Is mcp-server-smartsheet-rm@2.2.0 safe to install?

Skills/PyPI/mcp-server-smartsheet-rm

mcp-server-smartsheet-rm@2.2.0

VERIFIED· not started

Publisher claims: "Enterprise Model Context Protocol (MCP) server for Smartsheet Resource Management (10,000ft API) — time tracking, projects, allocations, scheduling, and capacity planning." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher christianclaudio · publishing for 79 daysInstalls 712Last detonated 5d ago

$claude mcp add mcp-server-smartsheet-rm -- uvx mcp-server-smartsheet-rm

Watch Report an issue

Coverage

Not started: dependency install failed; the server itself was not observed.

Tested: the dependency install step · every file read, file written and host contacted by what ran
Not tested: server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: SMARTSHEET_RM_API_TOKENSMARTSHEET_RM_GOV_SMARTSHEET_API_TOKENConfiguration, not credentials: SMARTSHEET_RM_ALLOWED_HOSTS, SMARTSHEET_RM_BASE_URL, SMARTSHEET_RM_JSON_RESPONSE, SMARTSHEET_RM_LOG_FORMAT, SMARTSHEET_RM_PROFILE, SMARTSHEET_RM_STATELESS_HTTP, SMARTSHEET_RM_TOOL_SEARCH_BACKEND
Where it talks to: no vendor host named in the codeAlso smartsheet.com, gofastmcp.com, smartsheetgov.com, encode.io — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names smartsheet.com, gofastmcp.com, smartsheetgov.com, encode.io as well as its own vendor. The guard injects SMARTSHEET_RM_API_TOKEN, SMARTSHEET_RM_GOV_SMARTSHEET_API_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx mcp-server-smartsheet-rm

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-09 and scored it 82/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.1sprocessdependency install exit 1 ·

0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed

0.1sprocessscript backend runs setup only

0.1sprocessno install scripts to re-run

Static findings

MEDIUM

MCP server using network transport (SSE/HTTP)tests/test_server.py:1067 · MCP server using network transport (SSE/HTTP) — data sent over network["mcp-server-smartsheet-rm", "--transport", "streamable-http", "--host", "0.0.0.0"],Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

Python subprocess execution detectedtests/test_release_notes.py:448 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

MCP server using network transport (SSE/HTTP)tests/test_server.py:1075 · MCP server using network transport (SSE/HTTP) — data sent over network["mcp-server-smartsheet-rm", "--transport", "streamable-http", "--allowed-host", "*"],Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

URL to the cloud instance metadata addresstests/test_server.py:284 · URL to the cloud instance metadata address — reads the VM's credentialsawait srv.get_client({"headers": {"x-smartsheet-rm-base-url": "https://169.254.169.254"}})Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

Destructive file system command detectedDockerfile:21 · Destructive file system command detectedrm -rf /var/lib/apt/lists/* && \Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

HTTP URL with a raw public IP addresstests/test_client.py:346 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot name_validate_base_url("https://93.184.216.34")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

URL to the cloud instance metadata addresstests/test_server.py:287 · URL to the cloud instance metadata address — reads the VM's credentialsawait srv.get_client({"headers": {"x-smartsheet-rm-base-url": "https://169.254.169.254"}})Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

Python subprocess execution detectedtests/test_drift.py:505 · Python subprocess execution detectedproc = subprocess.run([sys.executable, "-c", code], capture_output=True, text=True, timeout=120, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscripts/check_tool_contract.py:103 · Python subprocess execution detectedout = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

MCP server using network transport (SSE/HTTP)tests/test_server.py:1057 · MCP server using network transport (SSE/HTTP) — data sent over networkmonkeypatch.setattr("sys.argv", ["mcp-server-smartsheet-rm", "--transport", "sse", "--port", "8001"])Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

URL to the cloud instance metadata addresstests/test_drift.py:459 · URL to the cloud instance metadata address — reads the VM's credentialsassert main(["--spec-url", "https://169.254.169.254/latest/meta-data"]) == 2Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)scripts/check_conformance.sh:32 · MCP server using network transport (SSE/HTTP) — data sent over networkecho "[*] Starting mcp-server-smartsheet-rm server on ${HOST}:${PORT} (streamable-http)..."Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

