mcp@0.64.2
VERIFIEDPublisher claims: "MCP server to build and publish Telegram and MAX bot funnels/automations, broadcasts, service integrations, block-based websites (incl. free-layout Zero blocks, designs, templates, custom domains, form leads) and Markdown blog articles in the Retensy Bots" Observed in sandbox: calls registry.npmjs.org only, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher retensy · publishing for 63 daysInstalls 7,357Last detonated 1 h ago
Coverage
Server started and answered tools/list.- Tested
- MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
- Not tested
- what the tools do when called with real credentials
Before you give it your token
- It will ask for
RETENSY_MCP_TOKENConfiguration, not credentials: RETENSY_BASE_URL, RETENSY_COOKIE, RETENSY_MCP_AUTOUPDATE, RETENSY_MCP_CATALOG, RETENSY_MCP_REPORT_URL, RETENSY_MCP_TELEMETRY, RETENSY_SESSION_COOKIE- Where it talks to
- retensy.com (its own)Also t.me — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · reached only registry.npmjs.org
- What we could not test
- what the tools do when called with real credentials
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names t.me as well as its own vendor. The guard injects RETENSY_MCP_TOKEN only into requests to retensy.com (and its subdomains) and refuses the rest.
$vet-skills run --secrets RETENSY_MCP_TOKEN=retensy.com -- npx -y @retensy/mcp
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-15 and scored it 85/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: calls registry.npmjs.org only, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 20 s · 2 scenariost+CategoryObserved action
0.0sprocessno install scripts in bundle
20sfilesystemread ~/.retensy-bot-graph/token · ~/.retensy-bot-graph/catalog-14d154cb-cbe5cfdf7c2118a9.json · ~/.retensy-bot-graph/update-check.json outside project
20sfilesystemwrote ~/.retensy-bot-graph/update-check.json
20snetworkCONNECT tcp://registry.npmjs.org:443
20sclaimed220 tools: setup, set_token, account_add, account_list, account_remove, list_bots, list_graphs, list_channels, catalog_item_upsert, catalog_category_list, catalog_category_upsert, integration_catalog, integration_status, integration_test, channel_post, list_integrations, get_graph, create_graph, update_graph, edit_graph_live, patch_graph, dry_run, publish_graph, graph_versions_list, graph_version_rollback
20stoolsc16d9f35d6a8db32
20stoolsd76af31178c50d2b
20stools13a9f1097471da8c
20stools4f2416334a33283f
20stools23e6f1d22161b791
20stools6acb13ea96b34b02
20stoolsdcdf6619b51d80d7
20stoolsc21f8336a1dbb07c
20stools6e8f409d3fd30289
20stoolsc863a23ae59b3708
20stoolsb7b2c01192fe1d92
20stools33374cc4c8b79cfe
20stools20542b3d05840f8c
20stoolseeee5352ea0a81c9
20stools2d20639ed3dc40cb
20stools092fc975457e2179
20stoolsfcf104d8591fc591
20stoolse2eafa1e0c7aad40
20stools6d340d2093a88f75
20stoolsdf9e7ede1f2215ae
20stools48915d9eacd8581a
20stoolse3f989984a5562b2
20stoolsdb258cd67a32158e
20stools87b1638ad2d01ff8
20stools4363eed74d3a6403
20stools0fc3572aeea69728
20stools08c98e3a5c4c9d23
20stools4d42ecce79d1e091
20stools558b5a74e396bf7a
20stoolsf0d64cff29c566b6
20stools63c6cc3ef2245cc4
20stools3e4e1889a9128220
20stoolsefdf76c73fc06b47
20stoolse2f17824e9d8fe8c
20stools10b418f53b6efc72
20stoolsf6e7c19ce1ab795b
20stools8dad9cb1369acb78
20stools7d20e2121ad96678
20stools11890e481d54f54f
20stoolsb66a9350b159bce0
20stools64ce140f8d4a18cf
20stoolsf20f38a5df24ca5c
20stools59b7721d534b0fd7
20stools9a2a26269e7a5ed6
20stools725263ba83b6b5fd
20stools32b4624d6e64cbaa
20stoolscaa51e92565fa0f1
20stools34e5211a2735b8e2
20stools5b28b3e1a48d0756
20stoolsd24f34ef9d3800e7
20stools8aabee449850f3a6
20stoolsc8b1cb1a789edc2b
20stools43b825cbf395b991
20stools18a317b1726c8539
20stoolsa8c4f178e0f4030f
20stools64aaa6363c83b7b7
20stools1024edd7400d328e
20stools2e6def48233197e8
20stoolsf69cb3e250815960
20stools6f549b0beb80bb9d
20stoolsadddb033cac0cc5b
20stoolsb3b58877df4229f7
20stools5c1a08da7373d97d
20stoolsb5a2b4bd70e1a9a9
20stools3fbeafe8a05a345d
20stoolsb8593eb582a7d444
20stools516899418069c8cc
20stools1bf77d0419fcecc8
20stools8426c4e94b8e801b
20stools06d017d8dca5f64c
20stoolse846c1a09d8faf29
20stools5caed80e563cb7d4
20stools9e991a4b66db8896
20stoolsd6a965276ef83aad
20stoolse7aba9956b0e0e1a
20stools1304061c6560e62f
20stoolsf9d464d2f20b8ab8
20stoolsdd9859a16803905d
20stools54f9a887b02593c4
20stoolsc919f712851f13dc
20sprocessscript backend runs setup only
20sprocessno install scripts to re-run
Static findings
HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)README.md:52 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)
AST01ЮKassaFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)README.md:194 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)
AST01ЮKassaFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)README.md:373 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)
