Skills/npm/po-mcp-proxy

po-mcp-proxy@0.0.1-alpha.119

VERIFIED· not started

Publisher claims: "MCP proxy server package" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher agimon-ai · publishing for 253 daysInstalls 30,865Last detonated 4d ago
$claude mcp add po-mcp-proxy -- npx -y @agimon-ai/po-mcp-proxy
WatchReport an issue

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
AGIFLOW_API_KEYAPI_KEYINTERNAL_TOKENMY_API_KEYConfiguration, not credentials: MCP_HOST, MCP_PORT, MCP_PROXY_RUNTIME_LIFECYCLE, PORT_REGISTRY_PATH, PROCESS_REGISTRY_PATH, PROJECT_PATH
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard. It asks for AGIFLOW_API_KEY, API_KEY, INTERNAL_TOKEN, MY_API_KEY and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --net declared -- npx -y @agimon-ai/po-mcp-proxy

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-11 and scored it 83/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 29 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
29sprocessdependency install exit 1 · (Use `node --trace-warnings ...` to show where the warning was created) npm error Cannot read properties of null (reading 'edgesOut') npm error A complete log of this run can be found in: /tmp/ks-detonate-ID8UP4/task/home/.npm/_logs/2026-11-11T00_38_24_931Z-debug-0.log
29sclaimednot started: dependency install failed (exit 1); the server itself was not observed
29sprocessscript backend runs setup only
29sprocessno install scripts to re-run

