Skills/PyPI/mcp-server-tempest

mcp-server-tempest@0.12.0

VERIFIED· not started

Publisher claims: "MCP Server for Retrieving Tempest Weather Data" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher brian-connelly-bdc · publishing for 480 daysInstalls 352Last detonated 5d ago
$claude mcp add mcp-server-tempest -- uvx mcp-server-tempest
WatchReport an issue

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
WEATHERFLOW_API_TOKENConfiguration, not credentials: WEATHERFLOW_DISK_CACHE_TTL
Where it talks to
no vendor host named in the codeAlso tempestwx.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names tempestwx.com as well as its own vendor. The guard injects WEATHERFLOW_API_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx mcp-server-tempest

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-09 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

LOW
Authorization escalation language.agents/skills/agent-friendly-github/references/audit-workflow.md:135 · Authorization escalation language · informational: not an instruction file…licitly and names residual risks (e.g., "bypass-actors probe could not be run — admin access unavailable" or "no live Actions run logs were inspected for secret exposure").…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedskills/estimate-cloudiness/scripts/test_cloudiness.py:36 · Python subprocess execution detectedreturn subprocess.run([sys.executable, str(SCRIPT), *args], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandsrc/mcp_server_tempest/cache.py:61 · File permission modification command — agent changes file ownership/permissionschmod is a harmless best-effort.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_rest.py:368 · MCP server using network transport (SSE/HTTP) — data sent over networkpatch("mcp_server_tempest.rest.aiohttp.ClientSession", return_value=mock_session),Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actiontests/test_manifest.py:36 · File type combined with upload action — agent may exfiltrate local data files"""Committed manifest.json byte-equals the generator output (regenerate andFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Access to sensitive file pathstests/test_cache.py:114 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesresult = disk_cache.get("../../etc/passwd", SampleModel)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file paths.github/workflows/mcpb.yml:59 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'(^|/)(\.env$|\.git/|\.github/|\.venv/|tests/|docs/|scripts/|Makefile$|prek\.toml$|NOTES\.md$|__pycache__/|\.coverage$|\.pytest_cache/|\.ruff_cache/)'; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Authorization escalation language.agents/skills/agent-friendly-github/references/audit-workflow.md:5 · Authorization escalation language · informational: not an instruction file…log excerpt — not in impressions. Where evidence is unavailable (e.g., you lack admin access to view ruleset bypass lists, or a feature is not applicable to the plan tier),…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Access to sensitive file pathstests/test_cache.py:112 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesdisk_cache.set("../../etc/passwd", model)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionscripts/gen_manifest.py:8 · File type combined with upload action — agent may exfiltrate local data filesthe committed ``manifest.json`` matches this generator's output, so regenerateFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File permission modification commandsrc/mcp_server_tempest/cache.py:58 · File permission modification command — agent changes file ownership/permissionsby older versions may be world-readable, so we chmod explicitly. ThisFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandsrc/mcp_server_tempest/cache.py:63 · File permission modification command — agent changes file ownership/permissionsIf the cache dir is itself a symlink we refuse to operate on it: chmodFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Stripe-like API key pattern detectedtests/test_middleware.py:333 · Stripe-like API key pattern detected — possible hardcoded or harvested key"sk_live_4ec39hqlyjwdarjtt1zd",Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
LOW
Authorization escalation language.agents/skills/agent-friendly-github/references/audit-workflow.md:48 · Authorization escalation language · informational: not an instruction file- **`not-checked`** with a reason (e.g., "admin access not available," "no GitHub Actions configured," "private repo — requirement does not apply").Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction files.agents/skills/agent-friendly-github/references/setup-workflow.md:156 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileIn a monorepo, add a nested `AGENTS.md` per subtree with meaningfully different rules.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction files.agents/skills/agent-friendly-github/references/examples.md:379 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file…d` may use a different syntax — check the tool's documentation). In a monorepo, add a nested `AGENTS.md` per subtree that has meaningfully different branching, testing, or off-limits …Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedtests/test_capabilities.py:271 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈19,755 tok
8 files · 80 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp-server-tempest@0.12.0 as of 5d ago. This is the package itself, not its dependencies.