iflow-mcp-lns2905-beads-village@1.3.0
VERIFIEDPublisher claims: "MCP server for multi-agent workflow with Beads + Agent Mail" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
$claude mcp add iflow-mcp-lns2905-beads-village -- uvx iflow-mcp_lns2905-beads-village
WatchReport an issueIs [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-03 and scored it 81/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 1 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.8sprocessexec /usr/bin/timeout
0.8sclaimed21 tools: init, claim, done, add, assign, ls, show, cleanup, doctor, sync, reserve, release, reservations, msg, inbox, status, bv_insights, bv_plan, bv_priority, bv_diff, village_tui
0.8sprocessscript backend runs setup only
Static findings
MEDIUM
Python subprocess execution detectedbeads_village/bv_manager.py:39 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedbeads_village/bv_manager.py:187 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedbeads_village/bv_manager.py:284 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedbeads_village/bv_manager.py:208 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedbeads_village/dashboard/app.py:960 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedbeads_village/dashboard/app.py:918 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedbeads_village/bv_manager.py:276 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedbeads_village/server.py:120 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedbeads_village/server.py:835 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedbeads_village/server.py:2047 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedbeads_village/server.py:2065 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedbeads_village/server.py:2054 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05