Is mcp-resk@0.1.4 safe to install?

mcp-resk@0.1.4

VERIFIED· install only

Publisher claims: "RESK-MCP is an open-source Python library designed to add a robust security and management layer over the official MCP Library. More at https://resk.fr" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher resk-security · publishing for 541 daysInstalls 503Last detonated 6d ago

$claude mcp add mcp-resk -- uvx mcp-resk

Watch Report an issue

Coverage

Install scripts ran; no agent task scenario for this bundle.

Tested: install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested: use of the skill by an agent

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: DASHBOARD_AUTH_ENABLEDDASHBOARD_PASSWORDJWT_SECRETMAX_TOKEN_PER_REQUEST or --jwt-secretConfiguration, not credentials: DASHBOARD_USERNAME, JWT_ALGORITHM, JWT_EXPIRATION_MINUTES, RATE_LIMIT, RESK_MCP_CONFIG_FILE, RESK_MCP_DOCS, SERVER_HOST, SERVER_PORT, SSL_CERTFILE, SSL_KEYFILE
Where it talks to: resk.fr (its own)
What the honeypot saw: no credential files read · no network
What we could not test: use of the skill by an agent

Connect it with a scoped credential, under the guard. It asks for DASHBOARD_AUTH_ENABLED, DASHBOARD_PASSWORD, JWT_SECRET, MAX_TOKEN_PER_REQUEST and talks to resk.fr. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --secrets DASHBOARD_AUTH_ENABLED=resk.fr,DASHBOARD_PASSWORD=resk.fr,JWT_SECRET=resk.fr,MAX_TOKEN_PER_REQUEST=resk.fr -- uvx mcp-resk

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-08 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.1sprocessexited 1: ModuleNotFoundError: No module named 'setuptools'

0.1sprocessscript backend runs setup only

0.1sprocesssecond launch, clock +45 days, CI unset

0.2sprocessexited 1: ModuleNotFoundError: No module named 'setuptools'

Static findings

HIGH

Access to sensitive file pathsresk_mcp/server.py:641 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Create a .env file in your project root with:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsresk_mcp/config.py:7 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Load .env file first to make environment variables available for overridesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

MCP server using network transport (SSE/HTTP)tests/test_server_tools.py:51 · MCP server using network transport (SSE/HTTP) — data sent over networkserver = SecureMCPServer(name="TestToolsServer")Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

HIGH

Access to sensitive file pathsresk_mcp/server.py:665 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# JWT_SECRET, SSL_KEYFILE, SSL_CERTFILE now come from settings object which loads .env/config.yamlFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

Cost to the agent

Instructions loaded

≈72 tok

1 file · 34 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for mcp-resk@0.1.4 as of 6d ago. This is the package itself, not its dependencies.