mcp104@0.3.1
VERIFIED· not startedPublisher claims: "MCP server that lets an AI agent operate a 104人力銀行 enterprise recruiting account — résumé search, job listings, messaging and 詢問意願 events, with a device-flow login that keeps credentials out of the LLM" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry PyPI (MCP server)Publisher jasoncychueh · publishing for 71 daysInstalls 238Last detonated 4d ago
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
MCP104_AUTH_BASE_URLConfiguration, not credentials: MCP104_DATA_DIR- Where it talks to
- no vendor host named in the codeAlso 104.com.tw — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names 104.com.tw as well as its own vendor. The guard injects MCP104_AUTH_BASE_URL only into requests to the host you bind (and its subdomains) and refuses the rest.
$vet-skills run --net declared -- uvx mcp104
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-10 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run
Static findings
MEDIUM
Process kill commandsrc/mcp104/main.py:180 · Process kill command — agent can terminate processes
AST05# 路徑會 kill 子行程）；下一次 login() 會重新開始，patchright 自己會處理Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedtests/test_filters.py:652 · Python subprocess execution detected
AST05filters_result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/mcp104/tools/auth.py:357 · Python subprocess execution detected
AST05subprocess.Popen(["xdg-open", url], stdin=devnull, stdout=devnull, stderr=devnull)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_filters.py:443 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_main.py:119 · Python subprocess execution detected
AST05proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_main.py:161 · Python subprocess execution detected
AST05proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_main.py:90 · Python subprocess execution detected
AST05proc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Hex-encoded string detectedtests/test_helpers.py:552 · Hex-encoded string detected — may contain obfuscated payloads
AST07_SYNTH_JPEG = b"\xff\xd8\xff\xe0\x00\x10JFIF" + b"\x00" * 32Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Hex-encoded string detectedtests/test_api_client.py:1052 · Hex-encoded string detected — may contain obfuscated payloads
AST07_SYNTH_JPEG = b"\xff\xd8\xff\xe0\x00\x10JFIF" + b"\x00" * 32Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedtests/test_main.py:200 · Python subprocess execution detected
AST05proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_filters.py:656 · Python subprocess execution detected
AST05drop_detection_result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/mcp104/tools/auth.py:355 · Python subprocess execution detected
AST05subprocess.Popen(["open", url], stdin=devnull, stdout=devnull, stderr=devnull)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Unicode escape sequence detectedtests/test_stealth.py:128 · Unicode escape sequence detected — may contain obfuscated payloads
AST07… \u2551\n" "\u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\n" ) class _FakeChromium: as…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedtests/test_packaging.py:101 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_stealth.py:20 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_packaging.py:191 · Python subprocess execution detected
AST05proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packagetests/test_stealth.py:155 · npx invocation of non-well-known package — may execute untrusted code
AST06"npx ", "uvx ", "python -m patchright",Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Python subprocess execution detectedtests/test_main.py:220 · Python subprocess execution detected
AST05proc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Unicode escape sequence detectedtests/test_stealth.py:122 · Unicode escape sequence detected — may contain obfuscated payloads
AST07"\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\n"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Python subprocess execution detectedtests/test_packaging.py:174 · Python subprocess execution detected
AST05subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Hex-encoded string detectedtests/test_resume_files.py:38 · Hex-encoded string detected — may contain obfuscated payloads
AST07_SYNTH_JPEG = b"\xff\xd8\xff\xe0\x00\x10JFIF" + b"\x00" * 32Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Access to sensitive file pathstests/test_resume_files.py:419 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05@pytest.mark.parametrize("bad_id", ["", "abc", "12345678901a", "../../etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actiontests/test_messaging.py:20 · File type combined with upload action — agent may exfiltrate local data files
AST07(`research/results/send_validation.json`, `research/probes/probe_send_validation.py`'sFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.Cost to the agent
Instructions loaded
≈84 tok
1 file · 71 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for mcp104@0.3.1 as of 4d ago. This is the package itself, not its dependencies.