Skills/npm/revly-mcp-server

revly-mcp-server@0.2.2

CAUTION

Publisher claims: "MCP server exposing Revly's local AI Agent Gateway to MCP-compatible AI tools (Claude Code, Codex, Gemini CLI, etc.) - runs locally and only ever talks to your own machine's Revly desktop app." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher jencube · joined 0 days agoInstalls 30,846Last detonated 1 h ago

Dispute verdict

Behavior trace

Honeypot run · 1 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.5sprocessdependency install exit 1

0.6sprocessexec /usr/bin/timeout

0.6sprocessexited 1: Node.js v22.23.4

0.6sclaimedno tools/list reply (exit 1)

0.6sprocessscript backend runs setup only

Static findings

HIGH

Outbound HTTP to raw IP addressREADME.md:10 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

URL using raw IP addressdist/gatewayClient.js:6 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressREADME.md:10 · URL using raw IP address — may bypass domain-based filtering

AST07

CRITICAL

Prompting user to enter sensitive credentialsREADME.md:45 · Prompting user to enter sensitive credentials — social engineering

AST03

HIGH

Outbound HTTP to raw IP addressdist/gatewayClient.js:6 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

npx invocation of non-well-known packageREADME.md:17 · npx invocation of non-well-known package — may execute untrusted code

AST06