HTTP URL with a raw public IP addresstests/test_client.py:347 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameassert _validate_base_url("https://93.184.216.34", allowed_hosts_str="93.184.216.34") == "https://93.184.216.34"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)tests/test_server.py:1008 · MCP server using network transport (SSE/HTTP) — data sent over network["mcp-server-smartsheet-rm", "--transport", "streamable-http", "--port", "8000"],Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

URL using a raw public IP addresstests/test_client.py:346 · URL using a raw public IP address — may bypass domain-based filtering_validate_base_url("https://93.184.216.34")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

npx invocation of non-well-known packagescripts/check_conformance.sh:63 · npx invocation of non-well-known package — may execute untrusted codenpx --yes "@modelcontextprotocol/conformance@${CONFORMANCE_VERSION}" server \Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

URL using a raw public IP addresstests/test_client.py:347 · URL using a raw public IP address — may bypass domain-based filteringassert _validate_base_url("https://93.184.216.34", allowed_hosts_str="93.184.216.34") == "https://93.184.216.34"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)AGENTS.md:182 · MCP server using network transport (SSE/HTTP) — data sent over network

…ease commit locally, runs `rm -rf dist && uv build`, and confirms the wheel is `mcp_server_smartsheet_rm-X.Y.Z-py3-none-any.whl` and `scripts/check_version.py` passes; then discards the clone without pushing. - Only the maintainer's go cre…

Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

HIGH

Access to sensitive file pathssrc/smartsheet_rm_mcp/config.py:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file=".env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Python subprocess execution detectedscripts/release_notes.py:217 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL to the cloud instance metadata addresstests/test_client.py:342 · URL to the cloud instance metadata address — reads the VM's credentials_validate_base_url("https://169.254.169.254", allowed_hosts_str="169.254.169.254")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

Process kill commandscripts/check_conformance.sh:18 · Process kill command — agent can terminate processesif [[ -n "${SERVER_PID}" ]] && kill -0 "${SERVER_PID}" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Python subprocess execution detectedtests/test_dockerfile.py:132 · Python subprocess execution detectedresult = subprocess.run( # noqa: S603 - the command is the repo's own Dockerfile RUN lineFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

HTTP URL with a raw public IP addresstests/test_network_guard.py:33 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameawait client.get("https://192.0.2.1/x")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Process kill commandscripts/check_conformance.sh:20 · Process kill command — agent can terminate processeskill -TERM "${SERVER_PID}" 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

URL to the cloud instance metadata addresstests/test_client.py:481 · URL to the cloud instance metadata address — reads the VM's credentialsvalidate_outbound_url("https://169.254.169.254/latest/meta-data")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

LOW

URL to a private-network addresstests/test_server.py:282 · URL to a private-network address — a LAN or development targetawait srv.get_client({"headers": {"x-smartsheet-rm-base-url": "https://192.168.1.1"}})Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

URL with embedded credentialstests/test_client.py:323 · URL with embedded credentials — may be phishing or credential leaking_validate_base_url("https://user:[email protected]/api/v1")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

Python subprocess execution detectedtests/test_http_auth.py:412 · Python subprocess execution detectedout = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Hex-encoded URLtests/test_client.py:438 · Hex-encoded URL — attempt to bypass URL filteringassert _validate_base_url("https://0x5d581622/api", allowed_hosts_str="0x5d581622") == "https://0x5d581622/api"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.

AST07

MEDIUM

Python subprocess execution detectedtests/test_release_notes.py:31 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL using a raw public IP addresstests/test_network_guard.py:33 · URL using a raw public IP address — may bypass domain-based filteringawait client.get("https://192.0.2.1/x")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Destructive file system command detectedDockerfile:71 · Destructive file system command detectedrm -rf /var/lib/apt/lists/* && \Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

LOW

URL to a private-network addresstests/test_server.py:278 · URL to a private-network address — a LAN or development targetawait srv.get_client({"headers": {"x-smartsheet-rm-base-url": "https://10.0.0.1"}})Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

Cost to the agent

Instructions loaded

≈9,128 tok

2 files · 76 in bundle

Tool list per prompt

≈0 tok

0 tools · 0 per tool

Handshake

no reply

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp-server-smartsheet-rm@2.2.0 as of 5d ago. This is the package itself, not its dependencies.