mcpvault@0.18.4
VERIFIEDPublisher claims: "Universal AI bridge for Obsidian vaults - connect any MCP-compatible assistant" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher bitbonsai · publishing for 248 daysInstalls 77,791Last detonated 2 h ago
Coverage
Server started and answered tools/list.- Tested
- MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
- Not tested
- what the tools do when called with real credentials
Before you give it your token
- It will ask for
- no credential variables read in the code
- Where it talks to
- no vendor host named in the code
- What the honeypot saw
- no credential files read · no network
- What we could not test
- what the tools do when called with real credentials
Reasonable to connect. No credential asked for, no third-party host named, Server started and answered tools/list.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-15 and scored it 92/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 32 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
11sprocessdependency install exit 0
31sclaimed18 tools: read_note, write_note, patch_note, list_directory, delete_note, search_notes, move_note, move_file, read_multiple_notes, update_frontmatter, get_notes_info, get_frontmatter, manage_tags, get_vault_stats, list_all_tags, wiki_link, get_note_outline, read_note_lines
31stools2d796a8335c5ce8a
31stools79e093ba51fb3276
31stoolsaa1ace5e1063685c
31stoolsc949de224fae8a17
31stoolsbc834e9ad506de55
31stools0973b11cb4739f6b
31stoolsd32f5daadbf4c07a
31stoolsdaf10ed5e9968eb3
31stools217142767903a449
31stools523c1346c58bd67a
31stoolsdf033e06488dffb2
31stoolsa468c991d09414d2
31stools1a7d5fa42d4aec58
31stools9d055cfacfbc9b4e
31stools3ecc6ae6ba22a121
31stoolse011f6bcb1b6d528
31stools84da3af476e512c3
31stools7891521362604db0
31sprocessscript backend runs setup only
31sprocessno install scripts to re-run
Static findings
MEDIUM
npx invocation of non-well-known packagedist/server.js:43 · npx invocation of non-well-known package — may execute untrusted code
AST06npx @bitbonsai/mcpvault ~/Documents/MyVaultFix: Pin versions and sources; vendor anything fetched at install time.LOW
Prompt injectionREADME.md:290 · Prompt injection — known jailbreak technique reference · informational: not an instruction file
AST011. Access ChatGPT developer mode (beta feature)Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.LOW
Authorization escalation languageREADME.md:288 · Authorization escalation language · informational: not an instruction file
AST01ChatGPT uses MCP through Deep Research and developer mode. Configuration is done through the ChatGPT interface:Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
npx invocation of non-well-known packagedist/server.js:45 · npx invocation of non-well-known package — may execute untrusted code
AST06npx @bitbonsai/mcpvault ./Vault --read-onlyFix: Pin versions and sources; vendor anything fetched at install time.LOW
Authorization escalation languageREADME.md:290 · Authorization escalation language · informational: not an instruction file
AST011. Access ChatGPT developer mode (beta feature)Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Prompt injectionREADME.md:288 · Prompt injection — known jailbreak technique reference · informational: not an instruction file
AST01ChatGPT uses MCP through Deep Research and developer mode. Configuration is done through the ChatGPT interface:Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
npx invocation of non-well-known packagedist/server.js:27 · npx invocation of non-well-known package — may execute untrusted code
AST06npx @bitbonsai/mcpvault [vault-path] [--read-only[=true|false]] [--exclude <subtree>]...Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/server.js:44 · npx invocation of non-well-known package — may execute untrusted code
AST06npx @bitbonsai/mcpvault ./VaultFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/server.js:42 · npx invocation of non-well-known package — may execute untrusted code
AST06npx @bitbonsai/mcpvaultFix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Instructions loaded
≈57 tok
1 file · 30 in bundle
Tool list per prompt
≈2,579 tok
18 tools · 143 per tool
Handshake
813 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 124
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for @bitbonsai/mcpvault@0.18.4 as of 2 h ago. This is the package itself, not its dependencies.