Skills/npm/mcp

mcp@0.119.0

CAUTION

Publisher claims: "Anychat MCP server — drive your Anychat workspace (agents, playbooks, channels, people, outreach) from Claude Code, Claude Desktop, Cursor, or any MCP host." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher anychat-ai · publishing for 91 daysInstalls 6,949Last detonated 28 h ago
What would fix thisWatchDispute verdict

Coverage

Started with a decoy ANYCHAT_API_KEY; tool list observed. Tool calls with a real credential not tested.
Tested
server startup with a tagged decoy in ANYCHAT_API_KEY · MCP initialize and tools/list · every tool description, for hidden instructions · where the decoy credential went · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with a real credential
Needs
ANYCHAT_API_KEY — give it to the server where it runs, through vet-skills run --secrets, so the value never enters the server's environment. Never paste a credential into a chat, a ticket or a report.

Before you give it your token

It will ask for
ANYCHAT_API_KEYConfiguration, not credentials: ANYCHAT_API_URL, ANYCHAT_DOCS_URL
Where it talks to
anychat.ai (its own)
What the honeypot saw
no credential files read · no network
What we could not test
what the tools do when called with a real credential

Connect it with a scoped credential, under the guard. It asks for ANYCHAT_API_KEY and talks to anychat.ai. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind.

$vet-skills run --secrets ANYCHAT_API_KEY=anychat.ai -- npx -y @anychat-ai/mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-13 and scored it 79/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Credential pass-through configuration; Prompting user to enter sensitive credentials. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 54 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
13sprocessdependency install exit 0
33sprocessrelaunched with a decoy ANYCHAT_API_KEY (tagged; nothing real)
53sclaimed256 tools with a decoy ANYCHAT_API_KEY: whoami, list_agents, get_agent, create_agent, update_agent, delete_agent, export_agent, import_agent, apply_agent_template, get_template_update, preview_template_update, apply_template_update, list_catalog_items, get_catalog_item, get_identity, update_identity, get_personality, set_personality, import_personality_template, get_standing_instructions, set_standing_instructions, get_guardrails, set_guardrails, update_guardrails, import_guardrail_template
53stools02e98fc4e1928512
53stoolsb42ab00f4ce3f953
53stools0fed70a8c653c426
53stools23f4fc778d6f329b
53stools728a19f683b03539
53stools4aa086b277cca546
53stools1bf052b1cd50ddea
53stools6311b5290cbc59e5
53stoolse6b4b149d066e376
53stools37b917fb38eb80b6
53stools3340f2ddfed18120
53stools4280259bc4c6c7b0
53stools8c2b3323f1e66a00
53stoolsd725d3552fecb75c
53stools018b496624ceb6d5
53stoolsd48ba95aa2b26cc9
53stoolsf14090b6fb6a848e
53stools409c4a4b5836fd7a
53stoolsf21df3c7c38c633e
53stoolsab0882bda608610a
53stools64522953bf7fbb76
53stools870b9d0b352e7a4f
53stoolsbf7840cfa30aaf5a
53stoolsc39ec46bec7a39dc
53stools7a2b575841226a9f
53stools798d5200f11cd2fd
53stools1f0f4db3d002e2ff
53stools7c4acfbcc536cf97
53stools88b5790949ba28bc
53stools2b2658a43d9868b7
53stools6b3a8b2ac09e6463
53stools3fddc72e95fea56b
53stools0b2299bf20390a93
53stoolsf489fb84022111d5
53stoolsc22a54c9115c28a5
53stools3267359d2363f706
53stools8ba060d91ddec9cd
53stools0d84c406ebdb1e14
53stoolsa3db903d6d0ce23b
53stools1406cab7c1a69b8f
53stoolsc1d76ba544b2a871
53stoolsb155553c8ab58cfe
53stools00ded65a92b6a45a
53stools9d019c5a5f41eefe
53stools7574e785fe4f2a37
53stoolsc68b9cbb9eb82255
53stools79f084546fb769a2
53stools31dd2fb3a5539bb5
53stools6c27259a826e01b8
53stools735e8bb8aae818d7
53stoolsd91b3d976ea1272a
53stools95cd85e03226fe59
53stools97fc863787d06ebe
53stoolse41b60c48b91474f
53stoolsf43db8dbd60d4ded
53stools6ab61fb135c9e46b
53stools5118d146381bb674
53stoolsb8fcc0c65f22b4c9
53stoolsbbb5d79d0a10c37f
53stoolsfe641e264066b459
53stools6464f555105c3c56
53stools2d8c76da4298ed0b
53stoolsd30a43b23d5f2a3c
53stoolsc98e812b6e156df0
53stools3a969a8c89484c89
53stools94135603b5260077
53stoolsc4fb053b9ebd4b75
53stoolsb414281609f951bc
53stools7901d24e15ca33c4
53stoolsfd0614ce3535580f
53stools6d4ea7eed5b5957a
53stoolscd69b7b429206faf
53stools70f7cedf3c1a46ec
53stools495d0e4800084ad5
53stoolsb2d6c75d9a888919
53stoolsd23fa8c20dd87f7b
53stools210fa70f02ba6fea
53stools46c03e3dcc01cbfd
53stools9d66b27a67cb1428
53stoolsd816d5af6c941005
53sprocessscript backend runs setup only
53sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packagedist/bin.js:7 · npx invocation of non-well-known package — may execute untrusted code* ANYCHAT_API_KEY=sk-any-... npx -y @anychat-ai/mcpFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Credential pass-through configurationdist/tools/channels.js:138 · Credential pass-through configuration — agent relays sensitive credentials…lack, viber, poe → bind_channel); 422 for a value Google does not accept. Never pass credentials. Maps to POST /v1/orgs/{org}/agents/{agent}/channels with mode "managed".', …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
CRITICAL
Prompting user to enter sensitive credentialsdist/tools/ajo.js:90 · Prompting user to enter sensitive credentials — social engineering…, response, errorResponse }, runbook[] (setup and branching steps, in order) }. Paste your API key (scope integrations:ajo) in place of the Authorization placeholder. 422 agent.o…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03

Cost to the agent

Instructions loaded
≈74 tok
1 file · 64 in bundle
Tool list per prompt
≈83,704 tok
256 tools · 327 per tool
Handshake
12286 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 476

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @anychat-ai/mcp@0.119.0 as of 28 h ago. This is the package itself, not its dependencies.

What would make this Verified

1 point to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Prompting user to enter sensitive credentials≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. Unclaimed publisher≈ +8 on the totalClaim anychat-ai: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim anychat-aiPropose a patch to the maintainer