tokensafe@3.1.5
CAUTION· startup onlyPublisher claims: "Reduce your AI bills by up to 99% locally. Your agents read only needed code, keep prompt caches intact across turns, and keep secrets out of git." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher tokensafe-dev · publishing for 7 daysInstalls 14,624Last detonated 1 h ago
Coverage
Startup only; authenticated tool behavior not tested.- Tested
- server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
- Not tested
- the tool list (the server exited before answering) · what the tools do when called with real credentials
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
ANTHROPIC_API_KEYDEEPSEEK_API_KEYGEMINI_API_KEYOPENAI_API_KEYTOKENSAFE_AGENTTOKENSAFE_ALLOWED_ORIGINSTOKENSAFE_AUTOPRUNE_INTERVALTOKENSAFE_BG_LICENSE_KEYTOKENSAFE_BUNDLE_MAX_TOKENSTOKENSAFE_CACHE_TIMEOUTTOKENSAFE_CLOUD_DB_PATHTOKENSAFE_CLOUD_URLTOKENSAFE_CONTEXT_WINDOWTOKENSAFE_DATA_DIRTOKENSAFE_DB_PATHTOKENSAFE_GRAPH_DISK_CACHETOKENSAFE_GRAPH_TTLTOKENSAFE_HMAC_SALTTOKENSAFE_HOSTTOKENSAFE_LICENSE_KEYTOKENSAFE_LIVE_FLUSH_SECONDSTOKENSAFE_LIVE_URLTOKENSAFE_MAX_EVENTSTOKENSAFE_MAX_TURN_TOKENSTOKENSAFE_MCP_AUTORELOADTOKENSAFE_MCP_TIMEOUTTOKENSAFE_NONINTERACTIVETOKENSAFE_PRIVATE_KEYTOKENSAFE_PUBLIC_KEYTOKENSAFE_RETENTION_DAYSTOKENSAFE_SELF_HOSTEDTOKENSAFE_TARGET_TURN_TOKENSTOKENSAFE_TELEMETRY_DISABLEDTOKENSAFE_TOOL_PRUNE_ALLOWLISTTOKENSAFE_TOOL_PRUNE_KEEPTOKENSAFE_TOOL_PRUNINGTOKENSAFE_TREESITTERTOKENSAFE_UPSTREAM_KEYTOKENSAFE_UPSTREAM_MODELTOKENSAFE_UPSTREAM_URLor--claim-token- Where it talks to
- tokensafe.dev (its own)Also deepseek.com, python.org, apple.com — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- the tool list (the server exited before answering) · what the tools do when called with real credentials
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names deepseek.com, python.org, apple.com as well as its own vendor. The guard injects ANTHROPIC_API_KEY, DEEPSEEK_API_KEY, GEMINI_API_KEY, OPENAI_API_KEY, TOKENSAFE_AGENT, TOKENSAFE_ALLOWED_ORIGINS, TOKENSAFE_AUTOPRUNE_INTERVAL, TOKENSAFE_BG_LICENSE_KEY, TOKENSAFE_BUNDLE_MAX_TOKENS, TOKENSAFE_CACHE_TIMEOUT, TOKENSAFE_CLOUD_DB_PATH, TOKENSAFE_CLOUD_URL, TOKENSAFE_CONTEXT_WINDOW, TOKENSAFE_DATA_DIR, TOKENSAFE_DB_PATH, TOKENSAFE_GRAPH_DISK_CACHE, TOKENSAFE_GRAPH_TTL, TOKENSAFE_HMAC_SALT, TOKENSAFE_HOST, TOKENSAFE_LICENSE_KEY, TOKENSAFE_LIVE_FLUSH_SECONDS, TOKENSAFE_LIVE_URL, TOKENSAFE_MAX_EVENTS, TOKENSAFE_MAX_TURN_TOKENS, TOKENSAFE_MCP_AUTORELOAD, TOKENSAFE_MCP_TIMEOUT, TOKENSAFE_NONINTERACTIVE, TOKENSAFE_PRIVATE_KEY, TOKENSAFE_PUBLIC_KEY, TOKENSAFE_RETENTION_DAYS, TOKENSAFE_SELF_HOSTED, TOKENSAFE_TARGET_TURN_TOKENS, TOKENSAFE_TELEMETRY_DISABLED, TOKENSAFE_TOOL_PRUNE_ALLOWLIST, TOKENSAFE_TOOL_PRUNE_KEEP, TOKENSAFE_TOOL_PRUNING, TOKENSAFE_TREESITTER, TOKENSAFE_UPSTREAM_KEY, TOKENSAFE_UPSTREAM_MODEL, TOKENSAFE_UPSTREAM_URL only into requests to tokensafe.dev (and its subdomains) and refuses the rest.
