Skills/PyPI/mcp-clickhouse

mcp-clickhouse@0.7.0

VERIFIED· not started

Publisher claims: "An MCP server for ClickHouse." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher clickhouse · publishing for 640 daysInstalls 241KLast detonated 34 h ago
$claude mcp add mcp-clickhouse -- uvx mcp-clickhouse
WatchReport an issue

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
CLICKHOUSE_MCP_AUTH_DISABLEDCLICKHOUSE_MCP_AUTH_TOKENCLICKHOUSE_PASSWORDConfiguration, not credentials: CHDB_DATA_PATH, CHDB_ENABLED, CLICKHOUSE_ALLOW_DROP, CLICKHOUSE_ALLOW_WRITE_ACCESS, CLICKHOUSE_CA_CERT, CLICKHOUSE_CLIENT_CERT, CLICKHOUSE_CLIENT_CERT_KEY, CLICKHOUSE_CONNECT_TIMEOUT, CLICKHOUSE_DATABASE, CLICKHOUSE_ENABLED, CLICKHOUSE_HOST, CLICKHOUSE_MCP_BIND_HOST, CLICKHOUSE_MCP_BIND_PORT, CLICKHOUSE_MCP_MAX_WORKERS, CLICKHOUSE_MCP_QUERY_TIMEOUT, CLICKHOUSE_MCP_SERVER_TRANSPORT, CLICKHOUSE_PORT, CLICKHOUSE_PROXY_PATH, CLICKHOUSE_ROLE, CLICKHOUSE_SECURE, CLICKHOUSE_SEND_RECEIVE_TIMEOUT, CLICKHOUSE_SERVER_HOST_NAME, CLICKHOUSE_TLS_MODE, CLICKHOUSE_USER, CLICKHOUSE_VERIFY, MCP_CLICKHOUSE_TRUSTSTORE_DISABLE, MCP_MIDDLEWARE_MODULE
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard. It asks for CLICKHOUSE_MCP_AUTH_DISABLED, CLICKHOUSE_MCP_AUTH_TOKEN, CLICKHOUSE_PASSWORD and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --net declared -- uvx mcp-clickhouse

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 81/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsAGENTS.md:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…ntract This module has meaningful import-time behavior. `mcp_server.py` loads `.env`, creates executors, constructs the `FastMCP` instance, and conditionally regis…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Instructs the agent to modify its persistent memory or instruction files.claude/agents/docs-drift-reviewer.md:31 · Instructs the agent to modify its persistent memory or instruction files… and the declared environment dependencies. - `CHANGELOG.md`. Unlike some repos, AGENTS.md makes the changelog your responsibility too: add an entry for user-visible fixes, features, security changes, and behavior chang…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Instructs the agent to modify its persistent memory or instruction files.claude/agents/docs-drift-reviewer.md:62 · Instructs the agent to modify its persistent memory or instruction filesThe `Writing Style` section of AGENTS.md is the full rule set and it applies to every word you write into the docs. Read it rather than working from a summary. Terse, plain, concrete, no fluff.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsmcp_clickhouse/auth.py:214 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Find the nearest .env at or above the installed package directory."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_auth_config.py:152 · MCP server using network transport (SSE/HTTP) — data sent over networkmonkeypatch.setenv("CLICKHOUSE_MCP_SERVER_TRANSPORT", "http")Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathsmcp_clickhouse/auth.py:217 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = os.path.join(directory, ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_startup_contract.py:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(source_root / ".env").write_text("")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_auth_config.py:205 · MCP server using network transport (SSE/HTTP) — data sent over networkmonkeypatch.setenv("CLICKHOUSE_MCP_SERVER_TRANSPORT", "http")Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Access to sensitive file pathstests/test_auth_config.py:304 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = package_dir.parent / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_startup_contract.py:44 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagemcp_clickhouse/skills_advisor.py:9 · npx invocation of non-well-known package — may execute untrusted codenpx -y skills add clickhouse/agent-skills --allFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstests/test_auth_config.py:282 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_auth_config.py:189 · MCP server using network transport (SSE/HTTP) — data sent over networkmonkeypatch.setenv("CLICKHOUSE_MCP_SERVER_TRANSPORT", "http")Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedtests/test_auth_config.py:385 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Destructive file system command detected.github/workflows/ci.yaml:115 · Destructive file system command detectedtimeout 10s docker run --rm \Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_startup_contract.py:887 · MCP server using network transport (SSE/HTTP) — data sent over network"CLICKHOUSE_MCP_SERVER_TRANSPORT": "http" if app_method == "http_app" else "sse",Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_auth_config.py:94 · MCP server using network transport (SSE/HTTP) — data sent over networkmonkeypatch.setenv("CLICKHOUSE_MCP_SERVER_TRANSPORT", "http")Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
URL with embedded credentialstests/test_context_config_override.py:315 · URL with embedded credentials — may be phishing or credential leakingcreate_clickhouse_client({"dsn": "https://svc_user:svc_secret_79@host\uff03x/db"})Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)AGENTS.md:53 · MCP server using network transport (SSE/HTTP) — data sent over network…rchitecture And MCP Contract This module has meaningful import-time behavior. `mcp_server.py` loads `.env`, creates executors, constructs the `FastMCP` instance, and conditionally registers ClickHouse and chDB tools. HTTP/SSE authenticatio…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_http_security_boundary.py:432 · MCP server using network transport (SSE/HTTP) — data sent over networkapp = mcp_server_module.mcp.sse_app()Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Access to sensitive file pathstests/test_auth_config.py:258 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslambda: "/package/.env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_auth_config.py:263 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesload_default.assert_called_once_with(dotenv_path="/package/.env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_http_security_boundary.py:843 · MCP server using network transport (SSE/HTTP) — data sent over networkmonkeypatch.setenv("CLICKHOUSE_MCP_SERVER_TRANSPORT", "http")Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_auth_config.py:106 · MCP server using network transport (SSE/HTTP) — data sent over networkmonkeypatch.setenv("CLICKHOUSE_MCP_SERVER_TRANSPORT", "sse")Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathsmcp_clickhouse/auth.py:266 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesvalues = dotenv_values(env_file if explicit_env_file else ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)AGENTS.md:18 · MCP server using network transport (SSE/HTTP) — data sent over network- `mcp_clickhouse/mcp_server.py`: Startup assembly, FastMCP server construction, tool and prompt registration, and shutdown coordination.Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
URL with embedded credentialstests/test_context_config_override.py:364 · URL with embedded credentials — may be phishing or credential leakingdsn = "https://dsn_user:[email protected]:8443/dsn_db?query_limit=10"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Access to sensitive file pathstests/test_auth_config.py:303 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(package_dir / ".env").mkdir()Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_startup_contract.py:184 · MCP server using network transport (SSE/HTTP) — data sent over network"CLICKHOUSE_MCP_SERVER_TRANSPORT=http\n"Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)mcp_clickhouse/mcp_env.py:533 · MCP server using network transport (SSE/HTTP) — data sent over networkCLICKHOUSE_MCP_SERVER_TRANSPORT: "stdio", "http", or "sse" (default: stdio)Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)mcp_clickhouse/transport.py:20 · MCP server using network transport (SSE/HTTP) — data sent over network"CLICKHOUSE_MCP_SERVER_TRANSPORT=http for Streamable HTTP."Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Access to sensitive file pathstests/test_startup_contract.py:182 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(source_root / ".env").write_text(Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_auth_config.py:418 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈2,877 tok
3 files · 64 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp-clickhouse@0.7.0 as of 6 h ago. This is the package itself, not its dependencies.