Static findings

MEDIUM
File type combined with upload actiondist/cli.cjs:4 · File type combined with upload action — agent may exfiltrate local data files…ull,2))}else{if(l.length>0){console.log(` Found tools: `);for(let e of l)console.log(`Server: ${e.server}`),console.log(`Tool: ${e.name}`),console.log(`Description: ${e.description||`No description`}`),console.log(`Input Schema:`),console.…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/cli.cjs:2 · File type combined with upload action — agent may exfiltrate local data files… r}function h(e,t){let n=t?`Would stop`:`Stopped`;for(let t of e.stopped)console.log(`${n} orphaned runtime '${t.serverId}' (http://${t.host}:${t.port}) — ${t.reason}`);let r=t?`Would remove`:`Removed`;for(let t of e.removedFiles)console.l…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Auto-update or dynamic fetch configurationdist/src-Bc5ACepW.mjs:1 · Auto-update or dynamic fetch configuration — agent may load new code at runtime…=D.object({id:D.string().optional(),proxy:qt,mcpServers:D.record(D.string(),Vt),remoteConfigs:D.array(Wt).optional(),skills:Gt.optional()}),Yt=D.object({command:D.string(),args:D.array(D.string()).optional(),env:D.record(D.string(),D.strin…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationdist/src-6ZqdbXl9.cjs:1 · Auto-update or dynamic fetch configuration — agent may load new code at runtime…ect({id:v.z.string().optional(),proxy:ot,mcpServers:v.z.record(v.z.string(),et),remoteConfigs:v.z.array(rt).optional(),skills:it.optional()}),ct=v.z.object({command:v.z.string(),args:v.z.array(v.z.string()).optional(),env:v.z.record(v.z.st…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
MCP server using network transport (SSE/HTTP)dist/cli.mjs:141 · MCP server using network transport (SSE/HTTP) — data sent over network…f YAML`,!1).option(`-f, --force`,`Overwrite existing config file`,!1).option(`--mcp-servers <json>`,`JSON string of MCP servers to add to config (optional)`).action(async e=>{try{let t=O(e.output),n=!e.json&&(t.endsWith(`.yaml`)||t.endsWit…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actiondist/src-Bc5ACepW.mjs:4 · File type combined with upload action — agent may exfiltrate local data files…let n=An(t[0]);if(t.length===1)return v(T(),`.mcp-proxy`,`${n}.definitions-cache.json`);let r=S(`sha256`).update(t.map(e=>y(e)).join(`\0`)).digest(`hex`).slice(0,12);return v(T(),`.mcp-proxy`,`${n}.${r}.definitions-cache.json`)}static gene…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)dist/src-Bc5ACepW.mjs:55 · MCP server using network transport (SSE/HTTP) — data sent over network…),p=e?.definitionsCachePath||U.getDefaultCachePath(x),C.registerServerConfigs(S.mcpServers),e?.clearDefinitionsCache&&p&&(await U.clearFile(p),o.info(`[definitions-cache] Cleared ${p}`)),p){let e=await U.inspectFile(p,{configHash:f,oneMcpV…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actiondist/cli.cjs:141 · File type combined with upload action — agent may exfiltrate local data files…# # instruction: Optional user override {% endif %} `;function T(e=``){console.log(e)}function E(e,t){console.error(t?`${e} ${t}`:e)}const D={info:e=>T(e),error:(e,t)=>E(e,t)},O={info:e=>T(e),warning:e=>T(`Warning: ${e}`),error:e=>E(e),suc…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/cli.mjs:2 · File type combined with upload action — agent may exfiltrate local data files…n}function _e(e,t){let n=t?`Would stop`:`Stopped`;for(let t of e.stopped)console.log(`${n} orphaned runtime '${t.serverId}' (http://${t.host}:${t.port}) — ${t.reason}`);let r=t?`Would remove`:`Removed`;for(let t of e.removedFiles)console.l…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)dist/src-Bc5ACepW.mjs:9 · MCP server using network transport (SSE/HTTP) — data sent over network…,{...n,redirect:`error`})}}var dr=class extends Error{serverName;attempts;code=`MCP_SERVER_RECOVERY_EXHAUSTED`;constructor(e,t,n){super(`MCP server "${e}" did not recover after ${t} attempts.`,n),this.serverName=e,this.attempts=t,this.name…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actiondist/src-6ZqdbXl9.cjs:9 · File type combined with upload action — agent may exfiltrate local data files…a})}),r.on(`error`,e=>{n({success:!1,output:e.message})})})}};const Bn=`.runtime.json`;async function Vn(e){await(0,c.mkdir)(e,{recursive:!0,mode:448});try{await(0,c.chmod)(e,448)}catch{}}function Hn(e){return typeof e==`object`&&!!e}funct…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)dist/src-6ZqdbXl9.cjs:1 · MCP server using network transport (SSE/HTTP) — data sent over network…,outputGuard:at}).optional(),st=v.z.object({id:v.z.string().optional(),proxy:ot,mcpServers:v.z.record(v.z.string(),et),remoteConfigs:v.z.array(rt).optional(),skills:it.optional()}),ct=v.z.object({command:v.z.string(),args:v.z.array(v.z.str…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actiondist/src-6ZqdbXl9.cjs:1 · File type combined with upload action — agent may exfiltrate local data files…equire("@modelcontextprotocol/server/stdio");const