Skills/npm/vanta-mcp-server

vanta-mcp-server@1.2.0

BLOCKED

Publisher claims: "Model Context Protocol server for Vanta's security compliance platform" Observed in sandbox: static analysis only — behavior not yet observed.

Registry npm (MCP server)Publisher vantasdk · joined 0 days agoInstalls 70,088Last detonated 1 h ago

Dispute verdict

Behavior trace

Queued for honeypot run · static analysis only

t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

CRITICAL

Access to sensitive file pathsREADME.md:209 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packageREADME.md:277 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsREADME.md:130 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsbuild/auth.js:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsbuild/eval/eval.js:591 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packageREADME.md:163 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:166 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsREADME.md:288 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsREADME.md:150 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05