pi-mcp@1.4.0

CAUTION

Publisher claims: "Standalone Model Context Protocol client for pi and other applications" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher earendil-works · joined 0 days agoInstalls 4.9MLast detonated 2 h ago

Dispute verdict

Behavior trace

Honeypot run · 2 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

1.7sprocessdependency install exit 1

2.0sprocessexec /usr/bin/timeout

2.0sprocessexited 1: Node.js v22.23.4

2.0sclaimedno tools/list reply (exit 1)

2.0sprocessscript backend runs setup only

Static findings

CRITICAL

Access to sensitive file pathsdist/transports/stdio.js:75 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

No other findings across 3,464 lines in 41 files.