Skills/PyPI/mcp-zentao

mcp-zentao@1.0.0

CAUTION· not started

Publisher claims: "禅道系统 MCP 服务器 - 基于 Semantic Kernel 的 Model Context Protocol 服务器" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher wrcopilot-org · publishing for 376 daysInstalls 21Last detonated 4d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
ZENTAO_PASSWORDConfiguration, not credentials: ZENTAO_ACCOUNT, ZENTAO_HOST
Where it talks to
your-zentao-server.com (its own)
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard. It asks for ZENTAO_PASSWORD and talks to your-zentao-server.com. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --secrets ZENTAO_PASSWORD=your-zentao-server.com -- uvx mcp-zentao

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-10 and scored it 78/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Hidden zero-width characters detected; Hidden zero-width characters detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessexited 1: ModuleNotFoundError: No module named 'setuptools'
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocesssecond launch, clock +45 days, CI unset
0.2sprocessexited 1: ModuleNotFoundError: No module named 'setuptools'

Static findings

HIGH
Access to sensitive file paths.vscode/launch.json:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"envFile": "${workspaceFolder}/.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
URL to a private-network addresstest/test_api_details_collection.py:22 · URL to a private-network address — a LAN or development targetZENTAO_HOST = httpx.Client(base_url="http://192.168.2.84/zentao/")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Access to sensitive file pathstest/test_sk_mcp_server.py:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# 从环境变量或 .env 文件加载配置Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
URL to a private-network addresstest/test_client_details.py:36 · URL to a private-network address — a LAN or development targetZENTAO_BASE_URL = "http://192.168.2.84/zentao/"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstest/test_sk_mcp_server.py:27 · URL to a private-network address — a LAN or development target'base_url': os.getenv('ZENTAO_HOST', 'http://192.168.2.84/zentao'),Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstest/test_zentao_api.py:8 · URL to a private-network address — a LAN or development targetZENTAO_HOST = httpx.Client(base_url="http://192.168.2.84/zentao/")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)test/test_sk_mcp_server.py:444 · MCP server using network transport (SSE/HTTP) — data sent over networkmcp_server.client.logout.assert_called_once()Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
LOW
URL to a private-network address.vscode/mcp.json:18 · URL to a private-network address — a LAN or development target// "ZENTAO_HOST": "http://192.168.2.84/zentao/"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Hidden zero-width characters detectedsrc/mcp_zentao/sk_mcp_server.py:336 · Hidden zero-width characters detected — may conceal contentresult += f"👨‍💻 创建者: {get_user_name(bug.openedBy)}\n"Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
LOW
URL to a private-network addresstest/test_paginated_client.py:18 · URL to a private-network address — a LAN or development targetwith ZenTaoClient("http://192.168.2.84/zentao/") as client:Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
File type combined with upload actionsrc/mcp_zentao/models/session.py:152 · File type combined with upload action — agent may exfiltrate local data files定义向/user-login-{sessionid}.json发送POST请求时的参数结构。Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Hidden zero-width characters detectedsrc/mcp_zentao/sk_mcp_server.py:636 · Hidden zero-width characters detected — may conceal contentresult += f"👨‍💻 创建者: {task.openedBy or '未知'}\n"Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
LOW
URL to a private-network addresstest/test_data_collection.py:18 · URL to a private-network address — a LAN or development targetZENTAO_HOST = httpx.Client(base_url="http://192.168.2.84/zentao/")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Hidden zero-width characters detectedsrc/mcp_zentao/sk_mcp_server.py:256 · Hidden zero-width characters detected — may conceal contentresult += f"👨‍💻 解决: {bug.resolvedBy or ''}\n"Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07

Cost to the agent

Instructions loaded
≈51 tok
1 file · 39 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp-zentao@1.0.0 as of 4d ago. This is the package itself, not its dependencies.

What would make this Verified

2 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim wrcopilot-org: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
  4. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
  5. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  6. URL to a private-network address≈ +1 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim wrcopilot-orgPropose a patch to the maintainer