Skills/PyPI/a2a-governance-bridge-mcp

a2a-governance-bridge-mcp@1.1.14

VERIFIED

Publisher claims: "A2A Governance Bridge MCP server. Tools: verify agent compliance, authorize a2a transaction, get trust registry. Built by MEOK AI Labs." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher csoai-org · joined 0 days agoInstalls 552Last detonated 1 h ago

$claude mcp add a2a-governance-bridge-mcp -- uvx a2a-governance-bridge-mcp

Report an issue

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.1sprocessdependency install exit 1

0.1sprocessexec /usr/bin/timeout

0.1sprocessexec .venv/bin/a2a_governance_bridge_mcp

0.1sprocessexited 127: timeout: failed to run command '.venv/bin/a2a_governance_bridge_mcp': No such file or directory

0.1sclaimedno tools/list reply (exit 127)

0.1sprocessscript backend runs setup only

Static findings

HIGH

npx invocation of non-well-known packagePKG-INFO:74 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known package.github/workflows/mcp-smithery-publish.yml:32 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:36 · npx invocation of non-well-known package — may execute untrusted code

AST06

MEDIUM

MCP server using network transport (SSE/HTTP)mcp-wrapper.py:85 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04