digikala-mcp@0.6.1
VERIFIED· not startedPublisher claims: "Unofficial read-only MCP server for Digikala: search with feature filters, best picks for a budget, compare sellers and prices, price history, reviews, deals." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry PyPI (MCP server)Publisher sepehr071 · publishing for 42 daysInstalls 306Last detonated 3d ago
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
- no credential variables read in the code
- Where it talks to
- digikala.com (its own)
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it under the guard. Not started: dependency install failed; the server itself was not observed. The code names no credential variable and talks to digikala.com, its own; the guard pins the network to what the honeypot saw and logs every call.
$vet-skills run --net declared -- uvx digikala-mcp
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-11 and scored it 82/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.2sprocessdependency install exit 1 ·
0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run
Static findings
MEDIUM
Hidden zero-width characters detectedtests/fixtures/best_selling.json:41 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/best_selling.json:121 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Dense URL-encoded contenttests/fixtures/autocomplete.json:11 · Dense URL-encoded content — may be obfuscating payloads
AST07"url": "/search/category-mobile-phone/?q=%D9%85%D9%88%D8%A8%D8%A7%DB%8C%D9%84+%D8%B3%D8%A7%D9%85%D8%B3%D9%88%D9%86%DA%AF"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Hidden zero-width characters detectedtests/fixtures/budget_search.json:7 · Hidden zero-width characters detected — may conceal content
AST07…e-C، با قابلیت اتصال به 2 دستگاه همزمان، دارای باتری قابل شارژ، اتصال دوگانه (بی‌سیم و )، دارای نشانگر LED، دارای شیار کارت حافظه", "title_en": "", "sta…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.HIGH
Collapsed <details> block carrying instructionsREADME.md:162 · Collapsed <details> block carrying instructions
AST01<summary><b>Anything else</b></summary> It's a standard stdio MCP server: run `uvx digikala-mcp`, or `pip install digikala-mcp` and run `digikala-mcp`.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
Hidden zero-width characters detectedtests/fixtures/brand_products.json:139 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Dense URL-encoded contenttests/fixtures/autocomplete.json:20 · Dense URL-encoded content — may be obfuscating payloads
AST07"url": "/search/category-mobile-phone/?q=%D9%85%D9%88%D8%A8%D8%A7%DB%8C%D9%84+%D8%B3%D8%A7%D9%85%D8%B3%D9%88%D9%86%DA%AF+a56"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Hidden zero-width characters detectedtests/fixtures/brand_products.json:7 · Hidden zero-width characters detected — may conceal content
AST07"title": "دسته‌بندی",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/brand_products.json:113 · Hidden zero-width characters detected — may conceal content
AST07"title_fa": "گوشی موبایل سامسونگ مدل Galaxy A57 دو سیم‌کارت ظرفیت 256 گیگابایت و رم 8 گیگابایت - ویتنام",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/best_selling.json:7 · Hidden zero-width characters detected — may conceal content
AST07"title_fa": "گوشی موبایل نوکیا مدل 105 2023 دو سیم کارت - مونتاژ ایران تحت لیسانس نوکیا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/brand_products.json:23 · Hidden zero-width characters detected — may conceal content
AST07"title_fa": "شارژر مخصوص لپ‌تاپ",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Dense URL-encoded contenttests/fixtures/autocomplete.json:27 · Dense URL-encoded content — may be obfuscating payloads
AST07"url": "/search/?q=%D9%85%D9%88%D8%A8%D8%A7%DB%8C%D9%84+%D8%B3%D8%A7%D9%85%D8%B3%D9%88%D9%86%DA%AF+a17"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Hidden zero-width characters detectedtests/fixtures/best_selling.json:81 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/brand_products.json:99 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/comments.json:120 · Hidden zero-width characters detected — may conceal content
AST07"company_name": "نوآوران فن‌آوازه (دیجی‌کالا)",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/category_filters.json:46 · Hidden zero-width characters detected — may conceal content
AST07"title": "قهوه‌‌ای",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/category_tree.json:58 · Hidden zero-width characters detected — may conceal content
AST07"title_fa": "هدفون حرفه‌ای",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/compare.json:122 · Hidden zero-width characters detected — may conceal content
AST07"سایز نانو (8.8 × 12.3 میلی‌متر)"Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/comments.json:34 · Hidden zero-width characters detected — may conceal content
AST07"company_name": "نوآوران فن‌آوازه (دیجی‌کالا)",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/deals.json:75 · Hidden zero-width characters detected — may conceal content
AST07"title": "شگفت‌انگیز سفارشی",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/category_products.json:120 · Hidden zero-width characters detected — may conceal content
AST07"title_fa": "مرتبط‌ترین"Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/comments.json:33 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/compare.json:140 · Hidden zero-width characters detected — may conceal content
AST07"title": "نرخ به‌روزرسانی تصویر",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/compare.json:133 · Hidden zero-width characters detected — may conceal content
AST07"title": "فناوری صفحه نمایش",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/category_filters.json:75 · Hidden zero-width characters detected — may conceal content
AST07"description": "با خرید از کالاهایی با امکان ارسال توسط فروشنده می‌توانید سفارش خود را زودتر تحویل بگیرید",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/compare.json:92 · Hidden zero-width characters detected — may conceal content
AST07"title": "دسته بندی",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/budget_search.json:238 · Hidden zero-width characters detected — may conceal content
AST07"title_fa": "هدفون بلوتوثی مدل P47-5.0+EDR، پشتیبانی از کارت حافظه و رادیو، طراحی تاشو، باتری 500 میلی‌آمپرساعتی و کابل AUX",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/category_tree.json:59 · Hidden zero-width characters detected — may conceal content
