Skills/PyPI/mcp-oura

mcp-oura@0.4.0

CAUTION· not started

Publisher claims: "The Oura v2 API as an MCP server. Paginates, fixes the date range, warns when data is missing." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher proscar87 · publishing for 97 daysInstalls 745Last detonated 6d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
OAUTH_KVOAUTH_PROVIDEROURA_CLIENT_SECRETOURA_CREDENTIALSOURA_PATOURA_TOKENSConfiguration, not credentials: OURA_API_BASE_URL, OURA_CLIENT_ID, OURA_NO_KEYCHAIN, OURA_OWNER_EMAIL, OURA_PAT_FILE, OURA_PYTHON, OURA_SANDBOX, OURA_SMOKE_CMD, OURA_TIMEZONE
Where it talks to
ouraring.com (its own)Also pydantic.dev — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names pydantic.dev as well as its own vendor. The guard injects OAUTH_KV, OAUTH_PROVIDER, OURA_CLIENT_SECRET, OURA_CREDENTIALS, OURA_PAT, OURA_TOKENS only into requests to ouraring.com (and its subdomains) and refuses the rest.

$vet-skills run --secrets OAUTH_KV=ouraring.com,OAUTH_PROVIDER=ouraring.com,OURA_CLIENT_SECRET=ouraring.com,OURA_CREDENTIALS=ouraring.com,OURA_PAT=ouraring.com,OURA_TOKENS=ouraring.com -- uvx mcp-oura

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-08 and scored it 79/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathssrc/oura_mcp/__main__.py:87 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import credentials_path, forgetFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/oura_mcp/client.py:553 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import loadFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packageAGENTS.md:241 · npx invocation of non-well-known package — may execute untrusted codecd ts && npx vitest run # 127 more, same ruleFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known package.github/workflows/ci.yml:87 · npx invocation of non-well-known package — may execute untrusted codenpx wrangler dev --port 8787 --var OURA_SANDBOX:1 \Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathssrc/oura_mcp/server.py:558 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import SCOPES, loadFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/oura_mcp/client.py:253 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import load, refreshFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detectedDockerfile:43 · Destructive file system command detectedRUN pip install --no-cache-dir . && rm -rf /srcFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/oura_mcp/authorize.py:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import (SCOPES, AUTORIZAR_URL, DEFAULT_REDIRECT,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_parity.py:99 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtools/smoke_stdio.py:74 · Python subprocess execution detectedproc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandtools/mutate.py:163 · Process kill command — agent can terminate processes("a missing browser opener does not kill the process", "ts/src/authorize.ts",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtools/mutate.py:204 · Python subprocess execution detectedr = subprocess.run(cmd, cwd=cwd, capture_output=True, text=True, timeout=300)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_parity.py:283 · Python subprocess execution detectedr = subprocess.run(["node", "--input-type=module", "-e", guion],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagets/build-mcpb.sh:21 · npx invocation of non-well-known package — may execute untrusted codenpx tscFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandtools/mutate.py:165 · Process kill command — agent can terminate processes("a stray callback does not kill the process", "ts/src/authorize.ts",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiontests/test_today.py:9 · File type combined with upload action — agent may exfiltrate local data filesis computed here, `llms.txt` says an average computed inside arrives without itsFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagets/build-mcpb.sh:52 · npx invocation of non-well-known package — may execute untrusted code# THE PACKAGE IS SCOPED; the binary it installs is not. `npx mcpb` resolves onlyFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedtests/test_parity.py:233 · Python subprocess execution detectedr = subprocess.run(["node", "--input-type=module", "-e", guion],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagetests/test_parity.py:31 · npx invocation of non-well-known package — may execute untrusted codereason="needs node and a compiled ts/dist (run `cd ts && npx tsc`)",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedtests/test_parity.py:45 · Python subprocess execution detectedr = subprocess.run(["node", "--input-type=module", "-e", guion],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_parity.py:201 · Python subprocess execution detectedr = subprocess.run(["node", "--input-type=module", "-e", guion],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagets/worker/tests/e2e.sh:5 · npx invocation of non-well-known package — may execute untrusted code# npx wrangler dev --port 8787 --var OURA_SANDBOX:1 --var OURA_TIMEZONE:America/Mexico_CityFix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Authorization escalation languagets/worker/README.md:79 · Authorization escalation language · informational: not an instruction file · informational: not an instruction file- **ChatGPT** — *Settings → Apps → Advanced settings → Developer mode*, thenFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languageROADMAP.md:2520 · Authorization escalation language · informational: not an instruction file · informational: not an instruction fileconnectors in claude.ai take any URL on any plan, and ChatGPT's developer modeFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packagets/build-mcpb.sh:68 · npx invocation of non-well-known package — may execute untrusted codenpx ${NPM_CACHE:+--cache "$NPM_CACHE"} --yes @anthropic-ai/[email protected] \Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Prompt injectionROADMAP.md:2520 · Prompt injection — known jailbreak technique reference · informational: not an instruction file · informational: not an instruction fileconnectors in claude.ai take any URL on any plan, and ChatGPT's developer modeFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Process kill commandts/tests/client.test.ts:745 · Process kill command — agent can terminate processes// ── Opening the browser must not be able to kill the server ────────────────Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Refusal suppressionROADMAP.md:940 · Refusal suppression — attempting to prevent safety responses · informational: not an instruction file · informational: not an instruction fileclean, and the response looked identical to one that was never refused.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commandts/worker/src/tokens.ts:10 · Process kill command — agent can terminate processes* refresh token, and the second exchange would kill the session the first hadFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagets/build-mcpb.sh:54 · npx invocation of non-well-known package — may execute untrusted code# Anywhere else npx asks the registry for a package literally named `mcpb`, getsFix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Prompt injectionts/worker/README.md:79 · Prompt injection — known jailbreak technique reference · informational: not an instruction file · informational: not an instruction file- **ChatGPT** — *Settings → Apps → Advanced settings → Developer mode*, thenFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01

Cost to the agent

Instructions loaded
≈3,993 tok
2 files · 79 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp-oura@0.4.0 as of 6d ago. This is the package itself, not its dependencies.

What would make this Verified

1 point to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim proscar87: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  4. Destructive file system command detected≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim proscar87Propose a patch to the maintainer