Skills/npm/mcp

mcp@3.9.112

CAUTION· startup only

Publisher claims: "Approval gate and audit trail for AI agent actions: policy check first, proof after. Any MCP client." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server) · listed in the official MCP RegistryPublisher getmarrow · publishing for 232 daysInstalls 9,068Last detonated 6d ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
GITHUB_TOKENMARROW_API_KEYMARROW_PASSIVE_TOKEN_USAGEConfiguration, not credentials: CLAUDE_CODE_CHILD_SESSION, CLAUDE_CODE_ENTRYPOINT, CLAUDE_PLUGIN_ROOT, CLAUDE_PROJECT_DIR, CODEX_HOME, GEMINI_CLI_SYSTEM_DEFAULTS_PATH, GEMINI_CLI_SYSTEM_SETTINGS_PATH, GET_A_KEY_LINE, GET_A_KEY_URL, GIT_CONFIG, GIT_CONFIG_COUNT, GIT_CONFIG_GLOBAL, GIT_CONFIG_PARAMETERS, GIT_CONFIG_SYSTEM, KEYLESS_KEY_ADVICE, MARROW_AGENT_CLIENT, MARROW_AGENT_ID, MARROW_AGENT_RUNTIME, MARROW_AUTO_ENROLL, MARROW_AUTO_HOOK, MARROW_BASE_URL, MARROW_CLIENT, MARROW_CONTEXT_HOOK_DEBUG, MARROW_EVENT_SPOOL_PATH, MARROW_FLEET_AGENT_ID, MARROW_HARNESS, MARROW_HOOK_BACKGROUND_NUDGE, MARROW_HOOK_DEBUG, MARROW_INTERNAL_NUDGE_LOCK, MARROW_KEY, MARROW_MODEL_USAGE_BILLING_MODE, MARROW_MODEL_USAGE_ENDPOINT, MARROW_MODEL_USAGE_PRICING_DIMENSIONS, MARROW_PASSIVE_BRIEF, MARROW_PING_TIMEOUT_MS, MARROW_REQUEST_TIMEOUT_MS, MARROW_SEATBELT_STRICT
Where it talks to
getmarrow.ai (its own)Also claude.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names claude.com as well as its own vendor. The guard injects GITHUB_TOKEN, MARROW_API_KEY, MARROW_PASSIVE_TOKEN_USAGE only into requests to getmarrow.ai (and its subdomains) and refuses the rest.

$vet-skills run --secrets GITHUB_TOKEN=getmarrow.ai,MARROW_API_KEY=getmarrow.ai,MARROW_PASSIVE_TOKEN_USAGE=getmarrow.ai -- npx -y @getmarrow/mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-08 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Destructive file system command detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 22 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
1.7sprocessdependency install exit 0
22sclaimedstartup only: exited (0) before answering · '/tmp/ks-detonate-0SnbA3/task/home/work/acme-api/.claude/skills/mcp/dist/cli.js' ] } Node.js v22.23.4
22sprocessscript backend runs setup only
22sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsdist/hook-pre-action.js:679 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst ONE_NAME_READ = /\bprocess\.env\.(?!(?:items|keys|copy)\b)([A-Za-z_]\w*)/g;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/hook-pre-action.js:771 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* `xargs` string is one word to it). A command that can spell one holds a word of the secret-path table (src/secret-paths.ts: `.env`, `.npmrc`, `.ssh`, ...)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detecteddist/key-class.d.ts:8 · Destructive file system command detected* `-` for the `_`, NFKC/NFKD-foldable forms, zero-width / format / combining characters, percent or Basic-auth base64Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
URL with embedded credentialsdist/redact.js:104 · URL with embedded credentials — may be phishing or credential leaking* holds `@`, `#` or `?` may also hold the real host (`https://deploy:443#@api.example.test` goes to hostFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Access to sensitive file pathsdist/hook-contract.js:542 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…ess\.platform==="win32"\?"npx\.cmd":"npx",a\]\)\(require\("node:fs"\),\(process\.env\.HOME\|\|""\)\+"\/\.marrow\/runtime\/mcp\/(\d+\.\d+\.\d+)\/run",(\["-y","--pack…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/hook-pre-action.js:922 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// reason the mapper only gives a word that is no path (the pattern of `grep .env README.md`) in a command the policy reads whole (policyReadsAllWords).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/env.js:280 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfiles.push(path.join(dir, '.env'));Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/cli.js:311 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Same trusted resolution the installed hooks use: project .env files and non-private owner files cannot supply the key.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/env.js:279 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfiles.push(path.join(dir, '.env.local'));Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detecteddist/env.js:79 · Destructive file system command detected// Paths in notices can be attacker-named: control, line-separator and formatFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/seatbelt/hook.js:141 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst configEnv = { ...env };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/seatbelt/hook.js:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesS4: 'reading, copying or writing secrets (like .env files or private keys)',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/seatbelt/tables.js:70 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Q3: only these .env templates are excepted. Never widen this to other .env files.