mcp@1.22.1
VERIFIEDPublisher claims: "[Netlify MCP Server](https://docs.netlify.com/welcome/build-with-ai/netlify-mcp-server/) follows the [Model Context Protocol (MCP)](https://modelcontextprotocol.org) to enable code agents to use the Netlify API and CLI—so they can create new projects, bui" Observed in sandbox: calls www.netlify.com only, touches nothing outside the project, writes no memory.
Coverage
Server started and answered tools/list.- Tested
- MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
- Not tested
- what the tools do when called with real credentials
Before you give it your token
- It will ask for
JWE_SECRETMIN_JWE_SECRET_LENGTHNETLIFY_PERSONAL_ACCESS_TOKENOAUTH_ISSUERConfiguration, not credentials: MCP_VERBOSE_LOGGING- Where it talks to
- netlify.com, netlifysdk.com (its own)
- What the honeypot saw
- no credential files read · reached only www.netlify.com (its own)
- What we could not test
- what the tools do when called with real credentials
Connect it with a scoped credential, under the guard. It asks for JWE_SECRET, MIN_JWE_SECRET_LENGTH, NETLIFY_PERSONAL_ACCESS_TOKEN, OAUTH_ISSUER and talks to netlify.com, netlifysdk.com. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-15 and scored it 82/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: calls www.netlify.com only, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 35 s · 2 scenarios · 0 deviationsStatic findings
".env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.console.log("Uploading your project...");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.…--- [Netlify MCP Server](https://docs.netlify.com/welcome/build-with-ai/netlify-mcp-server/) follows the [Model Context Protocol (MCP)](https://modelcontextprotocol.org) to enable code agents to use the Netlify API and C…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.npx -y @netlify/mcp@latest --site-id ${params.siteId} --proxy-path "${proxyUrl}"Fix: Pin versions and sources; vendor anything fetched at install time.const proxyUrl = new URL(`/proxy/${proxyToken}`, getOAuthIssuer()).toString();Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.const proxyToken = await createJWE({Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.Cost to the agent
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for @netlify/mcp@1.22.1 as of 43 min ago. This is the package itself, not its dependencies.