Is sapiens-mcp@1.116.0 safe to install?

sapiens-mcp@1.116.0

VERIFIED

Publisher claims: "Operate your Sapiens Sintéticos AI studio: generate image, article, voice, music and video." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server) · listed in the official MCP RegistryPublisher sapiensinteticos · publishing for 163 daysInstalls 0Last detonated 8 h ago

$claude mcp add sapiens-mcp -- npx -y sapiens-mcp

Watch Report an issue

Coverage

Server started and answered tools/list.

Tested: MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested: what the tools do when called with real credentials

Before you give it your token

It will ask for: SAPIENS_DESKTOP_SESSION_TOKENSAPIENS_SESSION_TOKENConfiguration, not credentials: CONVEX_URL, NEXT_PUBLIC_CONVEX_URL, SAPIENS_CONVEX_TIMEOUT_MS, SAPIENS_MCP_CANAL, SAPIENS_MCP_HOME, SAPIENS_MCP_NO_TELEMETRY, SAPIENS_TIER_OVERRIDE, SHARE_DROP_BASE_URL
Where it talks to: sapiensinteticos.com (its own)Also gstatic.com, fal.run, b-cdn.net, convex.cloud, linkedin.com, portfolio.com, site.com, company.com, google.com, medium.com, kie.ai, wavespeed.ai, replicate.com, openrouter.ai, x.com, aitag.app, sint.fyi — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names gstatic.com, fal.run, b-cdn.net, convex.cloud, linkedin.com, portfolio.com, site.com, company.com, google.com, medium.com, kie.ai, wavespeed.ai, replicate.com, openrouter.ai, x.com, aitag.app, sint.fyi as well as its own vendor. The guard injects SAPIENS_DESKTOP_SESSION_TOKEN, SAPIENS_SESSION_TOKEN only into requests to sapiensinteticos.com (and its subdomains) and refuses the rest.

$vet-skills run --secrets SAPIENS_DESKTOP_SESSION_TOKEN=sapiensinteticos.com,SAPIENS_SESSION_TOKEN=sapiensinteticos.com -- npx -y sapiens-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-14 and scored it 82/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 38 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

18sprocessdependency install exit 0

38sclaimed42 tools: sapiens_pipeline, sapiens_carrossel, sapiens_image, sapiens_meta, sapiens_skill, sapiens_repertorio, sapiens_gallery, sapiens_pontes, sapiens_community, sapiens_article, sapiens_write, sapiens_quote_pop, sapiens_search, sapiens_studios, sapiens_persona, sapiens_helen, sapiens_musicator, sapiens_agente, sapiens_video, sapiens_stock_audio, sapiens_stock_video, sapiens_brand, sapiens_collection, sapiens_character, sapiens_profile

38stools3675fab3d71321ef

38stoolsb0eb03b39bf29902

38stoolscc1cb750c36d7fc6

38stools70f1010657764fd4

38stools6520b5165bd17551

38stoolsb2861f4d95df423b

38stoolsb4bf4370fe856b89

38stoolsa3b8aa543b67ff67

38stoolsb7701ed3e9f2d3c5

38stoolsf7c5465a1628ebfc

38stoolsaf34b1fa6a81c822

38stoolsca75edde491e97bf

38stoolsbfd605c1a6a39d52

38stools62d7e85069b3e779

38stoolsf1f7c7e055e54497

38stools3d7ccc21437d4a8d

38stoolsa78001b68b600fb9

38stools4bff385616a1dc88

38stoolsb49a2d3e3d9341d5

38stools7340fd321a62ae01

38stools0dc53fab5272857e

38stoolsb68be43463ff972f

38stools825198ad5c1c1d0a

38stools7b0959bdb1a91320

38stools8ef9ef130b02a1bf

38stools76add22f4d1dee65

38stools1e27d5902e9ef94a

38stools60e5094fb8de68e6

38stoolse4a71492a2762365

38stools90aed8c1b849c8bb

38stoolsb87892ce37889e54

38stools6d85342e69966016

38stools07ac7b6d4cb484a7

38stools61ab0c5fcbaaa263

38stoolseeaae76cb43937bb

38stoolsa1566f58f5ef2992

38stoolsf7ec27c8db68907e

38stools4668defeaaba0eb5

38stools5a07394770106c23

38stools5a6becb2bad6c954

38stools4bdb145e6487bcee

38stools7487559afba82cd2

38sprocessscript backend runs setup only

38sprocessno install scripts to re-run

Static findings

MEDIUM

File permission modification commanddist/convexClient.js:124 · File permission modification command — agent changes file ownership/permissions// aplica na CRIAÇÃO, então o chmod explícito cobre o caso de reescrever umFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

HIGH

Access to sensitive file pathsdist/convexClient.js:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* Carrega .env.local de vários lugares conhecidos sem sobrescrever vars jáFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

File permission modification commanddist/tools/pontes.js:380 · File permission modification command — agent changes file ownership/permissions// Windows/ACL: chmod pode não aplicar.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

MEDIUM

File permission modification commanddist/convexClient.js:133 · File permission modification command — agent changes file ownership/permissions// Windows/ACL: chmod pode não aplicar; o alvo real é o POSIX da VPS.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

HIGH

Access to sensitive file pathsdist/tools/meta.js:539 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesnote: "Achei um SAPIENS_DESKTOP_SESSION_TOKEN no ambiente (.env.local ou config do MCP). " +Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

File permission modification commanddist/convexClient.js:125 · File permission modification command — agent changes file ownership/permissions// arquivo já existente 0644. No Windows chmod é no-op benigno (try/catch).Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

MEDIUM

npx invocation of non-well-known packagedist/canal.js:32 · npx invocation of non-well-known package — may execute untrusted code

return `Pinar sapiens-mcp@${latest ?? "latest"} na config do MCP, ou limpar o cache do npx e reiniciar o cliente (restart sozinho não basta, o cache sobrevive).`;

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

HIGH

Access to sensitive file pathsdist/convexClient.js:25 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// 1. .env.local do MCP (legado, ainda primário)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdist/convexClient.js:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filespath.resolve(repoRoot(), ".env.local"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdist/convexClient.js:27 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// 2. .env.local global do monorepoFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdist/tools/gallery.js:225 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* filePath qualquer (o .env.local, uma chave) subia pro CDN como image/png, eFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdist/convexClient.js:26 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filespath.resolve(__dirname, "..", ".env.local"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsdist/tools/meta.js:541 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"remover essa linha do .env.local pra evitar confusão (ou rode logout pra forçar o uso do env).",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

npx invocation of non-well-known packagedist/index.js:43 · npx invocation of non-well-known package — may execute untrusted code// Transporte STDIO (o pacote npm/npx que os clients locais rodam). O catálogo,Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

HIGH

Access to sensitive file pathsdist/tools/meta.js:524 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// velho de .env.local sobrando (era exatamente o que mascarava o loginFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

Cost to the agent

Instructions loaded

≈97 tok

1 file · 64 in bundle

Tool list per prompt

≈77,054 tok

42 tools · 1835 per tool

Handshake

11081 ms

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 2571

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for sapiens-mcp@1.116.0 as of 8 h ago. This is the package itself, not its dependencies.