Is sdk@1.15.2 safe to install?

sdk@1.15.2

VERIFIED· startup only

Publisher claims: "Governance and audit layer for AI agents: policy, approvals, tamper-evident audit chains." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server) · listed in the official MCP RegistryPublisher mnemopay · publishing for 227 daysInstalls 0Last detonated 2d ago

$claude mcp add sdk -- npx -y @mnemopay/sdk

Watch Report an issue

Coverage

Startup only; authenticated tool behavior not tested.

Tested: server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested: the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: AGENTPAY_API_KEYANTHROPIC_API_KEYFIRECRAWL_API_KEYGROQ_API_KEYMCP_AUTH_TOKENMNEMO_API_KEYMNEMOPAY_API_KEYMNEMOPAY_MCP_TOKENMNEMOPAY_OPERATOR_API_KEYMNEMOPAY_ORG_API_KEYMNEMOPAY_PROVISIONER_TOKENMNEMOPAY_WEBHOOK_ALLOW_LOCALOPENAI_API_KEYPAYSTACK_SECRET_KEYPROVISIONER_TOKENREQUIRE_PORTAL_AUTHSHOPIFY_STOREFRONT_TOKENSTRIPE_SECRET_KEYConfiguration, not credentials: AGENTPAY_URL, BGE_LOCAL_MODEL_PATH, FLY_APP_NAME, LIGHTNING_BTC_PRICE, LIGHTNING_LND_URL, LIGHTNING_MACAROON, MNEMO_URL, MNEMOPAY_AGENT_ID, MNEMOPAY_BRAIN_PATH, MNEMOPAY_CLIENT_KEY, MNEMOPAY_COMMERCE_PROVIDER, MNEMOPAY_CONTACT, MNEMOPAY_CORS_ORIGIN, MNEMOPAY_GATEWAY_URL, MNEMOPAY_IDENTITY, MNEMOPAY_METERING, MNEMOPAY_MODE, MNEMOPAY_ORG_ID, MNEMOPAY_PAYMENT_RAIL, MNEMOPAY_PAYMENT_RATE_LIMIT, MNEMOPAY_PERSIST_DIR, MNEMOPAY_RATE_LIMIT
Where it talks to: no vendor host named in the codeAlso getbizsuite.com, stripe.com, groq.com, paystack.co — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names getbizsuite.com, stripe.com, groq.com, paystack.co as well as its own vendor. The guard injects AGENTPAY_API_KEY, ANTHROPIC_API_KEY, FIRECRAWL_API_KEY, GROQ_API_KEY, MCP_AUTH_TOKEN, MNEMO_API_KEY, MNEMOPAY_API_KEY, MNEMOPAY_MCP_TOKEN, MNEMOPAY_OPERATOR_API_KEY, MNEMOPAY_ORG_API_KEY, MNEMOPAY_PROVISIONER_TOKEN, MNEMOPAY_WEBHOOK_ALLOW_LOCAL, OPENAI_API_KEY, PAYSTACK_SECRET_KEY, PROVISIONER_TOKEN, REQUIRE_PORTAL_AUTH, SHOPIFY_STOREFRONT_TOKEN, STRIPE_SECRET_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y @mnemopay/sdk

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-12 and scored it 87/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 42 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

22sprocessdependency install exit 0

42sclaimedstartup only: exited (0) before answering · '/tmp/ks-detonate-Pw7fko/task/home/work/acme-api/.claude/skills/sdk/dist/mcp/server.js' ] } Node.js v22.23.4

42sprocessscript backend runs setup only

42sprocessno install scripts to re-run

Static findings

MEDIUM

Process kill commanddist/identity.js:235 · Process kill command — agent can terminate processes* Revoke ALL tokens for an agent (kill switch).Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

npx invocation of non-well-known packagedist/cli/setup.js:238 · npx invocation of non-well-known package — may execute untrusted codelog(" claude mcp add mnemopay -s user -- npx -y @mnemopay/sdk\n");Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagedist/cli/dashboard.js:4 · npx invocation of non-well-known package — may execute untrusted code* npx @mnemopay/sdk dashboardFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

File type combined with upload actiondist/index.js:1379 · File type combined with upload action — agent may exfiltrate local data filesthis.log(`Refunded $${tx.amount.toFixed(2)} → reputation: ${this._reputation.toFixed(2)}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

npx invocation of non-well-known packagedist/cli/dashboard.js:69 · npx invocation of non-well-known package — may execute untrusted codeconsole.log(" npx @mnemopay/sdk dashboard enterprise Subscribe to Enterprise ($299/mo)");Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

File type combined with upload actiondist/index.js:1481 · File type combined with upload action — agent may exfiltrate local data filesthis.log(`Dispute ${disputeId} resolved: ${outcome}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actiondist/index.js:1433 · File type combined with upload action — agent may exfiltrate local data filesthis.log(`Dispute filed for tx ${txId}: ${reason}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