$vet-skills run --secrets ANTHROPIC_API_KEY=tokensafe.dev,DEEPSEEK_API_KEY=tokensafe.dev,GEMINI_API_KEY=tokensafe.dev,OPENAI_API_KEY=tokensafe.dev,TOKENSAFE_AGENT=tokensafe.dev,TOKENSAFE_ALLOWED_ORIGINS=tokensafe.dev,TOKENSAFE_AUTOPRUNE_INTERVAL=tokensafe.dev,TOKENSAFE_BG_LICENSE_KEY=tokensafe.dev,TOKENSAFE_BUNDLE_MAX_TOKENS=tokensafe.dev,TOKENSAFE_CACHE_TIMEOUT=tokensafe.dev,TOKENSAFE_CLOUD_DB_PATH=tokensafe.dev,TOKENSAFE_CLOUD_URL=tokensafe.dev,TOKENSAFE_CONTEXT_WINDOW=tokensafe.dev,TOKENSAFE_DATA_DIR=tokensafe.dev,TOKENSAFE_DB_PATH=tokensafe.dev,TOKENSAFE_GRAPH_DISK_CACHE=tokensafe.dev,TOKENSAFE_GRAPH_TTL=tokensafe.dev,TOKENSAFE_HMAC_SALT=tokensafe.dev,TOKENSAFE_HOST=tokensafe.dev,TOKENSAFE_LICENSE_KEY=tokensafe.dev,TOKENSAFE_LIVE_FLUSH_SECONDS=tokensafe.dev,TOKENSAFE_LIVE_URL=tokensafe.dev,TOKENSAFE_MAX_EVENTS=tokensafe.dev,TOKENSAFE_MAX_TURN_TOKENS=tokensafe.dev,TOKENSAFE_MCP_AUTORELOAD=tokensafe.dev,TOKENSAFE_MCP_TIMEOUT=tokensafe.dev,TOKENSAFE_NONINTERACTIVE=tokensafe.dev,TOKENSAFE_PRIVATE_KEY=tokensafe.dev,TOKENSAFE_PUBLIC_KEY=tokensafe.dev,TOKENSAFE_RETENTION_DAYS=tokensafe.dev,TOKENSAFE_SELF_HOSTED=tokensafe.dev,TOKENSAFE_TARGET_TURN_TOKENS=tokensafe.dev,TOKENSAFE_TELEMETRY_DISABLED=tokensafe.dev,TOKENSAFE_TOOL_PRUNE_ALLOWLIST=tokensafe.dev,TOKENSAFE_TOOL_PRUNE_KEEP=tokensafe.dev,TOKENSAFE_TOOL_PRUNING=tokensafe.dev,TOKENSAFE_TREESITTER=tokensafe.dev,TOKENSAFE_UPSTREAM_KEY=tokensafe.dev,TOKENSAFE_UPSTREAM_MODEL=tokensafe.dev,TOKENSAFE_UPSTREAM_URL=tokensafe.dev -- npx -y tokensafe
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-15 and scored it 52/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 20 s · 2 scenariost+CategoryObserved action
0.0sprocessno install scripts in bundle
20sfilesystemread ~/.tokensafe/venv/pyvenv.cfg · ~/.tokensafe/venv/bin/python3._pth · ~/.tokensafe/venv/lib/python3.11/site-packages · ~/.tokensafe/venv outside project
20sfilesystemwrote ~/.tokensafe/venv/pyvenv.cfg
20sclaimedstartup only: exited (0) before answering · ⚡ Installing required dependency: cryptography>=42.0 ... ❌ TokenSafe requires the Python 'cryptography>=42.0' package. Install it manually cleanly via: pip install 'cryptography>=42.0'
20sprocessscript backend runs setup only
20sprocessno install scripts to re-run
Static findings
HIGH
Access to sensitive file pathssrc/mcp_server.py:231 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05… without permissions, timestamps, or ignored folders (node_modules, .git, dist, .env). Replaces verbose ls -la. Pass '.' for project root or a subfolder like 'src'.…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagebin/tokensafe.js:5 · npx invocation of non-well-known package — may execute untrusted code
AST06* Works with `npx tokensafe [command]` or global `tokensafe [command]`Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathssrc/secret_redactor.py:122 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05r"""process\.env(?:\.([A-Za-z0-9_]+)|\[\s*['"]([A-Za-z0-9_]+)['"]\s*\])\s*(?:\|\||\?\?)\s*['"`]([^'"`\n]+)['"`]""",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/guard.py:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05".env", ".env.local", ".env.production", ".env.staging", ".env.development",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Coercive compliance languagerules/AGENTS.md:8 · Coercive compliance language
AST01When interacting within this environment, you MUST follow strict token economy guidelines:Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.CRITICAL
HTML comment carrying imperative instructions to the agentrules/AGENTS.md:1 · HTML comment carrying imperative instructions to the agent
AST01Rule: Token-Optimized Communication Protocol (TOCP) Trigger: always_onFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.CRITICAL
Destructive command against a filesystem root or devicesrc/adapter_core.py:57 · Destructive command against a filesystem root or device
AST05r"rm\s+(-[a-zA-Z]*\s+)*-?[rf]{2,}[a-zA-Z]*\s+(--\s+)?/(?:\s|$)", # rm -rf /Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/guard.py:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST055. Git Staging Protection for Sensitive Files (.env*, *.key, *.pem)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Destructive file system command detectedsrc/adapter_core.py:57 · Destructive file system command detected
AST05r"rm\s+(-[a-zA-Z]*\s+)*-?[rf]{2,}[a-zA-Z]*\s+(--\s+)?/(?:\s|$)", # rm -rf /Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedsrc/cli.py:657 · Python subprocess execution detected
AST05proc = subprocess.run(cmd, cwd=PROJECT_ROOT, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathssrc/mcp_server.py:293 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05Ignores heavy folders (node_modules, dist, .git, etc.) and redacts sensitive files (.env*).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedsrc/benchmark_real.py:200 · Python subprocess execution detected
AST05subprocess.run([sys.executable, "-m", "venv", venv_dir],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Destructive file system command detectedsrc/guard.py:274 · Destructive file system command detected
AST05# 1. Destructive Unbounded File Deletion (rm -rf /, rm -rf ~, rm -rf *, etc.)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedsrc/benchmark_real.py:208 · Python subprocess execution detected
AST05subprocess.run([venv_py, "-m", "pip", "install", "-q", "pytest", *deps, "-e", repo_root],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/benchmark_real.py:157 · Python subprocess execution detected
