Skills/PyPI/awslabs.dynamodb-mcp-server

awslabs.dynamodb-mcp-server@2.1.10

VERIFIED· install only

Publisher claims: "The official MCP Server for interacting with AWS DynamoDB" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher awslabs · publishing for 592 daysInstalls 11,563Last detonated 5d ago
$claude mcp add awslabs.dynamodb-mcp-server -- uvx awslabs.dynamodb-mcp-server
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
AWS_ACCESS_KEY_IDAWS_SECRET_ACCESS_KEYMYSQL_SECRET_ARNConfiguration, not credentials: AWS_DEFAULT_REGION, AWS_REGION, JAVA_HOME, MYSQL_CLUSTER_ARN, MYSQL_DATABASE, MYSQL_HOSTNAME, MYSQL_MAX_QUERY_RESULTS, MYSQL_PORT
Where it talks to
no vendor host named in the codeAlso amazon.com, cloudfront.net — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
use of the skill by an agent

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names amazon.com, cloudfront.net as well as its own vendor. The guard injects AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, MYSQL_SECRET_ARN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx awslabs.dynamodb-mcp-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-09 and scored it 80/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
File permission modification commandDockerfile:71 · File permission modification command — agent changes file ownership/permissionschmod o+x /rootFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsawslabs/dynamodb_mcp_server/server.py:271 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- Path traversal attempts (e.g., ../../../../etc/passwd) are blockedFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Instructs the agent to modify its persistent memory or instruction filesAGENTS.md:241 · Instructs the agent to modify its persistent memory or instruction files- `docs: update AGENTS.md with new tool descriptions`Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
AWS access key pattern detectedawslabs/dynamodb_mcp_server/model_validation_utils.py:70 · AWS access key pattern detected — possible hardcoded or harvested keyDUMMY_ACCESS_KEY = 'AKIAIOSFODNN7EXAMPLE' # pragma: allowlist secretFix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Python subprocess execution detectedawslabs/dynamodb_mcp_server/cdk_generator/generator.py:115 · Python subprocess execution detectedsubprocess.run( # nosec B603, B607 - user local env, hardcoded cmd, no shell, timeoutFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/repo_generation_tool/conftest.py:259 · Python subprocess execution detectedreturn subprocess.run(cmd, cwd=project_root, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/repo_generation_tool/scripts/manage_snapshots.py:294 · Python subprocess execution detectedresult = subprocess.run(cmd, cwd=project_root)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/cdk_generator/integration/test_cdk_compilation.py:21 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagetests/cdk_generator/test_generator.py:231 · npx invocation of non-well-known package — may execute untrusted codewith pytest.raises(CdkGeneratorError, match='npx command not found'):Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstests/db_analyzer/test_plugins.py:516 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesplugin.parse_results_from_file('/tmp/safe/../../../etc/passwd')Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_model_validation_utils.py:1533 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'file:///etc/passwd',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_common.py:90 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesvalidate_path_within_directory('/etc/passwd', tmpdir, 'test file')Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/db_analyzer/test_analyzer_utils.py:255 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesplugin, 'test_db', 500, '/etc/passwd', tmpdir, 'mysql'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/repo_generation_tool/unit/test_codegen.py:681 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesgenerate(schema_path='../../../../etc/passwd', validate_only=True)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedawslabs/dynamodb_mcp_server/model_validation_utils.py:136 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagetests/cdk_generator/test_generator.py:228 · npx invocation of non-well-known package — may execute untrusted code"""Test _run_cdk_init when npx is not found."""Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstests/test_common.py:86 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesvalidate_path_within_directory('../../../etc/passwd', tmpdir, 'test file')Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/repo_generation_tool/scripts/manage_snapshots.py:105 · Python subprocess execution detectedreturn subprocess.run(cmd, cwd=get_project_root(), capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/db_analyzer/test_plugins.py:509 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesplugin.parse_results_from_file('../../../etc/passwd')Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagetests/cdk_generator/test_generator.py:229 · npx invocation of non-well-known package — may execute untrusted codemock_run.side_effect = FileNotFoundError('npx not found')Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagetests/cdk_generator/integration/test_cdk_deployment.py:197 · npx invocation of non-well-known package — may execute untrusted codepytest.skip('npx or npm not found')Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedtests/cdk_generator/integration/test_cdk_compilation.py:61 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/repo_generation_tool/conftest.py:289 · Python subprocess execution detectedresult = subprocess.run(cmd, cwd=project_root, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packageawslabs/dynamodb_mcp_server/cdk_generator/generator.py:136 · npx invocation of non-well-known package — may execute untrusted code'npx command not found. Install Node.js and npm, then try again.'Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Destructive command against a filesystem root or devicetests/test_model_validation_utils.py:587 · Destructive command against a filesystem root or device['bash', '-c', 'rm -rf /'],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_common.py:94 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesvalidate_path_within_directory('/etc/passwd', tmpdir, 'custom output file')Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/repo_generation_tool/unit/test_language_config.py:91 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesLanguageConfigLoader.load('../../../etc/passwd')Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/cdk_generator/integration/test_cdk_deployment.py:48 · Python subprocess execution detectedinstall_result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedawslabs/dynamodb_mcp_server/model_validation_utils.py:777 · Python subprocess execution detectedprocess = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagetests/cdk_generator/integration/test_cdk_compilation.py:82 · npx invocation of non-well-known package — may execute untrusted codepytest.skip('npx or npm not found - skipping synthesis test')Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstests/test_model_validation_utils.py:1590 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesMockMember('../../../etc/passwd'),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/cdk_generator/integration/test_cdk_compilation.py:47 · Python subprocess execution detectedinstall_result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/cdk_generator/integration/test_cdk_deployment.py:183 · Python subprocess execution detectedcleanup_result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Destructive file system command detectedtests/test_model_validation_utils.py:587 · Destructive file system command detected['bash', '-c', 'rm -rf /'],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
AWS access key pattern detectedtests/test_model_validation_utils.py:1512 · AWS access key pattern detected — possible hardcoded or harvested keyaws_access_key_id='AKIAIOSFODNN7EXAMPLE', # pragma: allowlist secretFix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Access to sensitive file pathstests/db_analyzer/test_analyzer_utils.py:214 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesanalyzer_utils.resolve_and_validate_path('/etc/passwd', tmpdir, 'test file')Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/cdk_generator/integration/test_cdk_deployment.py:60 · Python subprocess execution detecteddeploy_result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_model_validation_utils.py:1573 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesMockMember('/etc/passwd'),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
URL to a private-network addresstests/test_model_validation_utils.py:959 · URL to a private-network address — a LAN or development targetmock_client.meta.endpoint_url = 'http://192.168.1.100:8000'Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07

Cost to the agent

Instructions loaded
≈3,744 tok
2 files · 81 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for awslabs.dynamodb-mcp-server@2.1.10 as of 5d ago. This is the package itself, not its dependencies.