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commanddist/hook-pre-action.js:770 · Privileged sudo command — agent may execute with elevated privileges* False for a command that cannot read a secret FILE inside code the keyed policy does not parse (a quoted `bash -c`, `eval`, `sudo sh -c`, `ssh host` orFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/hook-pre-action.js:779 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files… that expectation is left as it is. */ const SECRET_FILE_WORDS = /(?<!process)\.env(?![a-z0-9_])|\.(?:ssh|aws|azure|kube|docker|gnupg|config|claude|marrow)|npmrc|n…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/seatbelt/tables.js:82 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files`${h}/.kube/config`, `${h}/.docker/config.json`, `${h}/.npmrc`, `${h}/.pypirc`, `${h}/.netrc`, `${h}/.git-credentials`,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/secret-paths.d.ts:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* above stay unconditional. `<name>.env.example` never matches.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/seatbelt/tables.js:75 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// (a glob or "$X/.env" is a stop when it can expand to one of these).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/seatbelt-mode.d.ts:64 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* environment or the owner files in a trusted home (never repo .env files);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/secret-paths.js:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'**/.kube/config', '**/.docker/config.json', '**/.npmrc', '**/.pypirc', '**/.netrc', '**/.git-credentials',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/cli.js:272 · npx invocation of non-well-known package — may execute untrusted codeconst GET_A_KEY_LINE = `Get a key: ${GET_A_KEY_URL}. Day-one steps and commands: npx @getmarrow/mcp --help`;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
References a credential file in the home directorydist/seatbelt-deploy.js:279 · References a credential file in the home directory* env or the same command) is added to ~/.kube/config, never substituted forFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathsdist/seatbelt-deploy.js:279 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* env or the same command) is added to ~/.kube/config, never substituted forFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/secret-paths.js:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'**/.env', '**/.env.*', '**/.dev.vars',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/seatbelt-mode.js:232 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst passwdText = readSystemFile(fs, '/etc/passwd');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/seatbelt-mode.js:437 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* environment or the owner files in a trusted home (never repo .env files);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/secret-paths.js:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* A `<name>.env` file is read as `.env` is (same operations, same S-code) when it is there toFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/control-notice.d.ts:1 · npx invocation of non-well-known package — may execute untrusted codeexport declare const CONTROL_STATUS_COMMAND = "npx @getmarrow/install control status";Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli.d.ts:8 · npx invocation of non-well-known package — may execute untrusted code* npx @getmarrow/mcp --helpFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/secret-paths.d.ts:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* such as `process.env` in `grep -rn "process.env" src`, is not a secret path; `.env` and `.env.*`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commanddist/cli.js:270 · File permission modification command — agent changes file ownership/permissions…nst PLUGIN_KEY_STEPS = 'Marrow plugin: put MARROW_API_KEY in ~/.marrow/env, run chmod 600 ~/.marrow/env, then /reload-plugins. The seatbelt hooks keep working without…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packagedist/cli.js:259 · npx invocation of non-well-known package — may execute untrusted codeconst ACTIVATE_COMMAND = 'npx -y @getmarrow/install@latest activate';Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli.d.ts:7 · npx invocation of non-well-known package — may execute untrusted code* npx @getmarrow/mcp (reads MARROW_API_KEY from env or an owner-only ~/.marrow/env)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/seatbelt/tables.js:85 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files`${h}/.env`, '/root/.ssh/id_rsa', '/root/.aws/credentials', `${h}/.marrow/seatbelt/salt`,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/cli.js:9 · npx invocation of non-well-known package — may execute untrusted code* npx @getmarrow/mcp --helpFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/secret-paths.d.ts:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* A `<name>.env` file is read as `.env` is (same operations, same S-code) when it is there toFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/cli.js:8 · npx invocation of non-well-known package — may execute untrusted code* npx @getmarrow/mcp (reads MARROW_API_KEY from env or an owner-only ~/.marrow/env)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli.js:291 · npx invocation of non-well-known package — may execute untrusted code4. Verify: npx -y @getmarrow/install@latest doctor --self-testFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/control-state.js:104 · npx invocation of non-well-known package — may execute untrusted code? 