Skills/npm/mcp

mcp@0.3.81

VERIFIED· not started

Publisher claims: "Pharaoh developer install for Claude Code, Codex and Claude Desktop: architecture tools, shell queries and agent workflows." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher pharaoh-so · publishing for 239 daysInstalls 7,957Last detonated 3d ago
$claude mcp add mcp -- npx -y @pharaoh-so/mcp
WatchReport an issue

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
no credential variables read in the code
Where it talks to
pharaoh.so (its own)Also claude.com, microsoft.com, chatgpt.com, openclaw.dev — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it under the guard. Not started: dependency install failed; the server itself was not observed. The code names no credential variable and talks to pharaoh.so, its own; the guard pins the network to what the honeypot saw and logs every call.

$vet-skills run --net declared -- npx -y @pharaoh-so/mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-11 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 6 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
6.0sprocessdependency install exit 1 · (Use `node --trace-warnings ...` to show where the warning was created) npm error Cannot read properties of null (reading 'edgesOut') npm error A complete log of this run can be found in: /tmp/ks-detonate-kcyPia/task/home/.npm/_logs/2026-11-11T06_40_10_115Z-debug-0.log
6.0sclaimednot started: dependency install failed (exit 1); the server itself was not observed
6.0sprocessscript backend runs setup only
6.0sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packagedist/helpers.js:11 · npx invocation of non-well-known package — may execute untrusted code/** Explicit setup works in a terminal or a script; tool commands keep the base NPX command. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/backend.d.ts:103 · Process kill command — agent can terminate processes* error we explicitly close() the transport to kill EventSource, thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/runtime.js:10 · npx invocation of non-well-known package — may execute untrusted codeconst RECOVERY = "npx @pharaoh-so/mcp@latest install";Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/client-install.js:13 · npx invocation of non-well-known package — may execute untrusted codeconst RECOVERY = "npx @pharaoh-so/mcp@latest install --migrate-legacy";Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/helpers.js:10 · npx invocation of non-well-known package — may execute untrusted codeexport const NPX_COMMAND = "npx @pharaoh-so/mcp";Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/install-skills.js:699 · npx invocation of non-well-known package — may execute untrusted code* to `npx @pharaoh-so/mcp@<this version>`, and write it back. Creates the fileFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/helpers.d.ts:5 · npx invocation of non-well-known package — may execute untrusted codeexport declare const NPX_COMMAND = "npx @pharaoh-so/mcp";Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/proxy.js:15 · Process kill command — agent can terminate processes* kill the EventSource, then let the proxy's own backoff loop create a freshFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/helpers.d.ts:4 · npx invocation of non-well-known package — may execute untrusted code/** The npx command users run to set up Pharaoh. Single source of truth for all output. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/doctor.js:51 · npx invocation of non-well-known package — may execute untrusted code"To inspect project markers for Claude Code, run npx @pharaoh-so/mcp@latest --doctor --client claude-code from the repository root.",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/install-skills.d.ts:51 · npx invocation of non-well-known package — may execute untrusted code* to `npx @pharaoh-so/mcp@<this version>`, and write it back. Creates the fileFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/version.js:17 · npx invocation of non-well-known package — may execute untrusted codeexport const UPGRADE_COMMAND = `npx ${PACKAGE_NAME}@latest install`;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/proxy.d.ts:15 · Process kill command — agent can terminate processes* kill the EventSource, then let the proxy's own backoff loop create a freshFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesCHANGELOG.md:180 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file…he interactive setup (`npx @pharaoh-so/mcp` in a terminal) asks once whether to add one line to `~/.claude/CLAUDE.md`: "In repos Pharaoh has mapped, before searching or reading files, ask Pharaoh …Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packagedist/helpers.js:110 · npx invocation of non-well-known package — may execute untrusted code…Claude Code plugin and OpenClaw skills", " --migrate-legacy Move plain pinned NPX connections to the managed runtime during install", " --skip-runtime Turn off runtime a…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/gateway.js:151 · npx invocation of non-well-known package — may execute untrusted code// proxy finishing device flow, or `npx @pharaoh-so/mcp` in a terminal.