Skills/npm/mcp

mcp@2.214.0

CAUTION

Publisher claims: "Agentistics MCP server — Claude Code analytics for Claude Desktop and Claude Code" Observed in sandbox: sends data to localhost.

Registry npm (MCP server)Publisher agentistics · publishing for 204 daysInstalls 36,600Last detonated 1 h ago
What would fix thisWatchDispute verdict

Coverage

Server started and answered tools/list.
Tested
MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with real credentials

Before you give it your token

It will ask for
VAULT_PASSWORD_MIN_LENGTHVAULT_PASSWORD_MIN_SPECIALConfiguration, not credentials: AGENTISTICS_API, AGENTISTICS_DIR, AGENTISTICS_MCP_NO_ORPHAN_GUARD, AGENTISTICS_NAY_SESSION, AGENTOP_MANAGED_ID
Where it talks to
no vendor host named in the codeAlso claude.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · contacted localhost (undeclared)
What we could not test
what the tools do when called with real credentials

Find out what these hosts are first. In the honeypot it contacted localhost, which nothing in the package names as its own. If that is the vendor's service, fine; if you cannot place it, do not connect it.

$vet-skills run --net localhost -- npx -y @agentistics/mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-15 and scored it 71/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Tool description instructs the agent: instruction addressed to the agent. Summary: sends data to localhost.

Behavior trace

Honeypot run · 26 s · 2 scenarios
t+CategoryObserved action
0.0sprocessno install scripts in bundle
5.6sprocessdependency install exit 0
26snetworkCONNECT tcp://localhost:47291 · not in the allow-list, refused
26snetworkCONNECT tcp://localhost:47291 · not in the allow-list, refused
26sclaimed58 tools: agentistics_tasks, agentistics_task, agentistics_task_create, agentistics_task_status, agentistics_task_statuses, agentistics_task_types, agentistics_task_type_edit, agentistics_task_status_edit, agentistics_task_comment, agentistics_task_subtask, agentistics_task_link, agentistics_task_blocked_by, agentistics_task_next, agentistics_task_claim, agentistics_task_activity, agentistics_live_delivery, agentistics_task_edit, agentistics_task_session, agentistics_task_delete, agentistics_delivery_calendar, agentistics_task_phase, agentistics_task_stage, agentistics_task_evidence, agentistics_task_queue, agentistics_task_queue_answer
26stools95016e14af63fb67
26stools8be66223936a2582
26stoolsa52cd66b553467a9
26stoolse0e3abdf16edd1a8
26stoolse446bf388307cb37
26stools9ac557f84b9e4d11
26stoolsc40e49acd0147823
26stools0521ec86b141ff65
26stools8acea08eea9fbd6f
26stools86f94901ce0508a0
26stoolsbf5405ad430001d6
26stools4919a965a1e3235f
26stools76e8f4298ee6b436
26stoolse0f5b49569a78425
26stoolsf706c145d5d2c9ed
26stoolse6d503db6025cb4c
26stools688c6267b7dc1310
26stoolse345def8aff04722
26stoolse1a2672f6eaa8f66
26stools30aae30e4a3596cd
26stoolsd84181d27aa5ab70
26stools31bb4761c31f6540
26stools0f18897d143a48fd
26stools35b1cbfa2ce92fc9
26stools346208a36c7e59cc
26stools153c703defcb3a90
26stools12cc2832dd8d332e
26stoolsd904ace160f678c4
26stools7473cba208c583e8
26stoolsd663e364fdd565c5
26stoolsb957756679caa68d
26stoolsc7a1e3f44b8d3d5e
26stools6d3f766b438b5e78
26stools4b1fb8745b32c310
26stoolscfa9fcbea8848bc2
26stoolsba20df0d96359929
26stoolsdd96b7f7c47d9593
26stoolsec2ac52c7fe137a0
26stools9423eeb3f35606c4
26stools505f9df736e5a256
26stools10a98f01d579bffd
26stools788b02aa290566fc
26stoolsd04b981d6da8df2a
26stools8405b84a35d6da8b
26stoolsbebc075558a1f26b
26stools67cf0452f886f34c
26stools86fe10d88aaa1fc5
26stools9457cb816a31f37e
26stools7a79757de446edde
26stoolsa7c1e214c10037b8
26stoolsab097a6e0443ece3
26stoolsfd72c19c15239d52
26stoolsdcfabf583940441a
26stoolse1992a5a5718b713
26stools7a790cdc546ef3cc
26stools221550a1fe6b3be2
26stools463703b4aabb774b
26stools5e600342283db425
26sprocessscript backend runs setup only
26sprocessno install scripts to re-run

Static findings

HIGH
Tool description instructs the agent: instruction addressed to the agentmcp:tools/agentistics_task_claim:1 · Instruction aimed at the agent: instruction addressed to the agenterriding a live claim on purpose and an agent should not send it. {"type":"object","properties":{"ref":{"type":"string"},Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File permission modification commandpackage.json:15 · File permission modification command — agent changes file ownership/permissions"build": "bun build agentistics-mcp.ts --outfile dist/agentistics-mcp.js --external @modelcontextprotocol/sdk --target node && chmod +x dist/agentistics-mcp.js",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05

Cost to the agent

Instructions loaded
≈56 tok
1 file · 4 in bundle
Tool list per prompt
≈18,485 tok
58 tools · 319 per tool
Handshake
2439 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 740

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @agentistics/mcp@2.214.0 as of 35 min ago. This is the package itself, not its dependencies.

What would make this Verified

9 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Contacts a host you did not declare≈ +23 on the totalList every host you talk to in SKILL.md frontmatter (`network: [api.example.com]`), or stop contacting the ones you cannot justify.
  2. Unclaimed publisher≈ +8 on the totalClaim agentistics: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim agentisticsPropose a patch to the maintainer