maidr-mcp@0.1.4
VERIFIED· not startedPublisher claims: "MCP server that shows accessible maidr charts in ChatGPT and Claude conversations, and lets the model move the reader through them" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry PyPI (MCP server)Publisher xability · publishing for 43 daysInstalls 232Last detonated 5d ago
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
MAIDR_MCP_TOKENMAIDR_MCP_TOKEN_FILEConfiguration, not credentials: CHROMIUM, GITHUB_OUTPUT, GITHUB_RUN_ID, GITHUB_SHA, HOST_URL, MAIDR_JS_FILE, MAIDR_MCP_MAIDR_JS_VERSION, SERVER_URL- Where it talks to
- maidr.ai (its own)Also jsdelivr.net, slsa.dev — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names jsdelivr.net, slsa.dev as well as its own vendor. The guard injects MAIDR_MCP_TOKEN, MAIDR_MCP_TOKEN_FILE only into requests to maidr.ai (and its subdomains) and refuses the rest.
$vet-skills run --secrets MAIDR_MCP_TOKEN=maidr.ai,MAIDR_MCP_TOKEN_FILE=maidr.ai -- uvx maidr-mcp
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-09 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run
Static findings
MEDIUM
npx invocation of non-well-known package.github/workflows/ci.yml:48 · npx invocation of non-well-known package — may execute untrusted code
AST06run: npm install --no-audit --no-fund && npx playwright-core install --with-deps chromiumFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known package.github/workflows/claude-code-review.yml:95 · npx invocation of non-well-known package — may execute untrusted code
AST06PLAYWRIGHT_BROWSERS_PATH="$HOME/.cache/ms-playwright" npx playwright-core install --with-deps chromiumFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known package.github/workflows/update-maidr.yml:218 · npx invocation of non-well-known package — may execute untrusted code
AST06install() { npm install --no-audit --no-fund && npx playwright-core install --with-deps chromium; }Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Python subprocess execution detectedtests/test_release_state.py:43 · Python subprocess execution detected
AST05done = subprocess.run(["git", *args], cwd=cwd, check=True, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/release_state.py:65 · Python subprocess execution detected
AST05found = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/update_maidr.py:205 · Python subprocess execution detected
AST05subprocess.run(command, cwd=root, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.LOW
Prompt injectionREADME.md:168 · Prompt injection — known jailbreak technique reference · informational: not an instruction file
AST01**ChatGPT.** Turn on developer mode, then create an app for `https://<your-host>/mcp/<token>`. Developer mode is available on the web for Plus, Pro, Business, Enterprise and Education accounts.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
npx invocation of non-well-known packagee2e/run.sh:36 · npx invocation of non-well-known package — may execute untrusted code
AST06INPUT=sandbox.html npx vite build --logLevel errorFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagee2e/run.sh:35 · npx invocation of non-well-known package — may execute untrusted code
AST06INPUT=index.html npx vite build --logLevel errorFix: Pin versions and sources; vendor anything fetched at install time.LOW
Prompt injectionREADME.md:192 · Prompt injection — known jailbreak technique reference · informational: not an instruction file
AST01- **App:** you add it in developer mode through the tunnel, as that guide describes.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Destructive file system command detectedtests/test_update_maidr.py:186 · Destructive file system command detected
AST05@pytest.mark.parametrize("value", ["", "1.26.0; rm -rf /", "1.26.0\n", ">=1.26", "1.26.*", "1!2.0"])Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Destructive command against a filesystem root or devicetests/test_update_maidr.py:186 · Destructive command against a filesystem root or device
AST05@pytest.mark.parametrize("value", ["", "1.26.0; rm -rf /", "1.26.0\n", ">=1.26", "1.26.*", "1!2.0"])Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commande2e/run.sh:47 · Process kill command — agent can terminate processes
AST05trap 'kill $SERVER $HOST 2>/dev/null || true' EXITFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.LOW
Authorization escalation languageREADME.md:192 · Authorization escalation language · informational: not an instruction file
AST01- **App:** you add it in developer mode through the tunnel, as that guide describes.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
Python subprocess execution detectedscripts/release_state.py:60 · Python subprocess execution detected
AST05return subprocess.run(["git", *args], check=True, stdout=subprocess.PIPE, text=True).stdoutFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Access to sensitive file pathstests/test_update_maidr.py:154 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"4.13.0/../../etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.LOW
Authorization escalation languageREADME.md:168 · Authorization escalation language · informational: not an instruction file
AST01**ChatGPT.** Turn on developer mode, then create an app for `https://<your-host>/mcp/<token>`. Developer mode is available on the web for Plus, Pro, Business, Enterprise and Education accounts.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
npx invocation of non-well-known packagee2e/run.sh:8 · npx invocation of non-well-known package — may execute untrusted code
AST06# driver at a Chromium binary; without it, run `npx playwright-core install chromium`Fix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Instructions loaded
≈1,735 tok
2 files · 36 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for maidr-mcp@0.1.4 as of 5d ago. This is the package itself, not its dependencies.