Skills/PyPI/mcphub-server

mcphub-server@3.13.1

BLOCKED· not started

Publisher claims: "AI-native management hub for WordPress, WooCommerce, and self-hosted services via Model Context Protocol (MCP)" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher airano-ir · publishing for 270 daysInstalls 73Last detonated 4d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Blocked here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Revoked: guards refuse to launch this version

confirmed incident: README sends the reader to a committed installer (installer lure) Every machine running vet-skills guard stops starting it at the next launch; the state clears when the honeypot re-run or a reviewer clears it.

Before you give it your token

It will ask for
API_AUTH_ENABLEDAPI_KEYS_STORAGECOMPANION_AUDIT_SECRETS_PATHDASHBOARD_SESSION_SECRETGITHUB_CLIENT_SECRETGOOGLE_CLIENT_SECRETMASTER_API_KEYOAUTH_AUTH_MODEOAUTH_BASE_URLOAUTH_JWT_SECRET_KEYOAUTH_STORAGE_PATHOAUTH_STORAGE_TYPEOAUTH_TRUSTED_DOMAINSConfiguration, not credentials: ADMIN_EMAILS, CAPABILITY_PROBE_TTL, COMPANION_AUDIT_MAX_BODY, COMPANION_AUDIT_REPLAY_WINDOW, DASHBOARD_LOGIN_RATE_LIMIT, DASHBOARD_SECURE_COOKIE, DASHBOARD_SESSION_EXPIRY_HOURS, DATABASE_PATH, DCR_ALLOWED_REDIRECT_PATTERNS, DCR_RATE_LIMIT_PER_HOUR, DCR_RATE_LIMIT_PER_MINUTE, DISABLE_MASTER_KEY_LOGIN, ENABLED_PLUGINS, ENCRYPTION_KEY, GITHUB_CLIENT_ID, GOOGLE_CLIENT_ID, MAX_SITES_PER_USER, MCP_SERVER_MODE, MCPHUB_UPLOAD_MAX_BYTES, MCPHUB_UPLOAD_MAX_CONCURRENT, MCPHUB_UPLOAD_SPILL_DIR, MCPHUB_UPLOAD_TTL_SEC, MULTI_ENDPOINT, PUBLIC_URL, RATE_LIMIT_PER_DAY, RATE_LIMIT_PER_MINUTE, SESSION_EXPIRY_HOURS
Where it talks to
no vendor host named in the codeAlso openpanel.dev, google.com, claude.ai — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Do not connect it. The honeypot or a critical finding blocked this version; the evidence is below.

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-11 and scored it 10/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Hidden zero-width characters detected; Hidden zero-width characters detected; Prompting user to enter sensitive credentials. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

