Skills/PyPI/mcpaisuite-workspacemcp

mcpaisuite-workspacemcp@1.1.0

VERIFIED· not started

Publisher claims: "Secure, auditable workspace management for AI agents with MCP support" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher gashel01 · publishing for 151 daysInstalls 30Last detonated 4d ago
$claude mcp add mcpaisuite-workspacemcp -- uvx mcpaisuite-workspacemcp
WatchReport an issue

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
WORKSPACEMCP_API_KEYSConfiguration, not credentials: WORKSPACEMCP_API_HOST, WORKSPACEMCP_API_PORT, WORKSPACEMCP_AUDIT, WORKSPACEMCP_CHECKPOINT_STORE, WORKSPACEMCP_CORS_ORIGINS, WORKSPACEMCP_FILE_STORE, WORKSPACEMCP_NAMESPACE, WORKSPACEMCP_READONLY, WORKSPACEMCP_ROOT, WORKSPACEMCP_SQLITE_PATH, WORKSPACEMCP_TENANT_ISOLATION
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard. It asks for WORKSPACEMCP_API_KEYS and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --net declared -- uvx mcpaisuite-workspacemcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-10 and scored it 81/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

MEDIUM
Access to sensitive file pathstests/unit/test_workspace_deep.py:117 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filessandbox.resolve("." + "/.." * 20 + "/etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_workspace_deep.py:68 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filessandbox.resolve("a/b/c/../../../../../../../../etc/shadow")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
GitHub token pattern detectedtests/unit/test_dlp.py:19 · GitHub token pattern detected — possible hardcoded or harvested tokenassert not await dlp.is_safe("token = ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890")Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Access to sensitive file pathstests/unit/test_pipeline.py:39 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesawait pipeline.write_file(".env", "SECRET=bad")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsworkspacemcp/analysis/tree.py:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env": "Environment variables", ".env.example": "Environment template",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_sandbox.py:27 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesoutside = "C:\\Windows\\System32\\cmd.exe" if platform.system() == "Windows" else "/etc/passwd"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_workspace_deep.py:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesrestricted_paths=[".env", "*.key", "*.pem", "secrets/"],Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_pipeline.py:15 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesawait pipeline.read_file(".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_sandbox.py:45 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert sandbox.check_restricted(".env") is TrueFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_sandbox.py:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filessandbox.resolve("src/../../etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
AWS access key pattern detectedtests/unit/test_dlp.py:46 · AWS access key pattern detected — possible hardcoded or harvested keycontent = "key=AKIAIOSFODNN7EXAMPLE\npwd=hunter2"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Access to sensitive file pathstests/unit/test_sandbox.py:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filessandbox.resolve("../../etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_sandbox.py:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconfig = WorkspaceConfig(root_path=str(tmp_path), restricted_paths=[".env", "*.key"], allowed_write_patterns=["*.py", "output/*"], approval_required_patterns=["production.*"])Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_workspace_deep.py:64 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filessandbox.resolve("../../../etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsworkspacemcp/core/models.py:45 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesrestricted_paths: list[str] = Field(default_factory=lambda: [".env", "*.key", "*.pem", "secrets/"])Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
AWS access key pattern detectedtests/unit/test_dlp.py:13 · AWS access key pattern detected — possible hardcoded or harvested keycontent = "aws_key = AKIAIOSFODNN7EXAMPLE"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Access to sensitive file pathstests/conftest.py:14 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(tmp_path / ".env").write_text("API_KEY=sk-secret-key-12345\nPASSWORD=hunter2\n")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/unit/test_workspace_deep.py:94 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesresolved = sandbox.resolve("/etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsworkspacemcp/core/models.py:54 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"production.*", ".env*", "*.key", "Dockerfile", "docker-compose.*",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedworkspacemcp/filesystem/local_store.py:209 · Python subprocess execution detectedproc = subprocess.run(cmd, capture_output=True, text=True, encoding="utf-8", errors="replace")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actiontests/unit/test_workspace_deep.py:34 · File type combined with upload action — agent may exfiltrate local data filesallowed_write_patterns=["*.py", "*.md", "*.txt", "*.yaml", "output/*"],Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈59 tok
1 file · 50 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcpaisuite-workspacemcp@1.1.0 as of 4d ago. This is the package itself, not its dependencies.