Skills/PyPI/mcp-pinot-server

mcp-pinot-server@5.0.0

VERIFIED· not started

Publisher claims: "A production-grade MCP server for Apache Pinot" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher startreedata · publishing for 578 daysInstalls 178Last detonated 6d ago
$claude mcp add mcp-pinot-server -- uvx mcp-pinot-server
WatchReport an issue

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
AUTH_PROVIDERMCP_CONFIRMATION_SECRETMCP_STATIC_TOKENOAUTH_AUDIENCEOAUTH_AUTHORIZATION_ENDPOINTOAUTH_BASE_URLOAUTH_CLIENT_IDOAUTH_CLIENT_SECRETOAUTH_ENABLEDOAUTH_EXTRA_AUTH_PARAMSOAUTH_GRANTED_SCOPESOAUTH_ISSUEROAUTH_JWKS_URIOAUTH_REQUIRED_SCOPESOAUTH_SCOPESOAUTH_TOKEN_ENDPOINTPINOT_CONTROLLER_PASSWORDPINOT_CONTROLLER_TOKENPINOT_PASSWORDPINOT_TOKENPINOT_TOKEN_FILENAMEConfiguration, not credentials: MCP_ALLOWED_HOSTS, MCP_ALLOWED_ORIGINS, MCP_CONFIRMATION_TTL_SECONDS, MCP_HOST, MCP_LOG_LEVEL, MCP_MAX_CONCURRENCY, MCP_MAX_RESPONSE_BYTES, MCP_PATH, MCP_PORT, MCP_RATE_LIMIT_BURST, MCP_RATE_LIMIT_IDLE_TTL_SECONDS, MCP_RATE_LIMIT_MAX_CLIENTS, MCP_RATE_LIMIT_RPS, MCP_SSL_CERTFILE, MCP_SSL_KEYFILE, MCP_STATIC_SCOPES, MCP_TRANSPORT, PINOT_BROKER_HOST, PINOT_BROKER_PORT
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard. It asks for AUTH_PROVIDER, MCP_CONFIRMATION_SECRET, MCP_STATIC_TOKEN, OAUTH_AUDIENCE, OAUTH_AUTHORIZATION_ENDPOINT, OAUTH_BASE_URL, OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET, OAUTH_ENABLED, OAUTH_EXTRA_AUTH_PARAMS, OAUTH_GRANTED_SCOPES, OAUTH_ISSUER, OAUTH_JWKS_URI, OAUTH_REQUIRED_SCOPES, OAUTH_SCOPES, OAUTH_TOKEN_ENDPOINT, PINOT_CONTROLLER_PASSWORD, PINOT_CONTROLLER_TOKEN, PINOT_PASSWORD, PINOT_TOKEN, PINOT_TOKEN_FILENAME and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --net declared -- uvx mcp-pinot-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-08 and scored it 87/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.3sprocessdependency install exit 1 ·
0.3sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.3sprocessscript backend runs setup only
0.3sprocessno install scripts to re-run

Static findings

MEDIUM
File permission modification commandtests/test_config.py:662 · File permission modification command — agent changes file ownership/permissionsreason="chmod 0o000 does not deny read access on Windows",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Access to sensitive file pathstests/test_config.py:107 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileswith patch("mcp_pinot.config.load_dotenv"): # Disable .env loadingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_config.py:93 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileswith patch("mcp_pinot.config.load_dotenv"): # Disable .env loadingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_config.py:123 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileswith patch("mcp_pinot.config.load_dotenv"): # Disable .env loadingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_incident_replay_runner.py:269 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(tmp_path / ".env").write_text(Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_incident_replay_runtime.py:91 · Python subprocess execution detectedresult = subprocess.run( # noqa: S603Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_config.py:151 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileswith patch("mcp_pinot.config.load_dotenv"): # Disable .env loadingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_incident_replay_runtime.py:134 · Python subprocess execution detectedresult = subprocess.run( # noqa: S603Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_incident_replay_runner.py:281 · Python subprocess execution detectedresult = subprocess.run( # noqa: S603Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_incident_replay_runtime.py:105 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(tmp_path / ".env").write_text(Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_incident_replay_runner.py:344 · Python subprocess execution detectedresult = subprocess.run( # noqa: S603Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_incident_replay_telemetry.py:224 · Python subprocess execution detectedresult = subprocess.run( # noqa: S603Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST05
MEDIUM
Python subprocess execution detectedtests/test_oauth_persistence.py:53 · Python subprocess execution detectedsubprocess.run( # noqa: S603 - fixed test script, no external inputFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_oauth_persistence.py:62 · Python subprocess execution detectedsubprocess.run( # noqa: S603 - fixed test script, no external inputFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_config.py:138 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileswith patch("mcp_pinot.config.load_dotenv"): # Disable .env loadingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_incident_replay_runner.py:312 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(tmp_path / ".env").write_text("OAUTH_CLIENT_SECRET=checkout-oauth-test-value\n")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_incident_replay_runner.py:319 · Python subprocess execution detectedresult = subprocess.run( # noqa: S603Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_entrypoint.py:32 · Python subprocess execution detectedresult = subprocess.run( # noqa: S603Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈50 tok
1 file · 43 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp-pinot-server@5.0.0 as of 6d ago. This is the package itself, not its dependencies.