scanruler-mcp@0.6.4
CAUTIONPublisher claims: "Drive ScanRuler, the 3D-scan measuring tool, from an AI agent: a local MCP server that reaches the ScanRuler tab open in your browser." Observed in sandbox: calls registry.npmjs.org only, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher cnckitchen · publishing for 35 daysInstalls 8,498Last detonated 32 h ago
Coverage
Server started and answered tools/list.- Tested
- MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
- Not tested
- what the tools do when called with real credentials
Before you give it your token
- It will ask for
SCANRULER_MCP_TOKENConfiguration, not credentials: SCANRULER_ENGINE, SCANRULER_MCP_ANSWER_WITHIN, SCANRULER_MCP_CONFIG_DIR, SCANRULER_MCP_HOST, SCANRULER_MCP_PORT, SCANRULER_MCP_TOOLS, SCANRULER_MCP_TRACE- Where it talks to
- scanruler.com (its own)
- What the honeypot saw
- no credential files read · reached only registry.npmjs.org
- What we could not test
- what the tools do when called with real credentials
Connect it with a scoped credential, under the guard. It asks for SCANRULER_MCP_TOKEN and talks to scanruler.com. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind.
$vet-skills run --secrets SCANRULER_MCP_TOKEN=scanruler.com -- npx -y scanruler-mcp
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-13 and scored it 74/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Destructive file system command detected; Access to sensitive file paths. Summary: calls registry.npmjs.org only, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 26 s · 2 scenariost+CategoryObserved action
0.0sprocessno install scripts in bundle
6.0sprocessdependency install exit 0
26sfilesystemread ~/.config/scanruler-mcp/update.json · ~/.config/scanruler-mcp/config.json · ~/.config/scanruler-mcp/tools.json outside project
26sfilesystemwrote ~/.config/scanruler-mcp/config.json.3562.5176c4cd.part · ~/.config/scanruler-mcp/update.json.3562.part
26snetworkCONNECT tcp://registry.npmjs.org:443
26sclaimed81 tools: scanruler_status, scanruler_open, scanruler_wait, scanruler_write, scanruler_files, scanruler_read, scanruler_batch, align_auto, align_clear, align_datum, align_symmetry, deviation_align, deviation_export, deviation_hotspots, deviation_measure, deviation_open_reference, deviation_set_target, deviation_settings, deviation_volume, dimension_add, dimension_remove, dimension_set_basic, dimension_set_limit, element_construct, element_fit
26stools8409c188ae3ca6b8
26stoolsf8c9fc2d58b56fae
26stoolsa3d12100a86a7224
26stools7c01338575d983a9
26stools8ee867931817eb82
26stoolsf7d80a9fb56443f0
26stools82a24e22f5844244
26stools734a444022f21644
26stoolsca1efb196bc97501
26stools73bdd482c6bc2c97
26stools2483e0b5305c835d
26stoolsffbbc24b6cf51349
26stools5bc5422426d6e757
26stoolsd9f0804c991bedc2
26stools4fb800e19d89f9de
26stools25c9703fb35c06fe
26stoolsdc729a81b2747bd9
26stoolsc87432e836c4524f
26stoolsd3a8591cc25e5c8c
26stools28dc6fbe4c3f4345
26stools76831d9c01063be5
26stools3a2486e63561d19d
26stools3151397924c40c46
26stools21dfdfa87c79ac3d
26stoolsd0df5653c285d12c
26stools8891ab5376b0f0e1
26stools1526be68be7b9f95
26stools0919ff401e8215af
26stools8ca464fcbebd61ee
26stools965b6300f8514ec1
26stoolsc640968dd7d96e7f
26stoolsf84d6140ae1946a0
26stools3d6e2777e9352dda
26stools0cc65218d5d89b2c
26stoolsf3bec3976cf635fe
26stools1dd39997517deb35
26stools4ff685f2a026b8d5
26stoolsd3914736fa7587f5
26stools3a50892bd5d69cda
26stools23c3254ba696593a
26stoolsf2b139b1b7a14ea7
26stools041833b3e8e1a201
26stoolsf6468f2c57d21069
26stoolsa2da9939a00ca742
26stools3ebcd3c34cab9b73
26stools1454dd1e6af88fc1
26stools6dd87c677c960c9f
26stools5ac9574e6404a902
26stoolsd553b959b14d5224
26stoolsc200e057dfdad07a
26stoolsd0e2c87f471fa114
26stools6fc4e30e8f4a6e99
26stools191b4f426b481432
26stools1315db676f33be04
26stools3263464e10fefd31
26stools0a8ee3994b0a00cc
