Skills/npm/mcp

mcp@0.18.28

CAUTION

Publisher claims: "Official Model Context Protocol (MCP) server for NineDeploy AI integration" Observed in sandbox: sends data to 127.0.0.1.

Registry npm (MCP server)Publisher ninedeploy · publishing for 88 daysInstalls 4,857Last detonated 14 h ago
What would fix thisWatchDispute verdict

Coverage

Started with a decoy NINEDEPLOY_TOKEN; tool list observed. Tool calls with a real credential not tested.
Tested
server startup with a tagged decoy in NINEDEPLOY_TOKEN · MCP initialize and tools/list · every tool description, for hidden instructions · where the decoy credential went · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with a real credential
Needs
NINEDEPLOY_TOKEN — give it to the server where it runs, through vet-skills run --secrets, so the value never enters the server's environment. Never paste a credential into a chat, a ticket or a report.

Before you give it your token

It will ask for
NINEDEPLOY_TOKENConfiguration, not credentials: NINEDEPLOY_MCP_READONLY, NINEDEPLOY_URL
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · contacted 127.0.0.1 (undeclared)
What we could not test
what the tools do when called with a real credential

Find out what these hosts are first. In the honeypot it contacted 127.0.0.1, which nothing in the package names as its own. If that is the vendor's service, fine; if you cannot place it, do not connect it.

$vet-skills run --net 127.0.0.1 -- npx -y @ninedeploy/mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-13 and scored it 71/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: sends data to 127.0.0.1.

Behavior trace

Honeypot run · 53 s · 2 scenarios
t+CategoryObserved action
0.0sprocessno install scripts in bundle
13sprocessdependency install exit 0
33sprocessrelaunched with a decoy NINEDEPLOY_TOKEN (tagged; nothing real)
53snetworkCONNECT tcp://127.0.0.1:3000 · not in the allow-list, refused
53sclaimed64 tools with a decoy NINEDEPLOY_TOKEN: list_services, get_service, service_logs, list_deploys, list_domains, list_databases, list_projects, list_alerts, activity_log, system_stats, topology, health, deploy_service, restart_service, cancel_deploy, remove_deploy, rollback_deploy, list_queue, list_plugins, marketplace_plugins, install_plugin, enable_plugin, disable_plugin, uninstall_plugin, list_configs
53stools6a427b2144d5ebd1
53stools720b2ad30a3f72ff
53stoolsb14491e5a695c94b
53stoolse70e8a93c291a387
53stools16961a416f6523f3
53stoolsbf3972eccb45b74b
53stoolsfddccf5e676e2710
53stools255a4170e9bd6612
53stools11cde1c015874281
53stools911f782b6f203e0c
53stools506f0f0ae033a29a
53stools4fd3225e0b752bac
53stools39fa4c198760af22
53stools59cce56111613d8f
53stools99d490dcc343fc63
53stools8d36345401b2f86b
53stools16a9a538c2c222c3
53stoolsf8f6a769a9267eba
53stoolsb5d421ca1025a23d
53stools88bd0eb344b5d40c
53stoolsd3d76f9637118338
53stools40d812b34797e9fc
53stools80de558184331bc3
53stools3821945352815cdc
53stools3a168196537cce5d
53stoolscd17bbb601bc0371
53stools41e861710ca859b5
53stoolsea34572ba54d04a4
53stoolsce2f33ffaef703b1
53stools939605672dd31ebd
53stools13d9389a1f0e54dd
53stools2c7f628ad2b33607
53stools1d7216f7afdc01ba
53stools67e8ea0a016e91f5
53stools0125b5449af34106
53stools0ec5ca953d195e22
53stools5ae1ebbaf80b8f7a
53stools0d39c3f00320a2e1
53stools9d79c65dadbcd48c
53stools279eda12e08fb0d7
53stools65865cd7ca428147
53stoolsd7a297cb0a4b8e31
53stools213a82c9c6d486a2
53stools310737599def9804
53stools19eb0df4d14cae3c
53stools6eb54ed8d3e1d8d4
53stools84357c1a1b370e70
53stools764a80220ea1dd33
53stoolsc6187872ae0a0980
53stools40b0abf50bc4207b
53stoolsbbc3d6e85bb89bab
53stools7b320ad976b8b5db
53stools9b0affe33bb6ed58
53stools24f37f381295167e
53stools830766702cefd274
53stools3f3348ee292c2ada
53stools1dbbfd7165db508c
53stoolsa319db038de4e001
53stoolse7acfb416f2a46ec
53stoolse35f4b6a214fa768
53stools6fcd164e8f7a777a
53stools3054aaea9d2fd423
53stools348942ff9f8e0c51
53stoolsb8b7ab422236c0fa
53sprocessscript backend runs setup only
53sprocessno install scripts to re-run

Static findings

No findings across 2,233 lines in 17 files.

Cost to the agent

Instructions loaded
≈54 tok
1 file · 17 in bundle
Tool list per prompt
≈5,184 tok
64 tools · 81 per tool
Handshake
1356 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 103

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @ninedeploy/mcp@0.18.28 as of 14 h ago. This is the package itself, not its dependencies.

What would make this Verified

9 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Contacts a host you did not declare≈ +23 on the totalList every host you talk to in SKILL.md frontmatter (`network: [api.example.com]`), or stop contacting the ones you cannot justify.
  2. Unclaimed publisher≈ +8 on the totalClaim ninedeploy: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim ninedeployPropose a patch to the maintainer