'Run npx @getmarrow/install control disable --yes to disable local enforcement.'Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commanddist/env.js:86 · File permission modification command — agent changes file ownership/permissions// Shell operand for a chmod command built from the REAL path. Returns null whenFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commanddist/env.js:54 · File permission modification command — agent changes file ownership/permissionsconst REPO_KEY_FIX = 'run npx @getmarrow/install doctor, or move the line to ~/.marrow/env, then chmod 600 ~/.marrow/env';Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commanddist/env.js:441 · File permission modification command — agent changes file ownership/permissions// refused, so a symlinked file or folder gets no chmod operand on that path.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packagedist/env.js:54 · npx invocation of non-well-known package — may execute untrusted codeconst REPO_KEY_FIX = 'run npx @getmarrow/install doctor, or move the line to ~/.marrow/env, then chmod 600 ~/.marrow/env';Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/control-notice.js:12 · npx invocation of non-well-known package — may execute untrusted codeexports.CONTROL_STATUS_COMMAND = 'npx @getmarrow/install control status';Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commanddist/env.js:445 · File permission modification command — agent changes file ownership/permissionsreturn `${lead} Fix: replace the symlink with the real file (owner-only, mode 600); do not run chmod on the link.`;Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packagedist/control-state.js:105 · npx invocation of non-well-known package — may execute untrusted code: 'Run npx @getmarrow/install control enable to resume local enforcement; hook processes poll this state without reinstalling.',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/env.js:489 · npx invocation of non-well-known package — may execute untrusted code…storage or place it in ~/.marrow/env with owner-only permissions before running npx -y --package=@getmarrow/mcp@latest marrow-mcp setup.' + (ignored ? `\n…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commanddist/env.js:440 · File permission modification command — agent changes file ownership/permissions// chmod follows a symlink and would change its target while the link staysFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packagedist/hook-context.js:13 · npx invocation of non-well-known package — may execute untrusted code* Both hooks are installed by `npx @getmarrow/mcp setup`. Either can beFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/hook-context.d.ts:12 · npx invocation of non-well-known package — may execute untrusted code* Both hooks are installed by `npx @getmarrow/mcp setup`. Either can beFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/hook-context.js:273 · npx invocation of non-well-known package — may execute untrusted codeconst match = /^(?:npx @getmarrow\/install@(\S+) --repair|npx @getmarrow\/mcp@(\S+) setup|npx -y --package=@getmarrow\/mcp@(\S+) marrow-mcp setup|npm install @getmarrow\/sdk@(\S+))$/.exec(command);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/control-routes.d.ts:3 · npx invocation of non-well-known package — may execute untrusted code* (`npx @getmarrow/install ...`, `marrow-install ...`, `node .../@getmarrow/install/bin/marrow-install.js ...`) with a `control` word otherFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/control-state.js:109 · npx invocation of non-well-known package — may execute untrusted code…exact_next_action: 'Inspect and replace unsafe ~/.marrow/control.json, then run npx @getmarrow/install control status; protected actions remain blocked.' }; } } //# sourceMapping…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/control-state.js:18 · npx invocation of non-well-known package — may execute untrusted codesuper('Local Marrow control state is unsafe or invalid. Protected actions remain blocked; inspect ~/.marrow/control.json and run npx @getmarrow/install control status.');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/control-routes.js:8 · npx invocation of non-well-known package — may execute untrusted code* (`npx @getmarrow/install ...`, `marrow-install ...`, `node .../@getmarrow/install/bin/marrow-install.js ...`) with a `control` word otherFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/env.js:476 · npx invocation of non-well-known package — may execute untrusted codeexactFix: `Marrow key was found in ${printablePath(filePath)}. Keep this file private and run npx @getmarrow/install doctor to verify.