Skills/npm/mcpvetter

mcpvetter@0.1.3

CAUTION· startup only

Publisher claims: "Audit your MCP servers for poisoned tools and leaked secrets, and check AI-generated code for flaws." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server) · listed in the official MCP RegistryPublisher mcpvetter · publishing for 12 daysInstalls 0Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
MCPVETTER_API_KEYConfiguration, not credentials: MCPVETTER_HOME, MCPVETTER_ORIGIN, NAME, SQL_KEYWORD_RE
Where it talks to
mcpvetter.com (its own)Also fixed.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names fixed.com as well as its own vendor. The guard injects MCPVETTER_API_KEY only into requests to mcpvetter.com (and its subdomains) and refuses the rest.

$vet-skills run --secrets MCPVETTER_API_KEY=mcpvetter.com -- npx -y mcpvetter

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-11 and scored it 58/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Bidirectional text override characters detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 30 s · 2 scenarios
t+CategoryObserved action
0.0sprocessno install scripts in bundle
9.8sprocessdependency install exit 0
30sfilesystemread ~/.mcpvetter/config.json outside project
30sclaimedstartup only: exited (0) before answering · mcpvetter serve Run as a local MCP server over stdio Exit codes: 0 = no findings at or above --fail-on (default high), 1 = findings at or above it, 2 = could not complete. Static scans are local and offline. Nothing is sent anywhere unless you configure an API key. --live starts each configured server (exactly as your AI client would) to read its tool list. It asks f
30sprocessscript backend runs setup only
30sprocessno install scripts to re-run

