Skills/npm/po-mcp

po-mcp@0.0.0-alpha.149

CAUTION· not started

Publisher claims: "Domain-aware MCP server selection and access boundaries for Pi sessions composed with Po." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher agimon-ai · publishing for 253 daysInstalls 30,585Last detonated 40 h ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
MCP_AUTHORIZATION_API_PATH
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard. It asks for MCP_AUTHORIZATION_API_PATH and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --net declared -- npx -y @agimon-ai/po-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-12 and scored it 76/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Prompting user to enter sensitive credentials; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 44 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
44sprocessdependency install exit 1 · (Use `node --trace-warnings ...` to show where the warning was created) npm error Cannot read properties of null (reading 'edgesOut') npm error A complete log of this run can be found in: /tmp/ks-detonate-UUnWqs/task/home/.npm/_logs/2026-11-12T22_38_00_136Z-debug-0.log
44sclaimednot started: dependency install failed (exit 1); the server itself was not observed
44sprocessscript backend runs setup only
44sprocessno install scripts to re-run

Static findings

MEDIUM
MCP server using network transport (SSE/HTTP)dist/extensions/server.mjs:3705 · MCP server using network transport (SSE/HTTP) — data sent over networkfunction createMcpServerRuntime(environment = {}, workspaceRoot, getResolver, publishFile, assertPackageActive, getVault, getFs, hostSettings) {Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)dist/extensions/server.cjs:1987 · MCP server using network transport (SSE/HTTP) — data sent over network…1,64}$/u.test(value.name) && !RESERVED.has(value.name.toLowerCase()) && require_mcpServerConfig.isSecretValue(value.value)) return { [value.name]: value.value }; throw new Error("…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)dist/extensions/server.cjs:3227 · MCP server using network transport (SSE/HTTP) — data sent over networkif (!require_mcpServerConfig.isSecretName(name) || !require_mcpServerConfig.isSecretValue(value)) throw new require_mcpServerConfig.McpSecretSupplyError(400, "Enter the secret as one line.");Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)dist/extensions/server.cjs:1986 · MCP server using network transport (SSE/HTTP) — data sent over networkif (value?.kind === "bearer" && require_mcpServerConfig.isSecretValue(value.token)) return { Authorization: `Bearer ${value.token}` };Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
CRITICAL
Prompting user to enter sensitive credentialsdist/extensions/server.cjs:3227 · Prompting user to enter sensitive credentials — social engineeringif (!require_mcpServerConfig.isSecretName(name) || !require_mcpServerConfig.isSecretValue(value)) throw new require_mcpServerConfig.McpSecretSupplyError(400, "Enter the secret as one line.");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathsdist/mcpServerConfig-D4CfVl5n.mjs:1160 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files...env ? { env } : {}Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)dist/mcpServerConfig-D4CfVl5n.mjs:1288 · MCP server using network transport (SSE/HTTP) — data sent over network…_QUERY as C, mcpScopeToWire as D, formatMcpSessionAuthStatus as E, connectRemoteMcpServers as F, writeSecrets as G, prepareSecretAddition as H, isUnauthorized as I, publishFileParams as J, createConsentedFilePublisher as K, readPoMcpRemote…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathsdist/mcpServerConfig-MsdUdLuv.cjs:1160 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files...env ? { env } : {}Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)dist/extensions/server.cjs:3716 · MCP server using network transport (SSE/HTTP) — data sent over networkfunction createMcpServerRuntime(environment = {}, workspaceRoot, getResolver, publishFile, assertPackageActive, getVault, getFs, hostSettings) {Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
CRITICAL
Prompting user to enter sensitive credentialsdist/extensions/server.mjs:3216 · Prompting user to enter sensitive credentials — social engineeringif (!isSecretName(name) || !isSecretValue(value)) throw new McpSecretSupplyError(400, "Enter the secret as one line.");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03

Cost to the agent

Instructions loaded
≈3,313 tok
2 files · 36 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @agimon-ai/po-mcp@0.0.0-alpha.149 as of 39 h ago. This is the package itself, not its dependencies.

What would make this Verified

4 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Prompting user to enter sensitive credentials≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. Unclaimed publisher≈ +8 on the totalClaim agimon-ai: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim agimon-aiPropose a patch to the maintainer