Skills/npm/wso2-docs-mcp-server

wso2-docs-mcp-server@1.3.16

VERIFIED· startup only

Publisher claims: "Production-ready MCP server providing RAG-based access to WSO2 documentation" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher iamvirul · publishing for 252 daysInstalls 1,181Last detonated 5d ago
$claude mcp add wso2-docs-mcp-server -- npx -y wso2-docs-mcp-server
WatchReport an issue

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
DATABASE_URLGEMINI_API_KEYOPENAI_API_KEYVOYAGE_API_KEYConfiguration, not credentials: CACHE_TTL_SECONDS, CHUNK_OVERLAP, CHUNK_SIZE, CRAWL_CONCURRENCY, EMBEDDING_DIMENSIONS, EMBEDDING_PROVIDER, GEMINI_EMBEDDING_MODEL, HUGGINGFACE_EMBEDDING_MODEL, MCP_SERVER_NAME, MCP_SERVER_VERSION, OLLAMA_BASE_URL, OLLAMA_EMBEDDING_MODEL, OPENAI_EMBEDDING_MODEL, TOP_K_RESULTS, VOYAGE_EMBEDDING_MODEL
Where it talks to
no vendor host named in the codeAlso wso2.com, ballerina.io, voyageai.com, githubusercontent.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names wso2.com, ballerina.io, voyageai.com, githubusercontent.com as well as its own vendor. The guard injects DATABASE_URL, GEMINI_API_KEY, OPENAI_API_KEY, VOYAGE_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y wso2-docs-mcp-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-09 and scored it 87/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 41 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
21sprocessdependency install exit 0
41sclaimedstartup only: exited (0) before answering · (node:1186) [UNDICI-EHPA] Warning: EnvHttpProxyAgent is experimental, expect them to change at any time. (Use `node --trace-warnings ...` to show where the warning was created) ◇ injected env (0) from .env Fatal error: getaddrinfo ENOTFOUND db.internal
41sprocessscript backend runs setup only
41sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathspackage.json:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env.example",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/scripts/migrate.js:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* Dynamic schema migration — respects EMBEDDING_DIMENSIONS from .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)dist/src/ingestion/githubFetcher.js:22 · MCP server using network transport (SSE/HTTP) — data sent over network'User-Agent': 'WSO2-Docs-MCP-Server/1.1 (+https://github.com/iamvirul/wso2-docs-mcp-server)',Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
npx invocation of non-well-known packageconfig-examples/claude_code.sh:11 · npx invocation of non-well-known package — may execute untrusted code-- npx -y wso2-docs-mcp-serverFix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈59 tok
1 file · 44 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for wso2-docs-mcp-server@1.3.16 as of 5d ago. This is the package itself, not its dependencies.

wso2-docs-mcp-server@1.3.16 safety verdict: Verified (startup only) — KillerSkills