Is weather-mcp@1.35.12 safe to install?

weather-mcp@1.35.12

VERIFIED· startup only

Publisher claims: "MCP server giving AI assistants 17 weather tools with zero API keys: global forecasts, current conditions, alerts, air quality, marine conditions, lightning detection, radar imagery, river levels, wildfire tracking, and historical weather back to 1940. Bu" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher dangahagan · publishing for 374 daysInstalls 10,126Last detonated 3d ago

$claude mcp add weather-mcp -- npx -y @dangahagan/weather-mcp

Watch Report an issue

Coverage

Startup only; authenticated tool behavior not tested.

Tested: server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested: the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: GOOGLE_POLLEN_API_KEYGOOGLE_WEATHER_API_KEYNCEI_API_TOKENConfiguration, not credentials: ENABLED_TOOLS, FIRMS_MAP_KEY, LOG_PII, WEATHER_LIGHTNING_PREWARM
Where it talks to: no vendor host named in the codeAlso noaa.gov, nasa.gov, go.jp, weather.gov, open-meteo.com, nominatim.org, rcc-acis.org, gc.ca, met.no, google.com, rainviewer.com, aviationweather.gov, arcgis.com, usgs.gov — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names noaa.gov, nasa.gov, go.jp, weather.gov, open-meteo.com, nominatim.org, rcc-acis.org, gc.ca, met.no, google.com, rainviewer.com, aviationweather.gov, arcgis.com, usgs.gov as well as its own vendor. The guard injects GOOGLE_POLLEN_API_KEY, GOOGLE_WEATHER_API_KEY, NCEI_API_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y @dangahagan/weather-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-11 and scored it 81/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 35 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

14sprocessdependency install exit 0

34sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-BrDsCY/task/home/work/acme-api/.claude/skills/weather-mcp/dist/services/locationStore.js' } Node.js v22.23.4

34sprocessscript backend runs setup only

34sprocessno install scripts to re-run

Static findings

HIGH

Access to sensitive file pathsdist/index.js:6 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Load environment variables from .env file (for local development)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

npx invocation of non-well-known packagedist/index.js:87 · npx invocation of non-well-known package — may execute untrusted codeautoUpdateTip: 'Use npx -y @dangahagan/weather-mcp@latest in MCP config for automatic updates'Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

HIGH

Hidden zero-width characters detecteddist/utils/jmaParse.js:149 · Hidden zero-width characters detected — may conceal contentconst stripped = xml.replace(/^/, '').trimStart();Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST07

HIGH

Auto-update or dynamic fetch configurationdist/index.js:87 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeautoUpdateTip: 'Use npx -y @dangahagan/weather-mcp@latest in MCP config for automatic updates'Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

HIGH

Access to sensitive file pathsdist/http.js:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Load environment variables from .env file (for local development)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

LOW

Prompt injectionpackage.json:66 · Prompt injection — known jailbreak technique reference · informational: not an instruction file"author": "Dan Gahagan",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST01

Cost to the agent

Instructions loaded

≈103 tok

1 file · 81 in bundle

Tool list per prompt

≈0 tok

0 tools · 0 per tool

Handshake

no reply

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @dangahagan/weather-mcp@1.35.12 as of 3d ago. This is the package itself, not its dependencies.