracePromise (node:diagnostics_channel:350:14) at ModuleLoader.import (node:internal/modules/esm/loader:679:21) at defaultImportModuleDynamicallyForModule (node:internal/modules/esm/utils:222:31)
41sprocessscript backend runs setup only
41sprocessno install scripts to re-run
Static findings
MEDIUM
npx invocation of non-well-known packagedist/chunk-DR6BNWZZ.js:1 · npx invocation of non-well-known package — may execute untrusted code
AST06…P\nserver.\n\nGet started (no account needed first):\n claude mcp add tempo -- npx -y @tempo-ai/mcp\n Then use any Tempo tool from Claude Code — the first one that …Fix: Pin versions and sources; vendor anything fetched at install time.LOW
Prompt injectionREADME.md:141 · Prompt injection — known jailbreak technique reference · informational: not an instruction file
AST014. In a chat, enable the connector under **Plus → More → Developer mode**.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.LOW
Authorization escalation languageREADME.md:141 · Authorization escalation language · informational: not an instruction file
AST014. In a chat, enable the connector under **Plus → More → Developer mode**.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Authorization escalation languageREADME.md:137 · Authorization escalation language · informational: not an instruction file
AST01**Advanced settings** → enable **Developer mode**.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
File type combined with upload actiondist/chunk-OB7GTENV.js:1 · File type combined with upload action — agent may exfiltrate local data files
AST07…in(r.homedir(),".tempo")}function authFilePath(){return s.join(tempoHome(),"auth.json")}function logsDir(){return s.join(tempoHome(),"logs")}function logFilePath(e){const t=(new Date).toISOString().slice(0,10);return s.join(logsDir(),`mcp-…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.LOW
Authorization escalation languageREADME.md:144 · Authorization escalation language · informational: not an instruction file
AST01deep-research tools; Developer mode unlocks full tool calling.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
File type combined with upload actiondist/sdk-runtime/node/astro.cjs:17 · File type combined with upload action — agent may exfiltrate local data files
AST07…;if(!e)for(let a=n;;a=(0,re.dirname)(a)){let l=(0,re.join)(a,"tempo/tempo.config.json");if((0,fe.existsSync)(l)){let u=JSON.parse((0,fe.readFileSync)(l,"utf8"));if(a===t||(0,re.resolve)(a,u.apps?.[0]?.appDir??u.appDir??".")===t){n=a;break}…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/sdk-runtime/node/astro.cjs:115 · File type combined with upload action — agent may exfiltrate local data files
AST07…odules/tempo-sdk");return(0,Mr.existsSync)((0,mt.join)(e,".tempo-prebuilt-source.json"))?["canvas","assets"].flatMap(r=>{let n=(0,mt.join)(e,"dist",r,"index.js");return(0,Mr.existsSync)(n)?[{find:new RegExp(`^tempo-sdk/${r}$`),replacement:…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/sdk-runtime/node/core.cjs:95 · File type combined with upload action — agent may exfiltrate local data files
AST07…s",m.packageName)}catch{}if(T===void 0)try{(0,ie.statSync)((0,K.join)(w,"package.json")).isFile()&&(T=w)}catch{}let I=(0,K.dirname)(w);if(I===w)break;w=I}return(0,K.join)(T??p,"node_modules",m.packageName)},"packageWatchTarget"),br=a(m=>m.…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/sdk-runtime/node/core.cjs:152 · File type combined with upload action — agent may exfiltrate local data files
AST07…){let t=(0,Je.dirname)(e);for(;;){if((0,Aa.existsSync)((0,Je.resolve)(t,"package.json")))return t;let r=(0,Je.dirname)(t);if(r===t)return null;t=r}}function eu(e){let t=e.filename??e.file.opts.filename;return t?(0,Je.resolve)(Re(t)):null}f…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/sdk-runtime/node/nuxt.cjs:4 · File type combined with upload action — agent may exfiltrate local data files
AST07…yaml")))return!0;try{return JSON.parse((0,ne.readFileSync)((0,_.join)(t,"package.json"),"utf8"))?.workspaces!=null}catch{return!1}}var ne,_,pt=w(()=>{ne=require("node:fs"),_=require("node:path");a(Le,"resolveAnnotationIdentity");a(cn,"read…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/sdk-runtime/node/core.cjs:34 · File type combined with upload action — agent may exfiltrate local data files