Process kill commanddist/identity.d.ts:136 · Process kill command — agent can terminate processes* Revoke ALL tokens for an agent (kill switch).Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

File type combined with upload actiondist/index.js:405 · File type combined with upload action — agent may exfiltrate local data filesthis.log(`Persisted reputation invalid (${raw.reputation}) — resetting to 0.5`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actiondist/index.js:1581 · File type combined with upload action — agent may exfiltrate local data files

this.log(`Reputation: ${report.tier} (${report.score.toFixed(2)}), ${report.settledCount} settled, rate: ${(report.settlementRate * 100).toFixed(0)}%, streak: ${this._streak.currentStreak}`);

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

npx invocation of non-well-known packagedist/cli/dashboard.js:68 · npx invocation of non-well-known package — may execute untrusted codeconsole.log(" npx @mnemopay/sdk dashboard subscribe Subscribe to Pro ($49/mo)");Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Process kill commanddist/mcp/server.d.ts:27 · Process kill command — agent can terminate processes* identity KYA identity + scoped capability tokens + kill switchFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

npx invocation of non-well-known packagedist/cli/dashboard.d.ts:3 · npx invocation of non-well-known package — may execute untrusted code* npx @mnemopay/sdk dashboardFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagedist/cli/setup.js:4 · npx invocation of non-well-known package — may execute untrusted code* npx @mnemopay/sdk setupFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagedist/cli/dashboard.js:70 · npx invocation of non-well-known package — may execute untrusted codeconsole.log(" npx @mnemopay/sdk dashboard pricing View pricing\n");Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagedist/cli/setup.d.ts:3 · npx invocation of non-well-known package — may execute untrusted code* npx @mnemopay/sdk setupFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

File permission modification commanddist/identity/wallet.js:47 · File permission modification command — agent changes file ownership/permissions// chmod failures on locked-down filesystems shouldn't break persistence.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

MEDIUM

npx invocation of non-well-known packagedist/cli/dashboard.js:67 · npx invocation of non-well-known package — may execute untrusted codeconsole.log(" npx @mnemopay/sdk dashboard Open dashboard");Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagedist/mcp/server.js:13 · npx invocation of non-well-known package — may execute untrusted code* npx @mnemopay/mcp-server --tools=memory,wallet # memory + wallet onlyFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

MCP server using network transport (SSE/HTTP)dist/mcp/server.js:11 · MCP server using network transport (SSE/HTTP) — data sent over network* npx @mnemopay/mcp-server # stdio, essentials (default)Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

npx invocation of non-well-known packagedist/mcp/server.d.ts:10 · npx invocation of non-well-known package — may execute untrusted code* npx @mnemopay/mcp-server # stdio, essentials (default)Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagedist/mcp/server.d.ts:13 · npx invocation of non-well-known package — may execute untrusted code* npx @mnemopay/mcp-server --http --port 3200 # HTTP/SSE modeFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagedist/mcp/server.js:14 · npx invocation of non-well-known package — may execute untrusted code* npx @mnemopay/mcp-server --http --port 3200 # HTTP/SSE modeFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

MCP server using network transport (SSE/HTTP)dist/mcp/server.js:14 · MCP server using network transport (SSE/HTTP) — data sent over network* npx @mnemopay/mcp-server --http --port 3200 # HTTP/SSE modeFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

npx invocation of non-well-known packagedist/mcp/server.d.ts:12 · npx invocation of non-well-known package — may execute untrusted code* npx @mnemopay/mcp-server --tools=memory,wallet # memory + wallet onlyFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

MCP server using network transport (SSE/HTTP)dist/mcp/server.d.ts:13 · MCP server using network transport (SSE/HTTP) — data sent over network* npx @mnemopay/mcp-server --http --port 3200 # HTTP/SSE modeFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

npx invocation of non-well-known packagedist/mcp/server.d.ts:11 · npx invocation of non-well-known package — may execute untrusted code* npx @mnemopay/mcp-server --tools=all # all 95 toolsFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Process kill commanddist/mcp/server.js:28 · Process kill command — agent can terminate processes* identity KYA identity + scoped capability tokens + kill switchFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

MCP server using network transport (SSE/HTTP)dist/mcp/server.d.ts:10 · MCP server using network transport (SSE/HTTP) — data sent over network* npx @mnemopay/mcp-server # stdio, essentials (default)Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

npx invocation of non-well-known packagedist/mcp/server.js:11 · npx invocation of non-well-known package — may execute untrusted code* npx @mnemopay/mcp-server # stdio, essentials (default)Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagedist/mcp/server.js:12 · npx invocation of non-well-known package — may execute untrusted code* npx @mnemopay/mcp-server --tools=all # all 95 toolsFix: Pin versions and sources; vendor anything fetched at install time.

AST06

Cost to the agent

Instructions loaded

≈93 tok

1 file · 81 in bundle

Tool list per prompt

≈0 tok

0 tools · 0 per tool

Handshake

no reply

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @mnemopay/sdk@1.15.2 as of 2d ago. This is the package itself, not its dependencies.