AST05subprocess.run(["git", "fetch", "--depth", depth, "origin"], cwd=dest,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathssrc/benchmark_real.py:673 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05env_path = os.path.join(root, ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/scoped_search.py:47 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"dockerfile", "dockerfile.cloud", "docker-compose.yml", ".env.example",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/mcp_server.py:306 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05'.env', '.env.local', '.env.production', '.env.staging', '.env.development'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Destructive file system command detectedsrc/guard.py:9 · Destructive file system command detected
AST056. Destructive Shell Command & Unbounded Deletion Prevention (rm -rf /)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedsrc/cli.py:231 · Python subprocess execution detected
AST05subprocess.run(["xdg-open", out_path], check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/cli.py:227 · Python subprocess execution detected
AST05subprocess.run(["open", out_path], check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathssrc/compactor.py:271 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05r'|(?:\.env(?:\.[\w\-]+)?|\.gitignore|\.dockerignore|\.prettierrc[\w\.\-]*|\.eslintrc[\w\.\-]*|\.npmignore|\.npmrc|\.yarnrc)'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedsrc/guard.py:584 · Python subprocess execution detected
AST05res = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/benchmark_real.py:159 · Python subprocess execution detected
AST05subprocess.run(["git", "reset", "--hard", "-q", "origin/HEAD"], cwd=dest,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/benchmark_real.py:163 · Python subprocess execution detected
AST05subprocess.run(["git", "clone", "--depth", depth, "-q", repo["url"], dest],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Privileged sudo commandbin/tokensafe.js:128 · Privileged sudo command — agent may execute with elevated privileges
AST05console.error(' Debian: sudo apt-get install python3\n');Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.LOW
Fake instruction boundary tagskills/token-optimizer/references/cli-reference.md:30 · Fake instruction boundary tag · informational: not an instruction file
AST01tokensafe test "<prompt>" # Test TOCP S-expression prompt compactionFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
Python subprocess execution detectedsrc/installer.py:469 · Python subprocess execution detected
AST05subprocess.run(["launchctl", "unload", plist_path], capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/installer.py:457 · Python subprocess execution detected
AST05res = subprocess.run(cmd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/telemetry_sync.py:530 · Python subprocess execution detected
AST05subprocess.Popen(Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedsrc/version_checker.py:262 · Python subprocess execution detected
AST05subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.LOW
Unpinned dependencysrc/installer.py:1334 · Unpinned dependency
AST06print(f" {CYAN}→{RESET} Updating global npm package via {npm_bin} (npm install -g tokensafe@latest)...")Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.MEDIUM
Python subprocess execution detectedsrc/version_checker.py:320 · Python subprocess execution detected
AST05subprocess.Popen(term)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/installer.py:433 · Python subprocess execution detected
AST05res = subprocess.run(["launchctl", "load", "-w", plist_path], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.LOW
Fake instruction boundary tagREADME.md:374 · Fake instruction boundary tag · informational: not an instruction file
AST01tokensafe test "<prompt>" Preview prompt compaction on custom inputFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
Python subprocess execution detectedsrc/version_checker.py:331 · Python subprocess execution detected
AST05subprocess.Popen([Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/version_checker.py:308 · Python subprocess execution detected
AST05p = subprocess.Popen(zenity_cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/installer.py:476 · Python subprocess execution detected
AST05subprocess.run(["systemctl", "--user", "disable", "--now", cls._SERVICE_NAME], capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/installer.py:432 · Python subprocess execution detected
AST05subprocess.run(["launchctl", "unload", plist_path], capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/version_checker.py:288 · Python subprocess execution detected
AST05subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Instructions loaded
≈4,247 tok
2 files · 63 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for tokensafe@3.1.5 as of 24 min ago. This is the package itself, not its dependencies.
What would make this Verified
28 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs. Seen: ~/.tokensafe/venv/pyvenv.cfg, ~/.tokensafe/venv/bin/python3._pth, ~/.tokensafe/venv/lib/python3.11/site-packages.
- Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Unclaimed publisher≈ +8 on the totalClaim tokensafe-dev: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
- Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim tokensafe-devPropose a patch to the maintainer