Is mcp-openproject@0.0.2 safe to install?

Skills/PyPI/mcp-openproject

mcp-openproject@0.0.2

VERIFIED· install only

Publisher claims: "OpenProject MCP Server for AI Integration - Production Ready v0.0.1" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher your-org · publishing for 487 daysInstalls 24Last detonated 6d ago

$claude mcp add mcp-openproject -- uvx mcp-openproject

Watch Report an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.

Tested: every file read, file written and host contacted by what ran
Not tested: use of the skill by an agent

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: API_KEYOPENPROJECT_API_KEYConfiguration, not credentials: ENCRYPTION_KEY, OPENPROJECT_BASE_URL
Where it talks to: openproject.org (its own)Also swagger.io, oauth.net, rfc-editor.org, gzip.org, openapi-generator.tech — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: use of the skill by an agent

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names swagger.io, oauth.net, rfc-editor.org, gzip.org, openapi-generator.tech as well as its own vendor. The guard injects API_KEY, OPENPROJECT_API_KEY only into requests to openproject.org (and its subdomains) and refuses the rest.

$vet-skills run --secrets API_KEY=openproject.org,OPENPROJECT_API_KEY=openproject.org -- uvx mcp-openproject

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-08 and scored it 87/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

0.0sprocessno install scripts to re-run

Static findings

HIGH

Access to sensitive file pathsmcp_server/http/app.py:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Load environment variables from .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

MCP server using network transport (SSE/HTTP)mcp_server/cli.py:174 · MCP server using network transport (SSE/HTTP) — data sent over networkfrom mcp_server.http.app import appFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

File type combined with upload actionmcp_server/openproject_client/openproject_api_client/__init__.py:8 · File type combined with upload action — agent may exfiltrate local data files

…ata. Moreover you can access the specification source itself under `/api/v3/spec.json` and `/api/v3/spec.yml` (e.g. [here](https://community.openproject.org/api/v3/spec.yml)). The APIv3 is a hypermedia REST API, a shorthand for \"Hypermedi…