`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/host-approval.d.ts:40 · npx invocation of non-well-known package — may execute untrusted code* Codex's kill clock starts when it spawns the hook command, so the time npxFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/hook-contract.js:541 · npx invocation of non-well-known package — may execute untrusted code…\\d+\\.\\d+\\.\\d+)/run"; if \\[ -x "\\$M" \\]; then "\\$M" ${LOCAL_ARGS}; else npx -y --package=@getmarrow/mcp@\\2 marrow-mcp \\3; fi; \\}`, 'g'); const LOCAL_SPAWN_…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commanddist/hook-pre-action.js:65 · File permission modification command — agent changes file ownership/permissions…ow.ai/docs#start-here (Claude Code plugin: put MARROW_API_KEY in ~/.marrow/env, chmod 600, then /reload-plugins). Agent: do not retry this action.'; /** Seatbelt mode…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commanddist/hook-pre-action.js:92 · File permission modification command — agent changes file ownership/permissionsconst PLUGIN_KEY_HINT = ' (Claude Code plugin: put MARROW_API_KEY in ~/.marrow/env, chmod 600, then /reload-plugins)';Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commanddist/host-approval.d.ts:40 · Process kill command — agent can terminate processes* Codex's kill clock starts when it spawns the hook command, so the time npxFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/hook-pre-action.js:74 · npx invocation of non-well-known package — may execute untrusted code…dit Marrow settings; tell the user it was stopped. If this keeps happening, run npx -y @getmarrow/install@latest doctor. Code: U5.fail_closed/hook_error.'; /** * Sea…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/hook-contract.js:548 · npx invocation of non-well-known package — may execute untrusted codeconst INSTALLER_REPAIR = 'The owner can repair it by running npx -y @getmarrow/install@latest --repair --cwd <project folder> from a terminal outside the project.';Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/hook-contract.js:48 · npx invocation of non-well-known package — may execute untrusted codeconst hookCommand = (entrypoint) => `npx -y --package=${exports.MCP_PACKAGE_SPEC} marrow-mcp ${entrypoint}`;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/hook-pre-action.js:72 · npx invocation of non-well-known package — may execute untrusted code…this machine\'s setup. Fix (for the person at this machine, not the agent): run npx -y @getmarrow/install@latest doctor, or add a Marrow key (getmarrow.ai/docs#start-…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/hook-contract.js:563 · npx invocation of non-well-known package — may execute untrusted code* The npx form of an installer local-runtime hook command, or the commandFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/hook-pre-action.js:282 · npx invocation of non-well-known package — may execute untrusted codeconst DOCTOR_FIX = 'Run `npx -y @getmarrow/install@latest doctor` in this terminal to check this machine\'s Marrow setup, then retry.';Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/hook-contract.d.ts:74 · npx invocation of non-well-known package — may execute untrusted code* The npx form of an installer local-runtime hook command, or the commandFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/host-approval.d.ts:29 · Process kill command — agent can terminate processes* hook process and set from each host's real kill timeout asFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/hook-pre-action.js:67 · npx invocation of non-well-known package — may execute untrusted codeexports.CLAIMED_NO_KEY_TEXT = 'Marrow is linked to an account but has no working key; owner: run `npx -y @getmarrow/install@latest doctor`.';Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/hook-pre-action.js:300 · npx invocation of non-well-known package — may execute untrusted codereturn 'Marrow doesn\'t know this agent yet. Run `npx @getmarrow/install` again in this terminal, then retry.';Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/host-approval.d.ts:32 · npx invocation of non-well-known package — may execute untrusted code* Gemini CLI 5 s. The margin covers npx start-up before the process starts.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/hook-contract.js:540 · npx invocation of non-well-known package — may execute untrusted code…d+\\.\\d+)/run"; if \\[ -x "\\$M" \\]; then exec "\\$M" ${LOCAL_ARGS}; fi; exec npx -y --package=@getmarrow/mcp@\\2 marrow-mcp \\3'$`); const LOCAL_INNER_RE = new Reg…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commanddist/seatbelt/hook.js:50 · File permission modification command — agent changes file ownership/permissions…ow.ai/docs#start-here (Claude Code plugin: put MARROW_API_KEY in ~/.marrow/env, chmod 600, then /reload-plugins).'; /** The label of a stop. A script Marrow could not…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packagedist/host-capability.js:94 · npx invocation of non-well-known package — may execute untrusted code…nd host hook review. The governed wrapper remains an explicit bounded fallback: npx @getmarrow/install run --agent <agent-id> -- -- <command>.', capability.exact_next_action,…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/host-approval.js:107 · npx invocation of non-well-known package — may execute untrusted code// Codex: 5 s kill, then it runs the call. npx start-up before this processFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commanddist/self-protect.d.ts:3 · File permission modification command — agent changes file ownership/permissions* T2 (control-file gap): a write, delete, move or chmod of Marrow's own control files, of the hooks settings of any host, or of theFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commanddist/host-session.js:757 · Process kill command — agent can terminate processes* `sh -c` wrapper), in milliseconds, so a host's kill clock that started atFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/lifecycle-spool.js:627 · npx invocation of non-well-known package — may execute untrusted code…ial from trusted secret storage and its exact original agent identity, then run npx -y --package=@getmarrow/mcp@latest marrow-mcp drain-spool. Never put the credentia…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Unicode escape sequence detecteddist/seatbelt/tables.js:567 · Unicode escape sequence detected — may contain obfuscated payloads…or line break first. return text.replace(/[\u2028\u2029]/g, '\n').replace(/[\u000b\u000c\u00a0\u0085\u1680\u2000-\u200a\u202f\u205f\u3000]/g, ' ').replace(/[\u2013\u2014\u2015]/g, '-').replace…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
npx invocation of non-well-known packagedist/host-approval.js:101 · npx invocation of non-well-known package — may execute untrusted code* Gemini CLI 5 s. The margin covers npx start-up before the process starts.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/lifecycle-spool.js:685 · npx invocation of non-well-known package — may execute untrusted code…recovery is exhausted; no local action is required. An explicit operator drain (npx -y --package=@getmarrow/mcp@latest marrow-mcp drain-spool) remains available but i…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/host-approval.js:117 · Process kill command — agent can terminate processes* Codex's kill clock starts when it spawns the hook command, so the time npxFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/host-approval.js:98 · Process kill command — agent can terminate processes* hook process and set from each host's real kill timeout asFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/host-session.js:745 · npx invocation of non-well-known package — may execute untrusted code// npm rewrites its process title: /proc shows "npm exec …" (or "npx …") as one string.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/host-session.js:743 · npx invocation of non-well-known package — may execute untrusted code/** A process that only launches the hook: npx or npm (exec), or a `sh -c` wrapper. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/host-capability.js:86 · npx invocation of non-well-known package — may execute untrusted code…e MCP tools on demand. For consequential CLI actions, use the governed wrapper: npx @getmarrow/install run --agent <agent-id> -- -- <command>. Custom hosts need a bounded event adapt…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/seatbelt/hook.d.ts:14 · npx invocation of non-well-known package — may execute untrusted codeexport declare const CLAIMED_NO_KEY_TEXT = "Marrow is linked to an account but has no working key; owner: run `npx -y @getmarrow/install@latest doctor`.";Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/lifecycle-spool.js:681 · npx invocation of non-well-known package — may execute untrusted code? 'The server rejected delivery authentication or authorization. Restore the credential and agent binding, then run npx -y --package=@getmarrow/mcp@latest marrow-mcp drain-spool.'Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/seatbelt/hook.js:25 · npx invocation of non-well-known package — may execute untrusted codeexports.CLAIMED_NO_KEY_TEXT = 'Marrow is linked to an account but has no working key; owner: run `npx -y @getmarrow/install@latest doctor`.';Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/host-approval.js:117 · npx invocation of non-well-known package — may execute untrusted code* Codex's kill clock starts when it spawns the hook command, so the time npxFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commanddist/keyless-notice.js:13 · File permission modification command — agent changes file ownership/permissions…, so holds and approvals are NOT recorded. Put MARROW_API_KEY in ~/.marrow/env (chmod 600) or start the host with it, then restart the session.'; let armed = false; f…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commanddist/host-session.d.ts:109 · Process kill command — agent can terminate processes* `sh -c` wrapper), in milliseconds, so a host's kill clock that started atFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈59 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @getmarrow/mcp@3.9.112 as of 6d ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim getmarrow: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. References a credential file in the home directory≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim getmarrowPropose a patch to the maintainer