26stools5623017c4e8c1214
26stools260d1d092bf5e8ff
26stoolsa512233f20aa32a9
26stools58ee35e8feb59d58
26stoolscf88baa7ee9c671a
26stoolscfd8282089f98dd3
26stoolsf646b1f1ea1e9737
26stoolsd3e4679cc034c5d7
26stoolsaaefc6e071bed529
26stoolsa0f989288e987f89
26stoolsd127532af11d31d6
26stoolsb143e5215b23209d
26stools6a3c2929a56e6545
26stoolsa39466ff86b7c290
26stools206371ba4e65d034
26stools076175e6c0dbb845
26stools5d446fcb16ec05da
26stools8637fbb69ae11392
26stoolseaf2c084ca1653e3
26stoolsedd4728fdd17aedd
26stoolsaed55f3e28ef7f55
26stoolsc4bf6a34b886c317
26stools403426e048998025
26stools14648d965179482c
26sprocessscript backend runs setup only
26sprocessno install scripts to re-run
Static findings
HIGH
Access to sensitive file pathssrc/update.js:183 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05env: { ...env, [HANDED_OFF_ENV]: version, [PARENT_ENV]: String(process.pid) },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagesrc/update.js:2 · npx invocation of non-well-known package — may execute untrusted code
AST06// The server keeps itself current. A config written as `npx -yFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/update.js:22 · npx invocation of non-well-known package — may execute untrusted code
AST06// pinned in the config (`npx -y [email protected]` is taken as meant).Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/update.js:26 · npx invocation of non-well-known package — may execute untrusted code
AST06// npx keeps each spec in its own folder, <npm cache>/_npx/<hash>, the hashFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/link.js:286 · npx invocation of non-well-known package — may execute untrusted code
AST06return refuse(CLOSE.badToken, 'The pairing token does not match — copy it again from `npx -y scanruler-mcp@latest --pair` into ScanRuler’s Settings.')Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Destructive file system command detectedsrc/commands.json:2946 · Destructive file system command detected
AST05… "title": "Get the report", "description": "The measurement report. format \"text\" is word for word what the workspace’s Copy report button gives — measure…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File type combined with upload actionsrc/link.js:280 · File type combined with upload action — agent may exfiltrate local data files
AST07this.log(`Another scanruler-mcp${message.peer.version ? ` ${message.peer.version}` : ''} sends its calls through this one.`)Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagesrc/update.js:93 · npx invocation of non-well-known package — may execute untrusted code
AST06/** How the copy in `packageDir` was installed: by npx (`npx`, with npm'sFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagesrc/update.js:28 · npx invocation of non-well-known package — may execute untrusted code
AST06// libnpmexec). A copy run by npx tells from that hash whether its spec wasFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathssrc/update.js:316 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05env: { ...env, [NO_UPDATE_ENV]: '1', [HANDED_OFF_ENV]: '' },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.Cost to the agent
Instructions loaded
≈70 tok
1 file · 18 in bundle
Tool list per prompt
≈38,981 tok
81 tools · 481 per tool
Handshake
5961 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 626
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for scanruler-mcp@0.6.4 as of 30 h ago. This is the package itself, not its dependencies.
What would make this Verified
6 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs. Seen: ~/.config/scanruler-mcp/update.json, ~/.config/scanruler-mcp/config.json, ~/.config/scanruler-mcp/tools.json.
- Unclaimed publisher≈ +8 on the totalClaim cnckitchen: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim cnckitchenPropose a patch to the maintainer