vsl-mcp-server@1.4.5
VERIFIEDPublisher claims: "VSL MCP Server — Model Context Protocol integration for AI agents (Claude Desktop, Cline, TaoCoder)" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Server started and answered tools/list.- Tested
- MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
- Not tested
- what the tools do when called with real credentials
Before you give it your token
- It will ask for
ANTHROPIC_API_KEYOPENAI_API_KEYVSL_PROXY_PASSWORDConfiguration, not credentials: VSL_ACCEPT_DOWNLOADS, VSL_BROWSER_AUTO_INSTALL, VSL_BROWSER_HEADLESS, VSL_BROWSER_INSTALL_TIMEOUT, VSL_CDP_PORT, VSL_DOM_STABILIZATION_ENABLED, VSL_DOM_STABILIZATION_NETWORK_IDLE_TIMEOUT, VSL_DOM_STABILIZATION_POLL_INTERVAL, VSL_DOM_STABILIZATION_STABLE_PERIOD, VSL_DOM_STABILIZATION_TIMEOUT, VSL_DOM_STABILIZATION_WAIT_NETWORK_IDLE, VSL_DOWNLOAD_TIMEOUT, VSL_DOWNLOADS_PATH, VSL_HUMANIZATION_ENABLED, VSL_HUMANIZATION_INTERNAL_HOSTS, VSL_MANUAL_LOGIN_POLL_INTERVAL, VSL_MANUAL_LOGIN_RESTORE_HEADLESS, VSL_MANUAL_LOGIN_TIMEOUT, VSL_NAVIGATION_TIMEOUT, VSL_PROXY_SERVER, VSL_PROXY_USERNAME, VSL_RENDER_TIMEOUT, VSL_SESSION_ID, VSL_USER_DATA_DIR, VSL_VISION_BASE_URL, VSL_VISION_MODEL, VSL_VISION_PROVIDER- Where it talks to
- no vendor host named in the codeAlso nodejs.org — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- what the tools do when called with real credentials
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names nodejs.org as well as its own vendor. The guard injects ANTHROPIC_API_KEY, OPENAI_API_KEY, VSL_PROXY_PASSWORD only into requests to the host you bind (and its subdomains) and refuses the rest.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-14 and scored it 89/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 36 s · 2 scenarios · 0 deviationsStatic findings
const result = execSync('npx playwright install --dry-run 2>&1 || true', {Fix: Pin versions and sources; vendor anything fetched at install time.execSync('npx playwright install chromium', { stdio: 'inherit', timeout: 180000 });Fix: Pin versions and sources; vendor anything fetched at install time.possible_causes: ["Playwright \u043D\u0435 \u0443\u0441\u0442\u0430\u043D\u043E\u0432\u043B\u0435\u043D"],Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.const command = options.cliPath ? `node "${options.cliPath}" install ${info.browser}` : `npx playwright install ${info.browser}`;Fix: Pin versions and sources; vendor anything fetched at install time.log(` ${C.dim}npx playwright install chromium...${C.reset}`);Fix: Pin versions and sources; vendor anything fetched at install time.info(`Install later: ${C.dim}npm install playwright && npx playwright install chromium${C.reset}`);Fix: Pin versions and sources; vendor anything fetched at install time.const browsers = execSync('npx playwright install --list 2>&1 || true', {Fix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for @thinkingos/vsl-mcp-server@1.4.5 as of 6 h ago. This is the package itself, not its dependencies.