Static findings

MEDIUM
Remote installer piped to shelldist/scanner/rules/static.js:122 · Remote installer piped to shell…on, or redirection, and any argument that pipes a download into an interpreter (curl ... | sh). The plain Windows wrapper `cmd /c npx ...` is not flagged.", lab: "lab-10…Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Process kill commanddist/engine/redact.d.ts:4 · Process kill command — agent can terminate processes* false positives, and false positives are what kill this product.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/scanner/launch.js:31 · npx invocation of non-well-known package — may execute untrusted code// npx / bunx / pnpm dlx / yarn dlxFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/scanner/rules/static.js:122 · npx invocation of non-well-known package — may execute untrusted code…download into an interpreter (curl ... | sh). The plain Windows wrapper `cmd /c npx ...` is not flagged.", lab: "lab-10-mcp-install", pattern: "mcp-config", …Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/code/rules/secret.js:27 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…ger (process.env.NAME, os.environ[\"NAME\"]) and keep the value in an untracked .env file or your platform's secret store.", method: "Flags string literals that…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/scanner/rules/static.js:153 · npx invocation of non-well-known package — may execute untrusted codefix: "Pin an exact version you have reviewed (npx -y [email protected], uvx package==1.2.3, image:tag or image@sha256:...), and re-scan after each deliberate upgrade.",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/scanner/rules/static.js:5 · File type combined with upload action — agent may exfiltrate local data filesconst ENV_REF_FIX = 'Claude Code and Claude Desktop expand "${VAR}" in .mcp.json, Cursor expands "${env:VAR}", and VS Code supports "${input:...}" prompts or an "envFile".';Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsdist/scanner/rules/live.js:25 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files{ re: /(?:~|\$HOME|%USERPROFILE%)?[\\/]\.(?:ssh|aws|gnupg|kube|docker)\b|\bid_(?:rsa|ed25519|ecdsa)\b|\.npmrc\b|\.netrc\b|\bcredentials\.json\b/i, label: "references credential files" },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)dist/code/rules/mcpcfg.js:114 · MCP server using network transport (SSE/HTTP) — data sent over network…very update.", method: "Parses MCP configuration JSON found in the snippet (mcpServers, servers, mcp.servers) and flags: npx/bunx/uvx/pipx packages without an exact version (including @latest); secret-looking values in env, headers or args…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actiondist/mcp/tools.js:209 · File type combined with upload action — agent may exfiltrate local data files…This remote server cannot read your files: pass the JSON of your MCP config (mcp.json, .mcp.json, claude_desktop_config.json). Secret values are redacted in the output and the config is not stored.", inputSchema: { config: z.st…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/scanner/launch.js:9 · npx invocation of non-well-known package — may execute untrusted code/** Unwrap `cmd /c npx ...` (the standard Windows wrapper) so the real launcher is analysed. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/cli.js:63 · File type combined with upload action — agent may exfiltrate local data files// `--json out.json` form: treat a following .json positional as the output file.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File permission modification commandpackage.json:34 · File permission modification command — agent changes file ownership/permissions"build": "tsc -p tsconfig.json && chmod +x dist/cli.js",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Bidirectional text override characters detecteddist/scanner/rules/live.js:84 · Bidirectional text override characters detected — may hide content directionconst INVISIBLE = /[\u{E0000}-\u{E007F}​-‏‪-‮⁠-⁤⁦-⁩­]/u;Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
npx invocation of non-well-known packagedist/mcp/tools.js:218 · npx invocation of non-well-known package — may execute untrusted code…desktop_config.json). For a full local scan including live tool inspection run: npx mcpvetter scan --live"); const blocked = await gate(backend, "check_mcp_setup"); …Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/code/rules/mcpcfg.js:113 · npx invocation of non-well-known package — may execute untrusted code… someone else's code to run.", fix: "Pin every package to an exact version (npx -y @scope/[email protected], uvx package==1.2.3), reference secrets as ${ENV_VAR} inste…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/mcp/tools.js:208 · npx invocation of non-well-known package — may execute untrusted code…etup or a server is safe. Static and local; for tool-description poisoning run `npx mcpvetter scan --live` in a terminal." : "Audit an MCP configuration for leak…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/scanner/rules/live.js:26 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…clude|attach|pass|send|upload)\b[^.]{0,60}\b(?:mcp\.json|claude_desktop_config|\.env\b|\.cursor[\\/]mcp|\.claude\.json)/i, label: "asks the model to read MCP or env…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Hidden zero-width characters detecteddist/scanner/rules/live.js:84 · Hidden zero-width characters detected — may conceal contentconst INVISIBLE = /[\u{E0000}-\u{E007F}​-‏‪-‮⁠-⁤⁦-⁩­]/u;Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Access to sensitive file pathsdist/code/rules/secret.js:6 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst ENV_LOOKUP_RE = /process\.env|os\.environ|getenv|import\.meta\.env|Deno\.env|config\(|secrets\./;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/scanner/rules/static.js:121 · npx invocation of non-well-known package — may execute untrusted codefix: "Launch the server binary or package directly with a pinned version (for example npx -y [email protected]) and pass configuration through env, not a shell one-liner.",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/scanner/launch.d.ts:17 · npx invocation of non-well-known package — may execute untrusted code/** Unwrap `cmd /c npx ...` (the standard Windows wrapper) so the real launcher is analysed. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
CRITICAL
Pipe-to-shell patterndist/scanner/rules/static.js:122 · Pipe-to-shell pattern — downloads and immediately executes remote code…on, or redirection, and any argument that pipes a download into an interpreter (curl ... | sh). The plain Windows wrapper `cmd /c npx ...` is not flagged.", lab: "lab-10…Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
npx invocation of non-well-known packagedist/mcp/tools.js:227 · npx invocation of non-well-known package — may execute untrusted codereturn text(`${head}\nNo findings from static checks.${r.notes.length ? `\n${r.notes.join("\n")}` : ""}\nFor tool-description poisoning and drift checks run: npx mcpvetter scan --live`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈62 tok
1 file · 72 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcpvetter@0.1.3 as of 3d ago. This is the package itself, not its dependencies.

What would make this Verified

22 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Unclaimed publisher≈ +8 on the totalClaim mcpvetter: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Bidirectional text override characters detected≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  6. Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim mcpvetterPropose a patch to the maintainer