a2anet-mcp@2.0.1

CAUTION

Publisher claims: "An MCP server for the Agent2Agent (A2A) protocol" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher a2anet · joined 0 days agoInstalls 206Last detonated 1 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.1sprocessdependency install exit 1

0.1sprocessexec /usr/bin/timeout

0.1sprocessexec .venv/bin/a2anet-mcp

0.1sprocessexited 127: timeout: failed to run command '.venv/bin/a2anet-mcp': No such file or directory

0.1sclaimedno tools/list reply (exit 127)

0.1sprocessscript backend runs setup only

Static findings

MEDIUM

URL shortener detectedPKG-INFO:423 · URL shortener detected — destination cannot be verified

AST07

MEDIUM

Remote installer piped to shellPKG-INFO:53 · Remote installer piped to shell

AST07

MEDIUM

Remote installer piped to shellREADME.md:30 · Remote installer piped to shell

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)PKG-INFO:26 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

CRITICAL

Pipe-to-shell patternREADME.md:30 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

CRITICAL

Pipe-to-shell patternPKG-INFO:53 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

MEDIUM

URL shortener detectedREADME.md:400 · URL shortener detected — destination cannot be verified

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)README.md:3 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04