Skills/PyPI/mcp-manager-gateway

mcp-manager-gateway@1.6.3

CAUTION· not started

Publisher claims: "Multi-user MCP management and lazy proxy gateway that makes MCP work like Skills: progressive capability discovery, on-demand server startup, and one stable gateway for every agent." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher eraycc · publishing for 63 daysInstalls 6,845Last detonated 6d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
MCP_MANAGER_TOKENConfiguration, not credentials: CLAUDE_CONFIG_DIR, CODEX_HOME, DSH_HOME, MCP_MANAGER_HOME, MCP_MANAGER_URL
Where it talks to
no vendor host named in the codeAlso mcp.example, environment.invalid — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names mcp.example, environment.invalid as well as its own vendor. The guard injects MCP_MANAGER_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx mcp-manager-gateway

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-08 and scored it 79/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathssrc/mcp_manager/home_migration.py:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileswith (home / ".env").open("x", encoding="utf-8") as file:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_manager/catalog_api.py:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import PERSONAL_AUTH_TYPESFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_manager/home_migration.py:89 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(staging / ".env").write_text(ENV_EXAMPLE + "\n" + "\n".join(Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_manager/imports.py:308 · Python subprocess execution detectedresult = subprocess.run([node, "-e", script, str(path)], capture_output=True, timeout=10, check=False,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathssrc/mcp_manager/home_migration.py:31 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(home / ".env").chmod(0o600)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_manager/app.py:32 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import CredentialStoreFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionsrc/mcp_manager/static/app.js:190 · File type combined with upload action — agent may exfiltrate local data files…ask('是否导出全部 MCP 服务配置为 JSON 文件？敏感字段将脱敏，重新导入后需补齐。',async()=>download('mcp-services.json',await api('/mcps/export',{method:'POST',body:{include_secrets:false}})))),button('新增服务',()=>mcpEditor(null,refresh),'primary')]));await tablePage(main,{…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/mcp_manager/static/app.js:260 · File type combined with upload action — agent may exfiltrate local data files…已取消']]]],actions:[button('导出筛选结果',()=>directDownload('/logs/export?'+p,'mcp-logs.json')),...(admin()?[button('删除全部匹配',()=>ask('永久删除所有匹配日志？',async()=>{await jobDialog(await api('/logs/delete',{method:'POST',body:{ids:null,filters:Object.fro…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathssrc/mcp_manager/home_migration.py:92 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(staging / ".env").chmod(0o600)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_manager/config.py:68 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesvalues.setdefault("_env_file", home / ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
document.cookie accesssrc/mcp_manager/static/core.js:9 · document.cookie access — can steal session cookies…null)} export async function api(path,{method='GET',body,signal}={}){const csrf=document.cookie.split('; ').find(x=>x.startsWith('mcp_csrf='))?.split('=').slice(1).join('=');c…Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathssrc/mcp_manager/oauth.py:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import config_isolation, credential_ownerFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathspyproject.toml:65 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesinclude = ["/src", "/tests", "/README.md", "/README.zh-CN.md", "/pyproject.toml", "/uv.lock", "/.env.example", "/Dockerfile", "/compose.yaml", "/compose.mysql.yaml", "/alembic.ini", "/deploy"]Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp_manager/catalog.py:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import PERSONAL_AUTH_TYPES, catalog_owner, credential_ownerFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionsrc/mcp_manager/static/styles.css:1 · File type combined with upload action — agent may exfiltrate local data files…-width:0;width:100%}textarea{min-height:120px;resize:vertical}.code,pre,textarea.json{font:12px/1.7 Consolas,monospace;overflow-wrap:anywhere}textarea.json{min-height:260px;tab-size:2}pre{white-space:pre-wrap;background:var(--bg);padding:1…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈85 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp-manager-gateway@1.6.3 as of 6d ago. This is the package itself, not its dependencies.

What would make this Verified

1 point to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim eraycc: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. document.cookie access≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  4. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  5. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim erayccPropose a patch to the maintainer