AST07"title_en": "هدفون حرفه‌ای",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/category_filters.json:104 · Hidden zero-width characters detected — may conceal content
AST07"title": "فقط کالاهای موجود در انبار دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/category_products.json:116 · Hidden zero-width characters detected — may conceal content
AST07"title_fa": "پرفروش‌ترین"Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/compare.json:34 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/comments.json:119 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/category_filters.json:122 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا"Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/fresh_search.json:130 · Hidden zero-width characters detected — may conceal content
AST07"title_fa": "مرتبط‌ترین"Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/fresh_search.json:74 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/fresh_product.json:121 · Hidden zero-width characters detected — may conceal content
AST07"title": "ارسال سریع سوپرمارکتی دیجی‌کالا"Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/fresh_deals.json:137 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/fresh_category.json:59 · Hidden zero-width characters detected — may conceal content
AST07"title_fa": "پنیر خامه ای",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/deals.json:125 · Hidden zero-width characters detected — may conceal content
AST07"title": "شگفت‌انگیز سفارشی",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/fresh_category.json:60 · Hidden zero-width characters detected — may conceal content
AST07"title_en": "پنیر خامه ای",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/fresh_product.json:118 · Hidden zero-width characters detected — may conceal content
AST07"description": "موجود در انبار دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/fresh_search.json:114 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/fresh_product.json:99 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/fresh_deals.json:87 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/deals.json:175 · Hidden zero-width characters detected — may conceal content
AST07"title": "شگفت‌انگیز سفارشی",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/fresh_product.json:140 · Hidden zero-width characters detected — may conceal content
AST07"title": "وزن بسته‌بندی",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/fresh_deals.json:187 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/fresh_category.json:102 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/fresh_category.json:49 · Hidden zero-width characters detected — may conceal content
AST07"title": "دسته‌بندی",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/fresh_search.json:34 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/fresh_product.json:50 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/fresh_category.json:142 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/product.json:99 · Hidden zero-width characters detected — may conceal content
AST07"title": "تحویل عادی دیجی‌کالا"Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/fresh_search.json:138 · Hidden zero-width characters detected — may conceal content
AST07"title_fa": "ارزان‌ترین"Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/search_filters.json:25 · Hidden zero-width characters detected — may conceal content
AST07"title_en": "هدفون حرفه‌ای"Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/product.json:75 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/seller.json:49 · Hidden zero-width characters detected — may conceal content
AST07"title": "دسته‌بندی",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/product.json:53 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/price_chart.json:22 · Hidden zero-width characters detected — may conceal content
AST07"seller": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/search.json:196 · Hidden zero-width characters detected — may conceal content
AST07"title_fa": "گوشی موبایل سامسونگ مدل Galaxy A07 دو سیم کارت ظرفیت 128 گیگابایت و رم 4 گیگابایت - نسخه به‌همراه شارژر",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/product.json:103 · Hidden zero-width characters detected — may conceal content
AST07"title": "تحویل سریع دیجی‌کالا (تهران و کرج)"Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/search.json:101 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/seller.json:205 · Hidden zero-width characters detected — may conceal content
AST07"title_fa": "پرفروش‌ترین"Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/product.json:95 · Hidden zero-width characters detected — may conceal content
AST07"description": "موجود در انبار دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/search.json:182 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/search_filters.json:7 · Hidden zero-width characters detected — may conceal content
AST07"title": "دسته‌بندی",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/search_filters.json:70 · Hidden zero-width characters detected — may conceal content
AST07"title": "قهوه‌‌ای",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/plus_plans.json:145 · Hidden zero-width characters detected — may conceal content
AST07"title": "بازه‌های ارسال اختصاصی",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/search_filters.json:24 · Hidden zero-width characters detected — may conceal content
AST07"title_fa": "هدفون حرفه‌ای",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/search.json:142 · Hidden zero-width characters detected — may conceal content
AST07"title": "دیجی‌کالا",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/search.json:49 · Hidden zero-width characters detected — may conceal content
AST07"title": "دسته‌بندی",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/similar.json:174 · Hidden zero-width characters detected — may conceal content
AST07"title_fa": "مرتبط‌ترین"Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.Cost to the agent
Instructions loaded
≈76 tok
1 file · 57 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for digikala-mcp@0.6.1 as of 3d ago. This is the package itself, not its dependencies.