se=[`pnpm-workspace.yaml`,`nx.json`,`.git`];async function O(e=process.env.PROJECT_PATH||process.cwd()){let t=l.default.resolve(e);for(;;){for(let e of se)try{return await(0,c.access)(l.de…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)dist/cli.cjs:141 · MCP server using network transport (SSE/HTTP) — data sent over network…f YAML`,!1).option(`-f, --force`,`Overwrite existing config file`,!1).option(`--mcp-servers <json>`,`JSON string of MCP servers to add to config (optional)`).action(async e=>{try{let r=(0,n.resolve)(e.output),i=!e.json&&(r.endsWith(`.yaml`…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actiondist/src-6ZqdbXl9.cjs:4 · File type combined with upload action — agent may exfiltrate local data files…length===1)return(0,l.join)((0,f.homedir)(),`.mcp-proxy`,`${n}.definitions-cache.json`);let r=(0,u.createHash)(`sha256`).update(t.map(e=>(0,l.resolve)(e)).join(`\0`)).digest(`hex`).slice(0,12);return(0,l.join)((0,f.homedir)(),`.mcp-proxy`,…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)dist/src-Bc5ACepW.mjs:1 · MCP server using network transport (SSE/HTTP) — data sent over network…al(),outputGuard:Kt}).optional(),Jt=D.object({id:D.string().optional(),proxy:qt,mcpServers:D.record(D.string(),Vt),remoteConfigs:D.array(Wt).optional(),skills:Gt.optional()}),Yt=D.object({command:D.string(),args:D.array(D.string()).optiona…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actiondist/cli.mjs:141 · File type combined with upload action — agent may exfiltrate local data files…# # instruction: Optional user override {% endif %} `;function P(e=``){console.log(e)}function F(e,t){console.error(t?`${e} ${t}`:e)}const I={info:e=>P(e),error:(e,t)=>F(e,t)},L={info:e=>P(e),warning:e=>P(`Warning: ${e}`),error:e=>F(e),suc…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/cli.mjs:7 · File type combined with upload action — agent may exfiltrate local data files…onsole.log(``)}if(p.length>0){console.log(` Next steps:`);for(let e of p)console.log(` • ${e}`);console.log(``)}d.length>0&&console.error(`\nTools/skills not found: ${d.join(`, `)}`),l.length===0&&u.length===0&&(console.error(`No tools or …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/src-Bc5ACepW.mjs:9 · File type combined with upload action — agent may exfiltrate local data files…a})}),r.on(`error`,e=>{n({success:!1,output:e.message})})})}};const Er=`.runtime.json`;async function Dr(e){await r(e,{recursive:!0,mode:448});try{await t(e,448)}catch{}}function Or(e){return typeof e==`object`&&!!e}function kr(e){return O…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File permission modification commanddist/src-Bc5ACepW.mjs:1 · File permission modification command — agent changes file ownership/permissionsimport{access as e,chmod as t,lstat as n,mkdir as r,mkdtemp as i,open as a,readFile as o,readdir as s,ren…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)dist/src-6ZqdbXl9.cjs:9 · MCP server using network transport (SSE/HTTP) — data sent over network…,{...n,redirect:`error`})}}var Tn=class extends Error{serverName;attempts;code=`MCP_SERVER_RECOVERY_EXHAUSTED`;constructor(e,t,n){super(`MCP server "${e}" did not recover after ${t} attempts.`,n),this.serverName=e,this.attempts=t,this.name…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actiondist/cli.mjs:4 · File type combined with upload action — agent may exfiltrate local data files…ull,2))}else{if(l.length>0){console.log(` Found tools: `);for(let e of l)console.log(`Server: ${e.server}`),console.log(`Tool: ${e.name}`),console.log(`Description: ${e.description||`No description`}`),console.log(`Input Schema:`),console.…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/src-Bc5ACepW.mjs:1 · File type combined with upload action — agent may exfiltrate local data files… Be}from"@modelcontextprotocol/server/stdio";const Ve=[`pnpm-workspace.yaml`,`nx.json`,`.git`];async function j(t=process.env.PROJECT_PATH||process.cwd()){let n=h.resolve(t);for(;;){for(let t of Ve)try{return await e(h.join(n,t)),n}catch{c…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/cli.cjs:7 · File type combined with upload action — agent may exfiltrate local data files…onsole.log(``)}if(p.length>0){console.log(` Next steps:`);for(let e of p)console.log(` • ${e}`);console.log(``)}d.length>0&&console.error(`\nTools/skills not found: ${d.join(`, `)}`),l.length===0&&u.length===0&&(console.error(`No tools or …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)dist/src-6ZqdbXl9.cjs:55 · MCP server using network transport (SSE/HTTP) — data sent over network…),m=e?.definitionsCachePath||U.getDefaultCachePath(x),C.registerServerConfigs(S.mcpServers),e?.clearDefinitionsCache&&m&&(await U.clearFile(m),o.info(`[definitions-cache] Cleared ${m}`)),m){let e=await U.inspectFile(m,{configHash:p,oneMcpV…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04

Cost to the agent

Instructions loaded
≈50 tok
1 file · 10 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @agimon-ai/po-mcp-proxy@0.0.1-alpha.119 as of 4d ago. This is the package itself, not its dependencies.