Skills/PyPI/mcpguard-proxy

mcpguard-proxy@0.4.1

CAUTION· not started

Publisher claims: "Runtime security proxy for MCP (Model Context Protocol) and A2A (Agent-to-Agent)" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher carlos-projects · publishing for 175 daysInstalls 24Last detonated 4d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
MCPGUARD_API_KEY
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard. It asks for MCPGUARD_API_KEY and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --net declared -- uvx mcpguard-proxy

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-11 and scored it 76/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Auto-update or dynamic fetch configuration; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessexited 1: ModuleNotFoundError: No module named 'setuptools'
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocesssecond launch, clock +45 days, CI unset
0.2sprocessexited 1: ModuleNotFoundError: No module named 'setuptools'

Static findings

HIGH
Access to sensitive file pathsmcpguard/detectors/resource_prompt.py:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"/etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Unicode escape sequence detectedmcpguard/detectors/stego_detector.py:27 · Unicode escape sequence detected — may contain obfuscated payloads"[\u0300-\u036f\u0483-\u0489\u0591-\u05bd\u05bf\u05c1\u05c2\u05c4\u05c5\u05c7"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedmcpguard/detectors/stego_detector.py:19 · Unicode escape sequence detected — may contain obfuscated payloads"[\u202a\u202b\u202c\u202d\u202e\u2066\u2067\u2068\u2069]"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Auto-update or dynamic fetch configurationmcpguard/cli.py:39 · Auto-update or dynamic fetch configuration — agent may load new code at runtimehot_reload: bool = typer.Option(False, "--hot-reload", help="Watch config file for changes"),Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedtests/test_integration_http.py:40 · Python subprocess execution detectedproc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsmcpguard/detectors/resource_prompt.py:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"/.env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcpguard/detectors/resource_prompt.py:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"/etc/shadow",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Unicode escape sequence detectedmcpguard/detectors/stego_detector.py:31 · Unicode escape sequence detected — may contain obfuscated payloads"\u093a\u093c\u0941-\u0948\u094d\u0951-\u0957\u0962\u0963\u0981\u09bc\u09be"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedtests/test_integration_http.py:52 · Python subprocess execution detectedproc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_detectors.py:162 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"params": {"uri": "file:///etc/passwd"},Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Unicode escape sequence detectedmcpguard/detectors/stego_detector.py:32 · Unicode escape sequence detected — may contain obfuscated payloads"\u09c1-\u09c4\u09cd\u09d7\u09e2\u09e3\u0a01\u0a02\u0a3c\u0a41\u0a42\u0a47"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedtests/test_integration_stdio.py:39 · Python subprocess execution detectedproc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Unicode escape sequence detectedmcpguard/detectors/stego_detector.py:11 · Unicode escape sequence detected — may contain obfuscated payloads"[\u200b\u200c\u200d\u2060\ufeff\u180e\u2061\u2062\u2063\u2064]"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Auto-update or dynamic fetch configurationmcpguard/proxy/server.py:595 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeif config.hot_reload and config.config_path:Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈57 tok
1 file · 66 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcpguard-proxy@0.4.1 as of 4d ago. This is the package itself, not its dependencies.

What would make this Verified

4 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim carlos-projects: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  4. Unicode escape sequence detected≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim carlos-projectsPropose a patch to the maintainer