Is mcp@1.5.4 safe to install?

mcp@1.5.4

VERIFIED

Publisher claims: "Agentic search over your Dewey document collections from any MCP-compatible client." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server) · listed in the official MCP RegistryPublisher meetdewey · publishing for 232 daysInstalls 0Last detonated 3d ago

$claude mcp add mcp -- npx -y @meetdewey/mcp

Watch Report an issue

Coverage

Started with a decoy DEWEY_API_KEY; tool list observed. Tool calls with a real credential not tested.

Tested: server startup with a tagged decoy in DEWEY_API_KEY · MCP initialize and tools/list · every tool description, for hidden instructions · where the decoy credential went · every file read, file written and host contacted by what ran
Not tested: what the tools do when called with a real credential
Needs: DEWEY_API_KEY — give it to the server where it runs, through vet-skills run --secrets, so the value never enters the server's environment. Never paste a credential into a chat, a ticket or a report.

Before you give it your token

It will ask for: DEWEY_API_KEYConfiguration, not credentials: DEWEY_API_URL, DEWEY_COLLECTION_ID, NODE_EXTRA_CA_CERTS
Where it talks to: meetdewey.com (its own)
What the honeypot saw: no credential files read · no network
What we could not test: what the tools do when called with a real credential

Connect it with a scoped credential, under the guard. It asks for DEWEY_API_KEY and talks to meetdewey.com. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind.

$vet-skills run --secrets DEWEY_API_KEY=meetdewey.com -- npx -y @meetdewey/mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-12 and scored it 95/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 51 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

11sprocessdependency install exit 0

31sprocessrelaunched with a decoy DEWEY_API_KEY (tagged; nothing real)

51sclaimed35 tools with a decoy DEWEY_API_KEY: dewey_list_collections, dewey_create_collection, dewey_search, dewey_scan_sections, dewey_research, dewey_list_documents, dewey_get_document, dewey_wait_for_document, dewey_list_document_tags, dewey_get_section, dewey_get_section_chunks, dewey_list_claims, dewey_list_contradictions, dewey_detect_contradictions, dewey_resolve_contradiction, dewey_get_collection_stats, dewey_update_collection, dewey_describe_collection, dewey_delete_document, dewey_batch_delete_documents, dewey_get_document_sections, dewey_get_document_markdown, dewey_retry_document, dewey_retry_failed_documents, dewey_update_document

51sprocessscript backend runs setup only

51sprocessno install scripts to re-run

Static findings

No findings across 221 lines in 7 files.

Cost to the agent

Instructions loaded

≈46 tok

1 file · 7 in bundle

Tool list per prompt

≈5,509 tok

35 tools · 157 per tool

Handshake

1052 ms

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 174

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @meetdewey/mcp@1.5.4 as of 3d ago. This is the package itself, not its dependencies.