AST07…odules/tempo-sdk");return(0,Rr.existsSync)((0,St.join)(t,".tempo-prebuilt-source.json"))?["canvas","assets"].flatMap(r=>{let n=(0,St.join)(t,"dist",r,"index.js");return(0,Rr.existsSync)(n)?[{find:new RegExp(`^tempo-sdk/${r}$`),replacement:…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.LOW
Prompt injectionREADME.md:137 · Prompt injection — known jailbreak technique reference · informational: not an instruction file
AST01**Advanced settings** → enable **Developer mode**.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
File type combined with upload actiondist/sdk-runtime/browser-runtime.cjs:4 · File type combined with upload action — agent may exfiltrate local data files
AST07…"no-store"});if(S.status===404)V={kind:"missing"};else if(S.ok){let f=Qo(await S.json());f&&(V={kind:"ready",table:f})}}catch{}let $=a.get(c);$?.kind!=="pending"||$.token!==E||(V===null?R(c,p+1):(a.set(c,V),V.kind==="ready"&&j(c)),T())}o(M…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/sdk-runtime/node/astro.cjs:175 · File type combined with upload action — agent may exfiltrate local data files
AST07…s",m.packageName)}catch{}if(T===void 0)try{(0,ae.statSync)((0,G.join)(A,"package.json")).isFile()&&(T=A)}catch{}let I=(0,G.dirname)(A);if(I===A)break;A=I}return(0,G.join)(T??f,"node_modules",m.packageName)},"packageWatchTarget"),ur=c(m=>m.…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.LOW
Prompt injectionREADME.md:143 · Prompt injection — known jailbreak technique reference · informational: not an instruction file
AST01Note: without Developer mode, ChatGPT connectors only run search-styleFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
File type combined with upload actiondist/sdk-runtime/node/astro.cjs:222 · File type combined with upload action — agent may exfiltrate local data files
AST07…larativeCanvasHostRequest");Hc=256,Ai=[".mjs",".js",".mts",".ts",".jsx",".tsx",".json"],jc=1e3;c(_i,"isRelativeImportSpecifier");c(Uc,"barePackageName");c(Vc,"resolvedIdMatchesFile");c(Ri,"resolveCanonicalRoot");c(Wc,"hasRootMetaTag");c(Bc…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.LOW
Authorization escalation languageREADME.md:143 · Authorization escalation language · informational: not an instruction file
AST01Note: without Developer mode, ChatGPT connectors only run search-styleFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
File type combined with upload actiondist/sdk-runtime/node/vue.cjs:16 · File type combined with upload action — agent may exfiltrate local data files
AST07…rname)(r))}}function Mr(n){let e;try{e=(0,oe.readFileSync)((0,Q.join)(n,"package.json"),"utf8")}catch{return}try{let t=JSON.parse(e);return t&&typeof t=="object"?t:null}catch{return null}}var oe,Q,_t,Lr,Lt=w(()=>{oe=require("node:fs"),Q=re…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagedist/token-ARFG52GQ.js:1 · npx invocation of non-well-known package — may execute untrusted code
AST06…herever a browser login is impossible."),0):(console.error("Not signed in. Run `npx -y @tempo-ai/mcp login` first."),1)}finally{a()}}async function runTokenList(){awa…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/chunk-OB7GTENV.js:1 · npx invocation of non-well-known package — may execute untrusted code
AST06…ew Error("Not signed in to Tempo. Retry the tool to get a sign-in link, or run `npx -y @tempo-ai/mcp login`.");if(t.expiresAt-Date.now()<3e4){const t=await e.refreshN…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actiondist/sdk-runtime/node/astro.cjs:64 · File type combined with upload action — agent may exfiltrate local data files
AST07…e,r,n=[]){let o=Array.isArray(e)?e:[e],i=Bn(t,o,r,n),s=i,a=(0,ne.join)(r,"routes.json"),l=(0,ne.join)(r,"storyboards.astro"),u=c(h=>JSON.stringify(h.map(({path:y,file:x})=>({path:y,file:x.replaceAll("\\","/")}))),"shape"),p=new Set,d=c(h=>…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.LOW
Prompt injectionREADME.md:144 · Prompt injection — known jailbreak technique reference · informational: not an instruction file
AST01deep-research tools; Developer mode unlocks full tool calling.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.Cost to the agent
Instructions loaded
≈82 tok
1 file · 18 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for @tempo-ai/mcp@0.0.145 as of 35 min ago. This is the package itself, not its dependencies.