mcp-genelab@1.0.0
CAUTION· not startedPublisher claims: "MCP server for querying the NASA GeneLab Knowledge Graph with specialist tools for differential gene expression, DNA methylation, and organism abundance analyses (per-assay and cross-assay), plus DE/DM overlap detection, volcano and Venn plotting, session-scoped resource-based plot delivery, and ALB health/usage-metrics endpoints for shared-process (ECS Fargate) deployment." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry PyPI (MCP server)Publisher sbl-sdsc · publishing for 405 daysInstalls 23Last detonated 7d ago
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
Code inventory arrives with this version's next honeypot run.- It will ask for
- unknown until the next run
- Where it talks to
- unknown until the next run
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Not enough was observed to say yet. Not started: dependency install failed; the server itself was not observed. This version's code has not been inventoried for credentials and hosts either; both arrive with its next honeypot run (popular servers first). `vet-skills try mcp-genelab` runs it now and prints the full answer.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-07 and scored it 79/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Latin word with Cyrillic or Greek look-alike letters (homoglyph). Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1
0.2sprocessexec /usr/bin/date
0.2sprocessexec /usr/bin/timeout
0.2sprocessexec .venv/bin/mcp-genelab
0.2sclaimedno tools/list reply (exit 0)
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run
Static findings
HIGH
Latin word with Cyrillic or Greek look-alike letters (homoglyph)docs/examples/demos/HBISS_03-2026_Demos/OSD-48_GLkg_monarchkg_pubmed.md:249 · Latin word with Cyrillic or Greek look-alike letters (homoglyph)
AST01PPARαFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
MCP server using network transport (SSE/HTTP)mcp-genelab-tests/tests/test_common_tools.py:44 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04mcp_server, "find_common_differentially_expressed_genes",Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
Destructive file system command detectedDockerfile:39 · Destructive file system command detected
AST05&& rm -rf /var/lib/apt/lists/*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.LOW
Authorization escalation languagedocs/deployment.md:480 · Authorization escalation language · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file
AST01- **ChatGPT (Developer Mode)** and dev tools (Claude Code, Cursor, Cline, curl)Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Prompt injectionREADME.md:171 · Prompt injection — known jailbreak technique reference · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file
AST011. In ChatGPT on the web, open **Settings → Apps → Advanced settings** and enable **Developer mode** (Pro; on Business/Enterprise/Edu an admin must enable it)Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
MCP server using network transport (SSE/HTTP)mcp-genelab-tests/tests/test_data_tools.py:119 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04mcp_server, "find_differentially_expressed_genes",Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.LOW
Prompt injectiondocs/deployment.md:480 · Prompt injection — known jailbreak technique reference · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file
AST01- **ChatGPT (Developer Mode)** and dev tools (Claude Code, Cursor, Cline, curl)Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.LOW
Authorization escalation languageREADME.md:171 · Authorization escalation language · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file
AST011. In ChatGPT on the web, open **Settings → Apps → Advanced settings** and enable **Developer mode** (Pro; on Business/Enterprise/Edu an admin must enable it)Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Prompt injectionREADME.md:180 · Prompt injection — known jailbreak technique reference · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file
AST01Documentation: [Add custom MCP server](https://developers.openai.com/api/docs/guides/custom-mcp-server) · [Developer mode and MCP apps in ChatGPT](https://help.openai.com/en/articles/12584461-developeFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.LOW
Authorization escalation languagedocs/deployment.md:6 · Authorization escalation language · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file
AST01MCP client (ChatGPT Developer Mode / Claude / Cursor / Claude Code / curl …)Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Authorization escalation languageREADME.md:129 · Authorization escalation language · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file
AST01- ChatGPT (web, Developer mode) — connect via Add custom MCP serverFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Prompt injectionREADME.md:129 · Prompt injection — known jailbreak technique reference · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file
AST01- ChatGPT (web, Developer mode) — connect via Add custom MCP serverFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Access to sensitive file pathsmcp-genelab-tests/tests/test_endpoint_hardening.py:156 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"/tmp/../../etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.LOW
Fake instruction boundary tagdocs/api.md:507 · Fake instruction boundary tag · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file
AST01<prompt>Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
File type combined with upload actionmcp-genelab-tests/tests/test_session_isolation.py:409 · File type combined with upload action — agent may exfiltrate local data files
AST07assert rj.json()["tools"]["get_output_directory"]["calls"] == 1Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.LOW
Prompt injectiondocs/deployment.md:6 · Prompt injection — known jailbreak technique reference · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file
AST01MCP client (ChatGPT Developer Mode / Claude / Cursor / Claude Code / curl …)Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.LOW
Authorization escalation languageREADME.md:180 · Authorization escalation language · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file
AST01Documentation: [Add custom MCP server](https://developers.openai.com/api/docs/guides/custom-mcp-server) · [Developer mode and MCP apps in ChatGPT](https://help.openai.com/en/articles/12584461-developeFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
MCP server using network transport (SSE/HTTP)mcp-genelab-tests/tests/test_session_isolation.py:341 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04mcp_server.streamable_http_app(**_SERVER_MODULE.STREAMABLE_HTTP_OPTIONS),Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
MCP server using network transport (SSE/HTTP)mcp-genelab-tests/tests/test_data_tools.py:102 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04mcp_server, "find_differentially_expressed_genes",Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.Cost to the agent
Instructions loaded
≈130 tok
1 file · 49 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for mcp-genelab@1.0.0 as of 7d ago. This is the package itself, not its dependencies.
What would make this Verified
1 point to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim sbl-sdsc: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
- MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
- Destructive file system command detected≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Access to sensitive file paths≈ +2 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim sbl-sdscPropose a patch to the maintainer