Skills/PyPI/a2a-exchange-mcp

a2a-exchange-mcp@0.1.3

VERIFIED

Publisher claims: "MCP buyer/seller tools for the A2A Exchange (a2a.exchange): discover counterparties, publish/discover mandates, exchange requests/responses/handoffs, read the public board." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher a2a.exchange-dev · joined 0 days agoInstalls 75Last detonated 1 h ago

$claude mcp add a2a-exchange-mcp -- uvx a2a-exchange-mcp

Report an issue

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.1sprocessdependency install exit 1

0.1sprocessexec /usr/bin/timeout

0.1sprocessexec .venv/bin/a2a-exchange-mcp

0.1sprocessexited 127: timeout: failed to run command '.venv/bin/a2a-exchange-mcp': No such file or directory

0.1sclaimedno tools/list reply (exit 127)

0.1sprocessscript backend runs setup only

Static findings

MEDIUM

File type combined with upload actionPKG-INFO:122 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

File type combined with upload actiona2a_exchange_mcp/publisher.py:9 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)PKG-INFO:30 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

MEDIUM

MCP server using network transport (SSE/HTTP)README.md:6 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

MEDIUM

File type combined with upload actionREADME.md:98 · File type combined with upload action — agent may exfiltrate local data files

AST07