AST01ЮKassaFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)skills/build-bot-funnel/reference/schema.md:411 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)
AST01ЮKassaFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)skills/build-bot-funnel/reference/schema.md:39 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)
AST01ЮKassaFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: credential exfiltration instructionmcp:tools/bot_change_token:1 · Instruction aimed at the agent: credential exfiltration instruction
AST01Сменить токен бота (POST /api/bots/{botId}/token {token}): сервер проверяет токен и перезапускает приём сообщений;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)skills/build-bot-funnel/SKILL.md:42 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)
AST01ЮKassaFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
File type combined with upload actionsrc/index.mjs:1413 · File type combined with upload action — agent may exfiltrate local data files
AST07…е пишет в базу. scenarioFile — локальный JSON-дамп bots/<channel>/scenarios/<id>.json (как есть, с полями complexBot/steps); externalRequestsDir — опционально, папка bots/<channel>/external_requests/ (каждый *.json грузится под своим uuid …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)mcp:tools/audience_tag_edit:1 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)
AST01спискaхFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)README.md:374 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)
AST01ЮKassaFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)skills/build-bot-funnel/reference/schema.md:52 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)
AST01ЮKassaFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)skills/build-bot-funnel/reference/schema.md:251 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)
AST01ЮKassaFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)skills/build-bot-funnel/reference/schema.md:416 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)
AST01ЮKassaFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)mcp:tools/integrations_for_spec:1 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)
AST01ЮKassaFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: credential exfiltration instructionmcp:tools/bot_channel_add:1 · Instruction aimed at the agent: credential exfiltration instruction
AST01оту ещё одного Telegram-бота как канал (POST /api/bots/{botId}/channels {token, name?}): он отвечает теми же сценариями. Токен проверяетсяFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)skills/build-bot-funnel/reference/schema.md:97 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)
AST01ЮKassaFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)skills/build-bot-funnel/reference/schema.md:419 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)
AST01ЮKassaFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
File type combined with upload actionsrc/index.mjs:1385 · File type combined with upload action — agent may exfiltrate local data files
AST07…xport", description: "Все заявки сайта в CSV (GET /api/bots/pages/{siteId}/leads.csv). savePath — сохранить в локальный файл и вернуть путь (для больших выгрузок); без него CSV возвращается текстом. Read-only.", inputSchema: { type: "objec…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)skills/build-bot-funnel/reference/schema.md:47 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)
AST01ЮKassaFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)mcp:tools/ticket_cancel:1 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)
AST01ЮKassaFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)mcp:tools/broadcast_group:1 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)
AST01перBotFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: credential exfiltration instructionmcp:tools/scenario_rotate_secret:1 · Instruction aimed at the agent: credential exfiltration instruction
AST01ить новый секрет входа вебхук-сценария (POST /api/scenarios/{id}/rotate-secret) — старый сразу перестаёт приниматься. Секрет виден в ответFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)mcp:tools/ai_pack_purchase:1 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)
AST01ЮKassaFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Tool description instructs the agent: credential exfiltration instructionmcp:tools/vk_connect:1 · Instruction aimed at the agent: credential exfiltration instruction
AST01дключить VK-сообщество вручную токеном (POST /api/bots/vk/connect-token): communityId, accessToken — токен сообщества с правами walFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.Cost to the agent
Instructions loaded
≈15,786 tok
5 files · 18 in bundle
Tool list per prompt
≈51,984 tok
220 tools · 236 per tool
Handshake
10535 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 434
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for @retensy/mcp@0.64.2 as of 35 min ago. This is the package itself, not its dependencies.