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/runtime-command.js:32 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileswriteCredentials({ ...credentials, runtime_session: randomUUID() });Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/client-install.js:390 · npx invocation of non-well-known package — may execute untrusted code/** List only enabled plain NPX registrations eligible for explicit migration consent. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/helpers.js:9 · npx invocation of non-well-known package — may execute untrusted code/** The npx command users run to set up Pharaoh. Single source of truth for all output. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/install-skills.js:468 · npx invocation of non-well-known package — may execute untrusted codeconst COMMAND_MARKER_LINE = `${PHARAOH_COMMAND_MARKER} (rewritten by npx ${PACKAGE_NAME} on upgrade; rename this file to keep your own version)`;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/backend.js:295 · Process kill command — agent can terminate processes// Non-fatal — explicitly close the transport to killFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/runtime-command.js:180 · npx invocation of non-well-known package — may execute untrusted codeprintLines("Pharaoh: install an owned local connection first with npx @pharaoh-so/mcp@latest install. Custom and disabled connections are kept.");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/install-skills.js:701 · npx invocation of non-well-known package — may execute untrusted code* `npx @pharaoh-so/mcp` command (extra arguments kept) and left alone when itFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/helpers.d.ts:7 · npx invocation of non-well-known package — may execute untrusted codeexport declare const INSTALL_COMMAND = "npx @pharaoh-so/mcp@latest install";Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/version.d.ts:4 · npx invocation of non-well-known package — may execute untrusted codeexport declare const UPGRADE_COMMAND = "npx @pharaoh-so/mcp@latest install";Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/helpers.d.ts:6 · npx invocation of non-well-known package — may execute untrusted code/** Explicit setup works in a terminal or a script; tool commands keep the base NPX command. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageinspect-tools.json:2 · npx invocation of non-well-known package — may execute untrusted code…cal connection, get_blast_radius also analyzes saved worktree files. The active NPX hook supplies the checkout reference for local analysis. Hosted scope queries the de…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageinspect-tools.json:217 · npx invocation of non-well-known package — may execute untrusted code"description": "Checkout reference from the active NPX hook. Omit without one.",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/helpers.js:12 · npx invocation of non-well-known package — may execute untrusted codeexport const INSTALL_COMMAND = "npx @pharaoh-so/mcp@latest install";Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/install-skills.js:126 · npx invocation of non-well-known package — may execute untrusted codemetadata: { description: "Pharaoh's Claude Code plugin, installed by npx @pharaoh-so/mcp" },Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/client-install.d.ts:4 · npx invocation of non-well-known package — may execute untrusted code/** List only enabled plain NPX registrations eligible for explicit migration consent. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/install-skills.js:860 · npx invocation of non-well-known package — may execute untrusted codeconst start = `<!-- pharaoh-mcp:start${addedNewline ? "+nl" : ""} (managed by npx ${PACKAGE_NAME}; --clean or --logout removes it) -->`;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/backend.js:144 · Process kill command — agent can terminate processes* error we explicitly close() the transport to kill EventSource, thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/install-skills.d.ts:53 · npx invocation of non-well-known package — may execute untrusted code* `npx @pharaoh-so/mcp` command (extra arguments kept) and left alone when itFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/install.js:127 · npx invocation of non-well-known package — may execute untrusted codewrite("Existing pinned NPX connections:");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/install-skills.js:1104 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction filereturn `Pharaoh: couldn't write ~/.claude/CLAUDE.md. ${byHand}`;Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/install-skills.js:1132 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileprocess.stderr.write(`Pharaoh: couldn't remove its line from ~/.claude/CLAUDE.md${code ? ` (${code})` : ""}. Delete the pharaoh-mcp block by hand.\n`);Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈3,063 tok
2 files · 80 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @pharaoh-so/mcp@0.3.81 as of 3d ago. This is the package itself, not its dependencies.