HIGH
Hidden zero-width characters detectedcore/i18n.py:55 · Hidden zero-width characters detected — may conceal content"wants_access": "{client_name} می‌خواهد به MCP Hub شما دسترسی داشته باشد",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Hidden zero-width characters detectedcore/dashboard/routes.py:940 · Hidden zero-width characters detected — may conceal content"oauth_clients": "کلاینت‌های OAuth",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
CRITICAL
Prompting user to enter sensitive credentialscore/i18n.py:24 · Prompting user to enter sensitive credentials — social engineering"enter_api_key": "Enter your API Key to authorize",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathscore/auth.py:34 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"(set MASTER_API_KEY in .env for production use)"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Hidden zero-width characters detectedcore/i18n.py:61 · Hidden zero-width characters detected — may conceal content"requested_permissions": "دسترسی‌های درخواستی:",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Hidden zero-width characters detectedcore/dashboard/routes.py:938 · Hidden zero-width characters detected — may conceal content"projects": "پروژه‌ها",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Access to sensitive file pathscore/dashboard/auth.py:64 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"Set DASHBOARD_SESSION_SECRET in your .env for persistent sessions."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Hidden zero-width characters detectedcore/dashboard/routes.py:953 · Hidden zero-width characters detected — may conceal content"rate_limit_error": "تلاش‌های زیاد برای ورود. لطفاً بعداً تلاش کنید.",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Hidden zero-width characters detectedcore/dashboard/routes.py:943 · Hidden zero-width characters detected — may conceal content"services": "سرویس‌ها",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
CRITICAL
README links to a committed installerREADME.md → wordpress-plugin/airano-mcp-bridge.zipwordpress-plugin/airano-mcp-bridge.zipFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Hidden zero-width characters detectedcore/dashboard/routes.py:941 · Hidden zero-width characters detected — may conceal content"audit_logs": "لاگ‌های ممیزی",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Hidden zero-width characters detectedcore/tool_access.py:106 · Hidden zero-width characters detected — may conceal content"hint_fa": "تنظیمات + نصب و فعال‌سازی پلاگین/قالب از wp.org.",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
Hidden zero-width characters detectedtests/test_dashboard.py:137 · Hidden zero-width characters detected — may conceal contentassert trans["projects"] == "پروژه‌ها"Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
Unicode escape sequence detectedtests/test_encryption.py:79 · Unicode escape sequence detected — may contain obfuscated payloads"password": "\u0631\u0645\u0632\u0639\u0628\u0648\u0631-\u0627\u06cc\u0645\u0646",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hidden zero-width characters detectedcore/tool_access.py:277 · Hidden zero-width characters detected — may conceal content"hint_fa": "مشاهده محصولات، سفارش‌ها و مشتریان",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
LOW
Authorization escalation languageREADME.md:150 · Authorization escalation language · informational: not an instruction file| `MASTER_API_KEY` | Recommended | Auto-generated | Master API key for admin access |Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
MCP server using network transport (SSE/HTTP)core/dashboard/routes.py:4121 · MCP server using network transport (SSE/HTTP) — data sent over network"server_mode": os.environ.get("MCP_SERVER_MODE", "streamable-http"),Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Hidden zero-width characters detectedcore/settings.py:38 · Hidden zero-width characters detected — may conceal content"label_fa": "پلاگین‌های فعال",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Hidden zero-width characters detectedcore/tool_access.py:104 · Hidden zero-width characters detected — may conceal content"label_fa": "نصب‌کننده",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Hidden zero-width characters detectedcore/i18n.py:72 · Hidden zero-width characters detected — may conceal content"security_message": "فقط برنامه‌هایی را که به آن‌ها اعتماد دارید تایید کنید. توکن OAuth دسترسی‌های API Key شما را به ارث خواهد برد.",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
File type combined with upload actioncore/upload_sessions.py:372 · File type combined with upload action — agent may exfiltrate local data filesreturn await self.db.fetchone("SELECT * FROM upload_sessions WHERE id = ?", (session_id,))Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actioncore/upload_sessions.py:375 · File type combined with upload action — agent may exfiltrate local data filesawait self.db.execute("DELETE FROM upload_sessions WHERE id = ?", (session_id,))Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Hidden zero-width characters detectedcore/tool_access.py:88 · Hidden zero-width characters detected — may conceal content"hint_fa": "مشاهده و عیب‌یابی — بدون تغییر.",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Hidden zero-width characters detectedcore/tool_access.py:222 · Hidden zero-width characters detected — may conceal content"hint_fa": "مشاهده + راه‌اندازی/توقف/ریستارت",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Hidden zero-width characters detectedcore/settings.py:46 · Hidden zero-width characters detected — may conceal content"hint_fa": "حداکثر تعداد سایت‌هایی که هر کاربر می‌تواند بسازد",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07

Cost to the agent

Instructions loaded
≈65 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcphub-server@3.13.1 as of 4d ago. This is the package itself, not its dependencies.

What would make this Verified

70 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%

An override rule (installer_lure) caps this verdict regardless of the score. The first item below has to go before anything else counts.

  1. Prompting user to enter sensitive credentials≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. README links to a committed installer≈ +9 on the totalPin versions and sources; vendor anything fetched at install time.
  3. Unclaimed publisher≈ +8 on the totalClaim airano-ir: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
  5. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Unicode escape sequence detected≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim airano-irPropose a patch to the maintainer