Skills/PyPI/mcpkernel

mcpkernel@0.3.0

CAUTION· not started

Publisher claims: "Open-source MCP/A2A security gateway — policy enforcement, taint tracking, sandboxed execution, deterministic envelopes, and Sigstore audit for every AI agent tool call. OWASP ASI 2026 compliant." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher piyushptiwari1 · publishing for 236 daysInstalls 26Last detonated 4d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
MCPKERNEL_HEALTH_TOKENMCPKERNEL_SECRETS_BACKENDSIGSTORE_ID_TOKENVAULT_TOKENConfiguration, not credentials: AWS_DEFAULT_REGION, AWS_REGION, GOOGLE_CLOUD_PROJECT, MCPKERNEL_DEE__REQUIRE_SIGN, MCPKERNEL_VAULT_MOUNT, VAULT_ADDR, VAULT_NAMESPACE
Where it talks to
mcpkernel.dev (its own)Also langfuse.com, in-toto.io, oasis-open.org, opentelemetry.io, owasp.org, invariantlabs.ai — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names langfuse.com, in-toto.io, oasis-open.org, opentelemetry.io, owasp.org, invariantlabs.ai as well as its own vendor. The guard injects MCPKERNEL_HEALTH_TOKEN, MCPKERNEL_SECRETS_BACKEND, SIGSTORE_ID_TOKEN, VAULT_TOKEN only into requests to mcpkernel.dev (and its subdomains) and refuses the rest.

$vet-skills run --secrets MCPKERNEL_HEALTH_TOKEN=mcpkernel.dev,MCPKERNEL_SECRETS_BACKEND=mcpkernel.dev,SIGSTORE_ID_TOKEN=mcpkernel.dev,VAULT_TOKEN=mcpkernel.dev -- uvx mcpkernel

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-11 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; OS command execution function call detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

MEDIUM
File permission modification commandsrc/mcpkernel/integrations/doctor.py:229 · File permission modification command — agent changes file ownership/permissions"detail": f"{p} is accessible by other users (mode {oct(mode)}). Run: chmod 600 {p}",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathssrc/mcpkernel/cli.py:659 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"# MCPKernel local config — see .env.example for the full inventory.\n"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Unicode escape sequence detectedsrc/mcpkernel/integrations/poisoning.py:139 · Unicode escape sequence detected — may contain obfuscated payloadsr"[\u200b\u200c\u200d\u200e\u200f\ufeff]",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathssrc/mcpkernel/taint/dlp.py:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesread_file(.env) → http_post(external_url) -- SECRET exfiltrationFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
OS command execution function call detectedsrc/mcpkernel/taint/static_analysis.py:55 · OS command execution function call detected"os.popen": ("STATIC-012", Severity.CRITICAL, "os.popen() allows shell command execution"),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/mcpkernel/taint/flow_analyzer.py:91 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(re.compile(r"\b(env|environment|dotenv|\.env)\b", re.I), FlowCategory.SENSITIVE_DATA, 1.0),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
OS command execution function call detectedsrc/mcpkernel/taint/static_analysis.py:54 · OS command execution function call detected"os.system": ("STATIC-011", Severity.CRITICAL, "os.system() allows shell command execution"),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/mcpkernel/integrations/skill_scanner.py:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(r"cat\s+.*(?:\.env|\.ssh|\.aws|\.gnupg|credentials|token|secret|password)", "Sensitive file access", "high"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcpkernel/security.py:525 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesarguments={"path": "/etc/passwd"},Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcpkernel/cli.py:656 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = directory / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/mcpkernel/config.py:257 · npx invocation of non-well-known package — may execute untrusted codedescription="Command for stdio transport (e.g. 'npx @mcp/server-filesystem')",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationsrc/mcpkernel/policy/watcher.py:1 · Auto-update or dynamic fetch configuration — agent may load new code at runtime"""Policy hot-reload watcher — monitors policy YAML files and reloads on changes."""Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationsrc/mcpkernel/config.py:142 · Auto-update or dynamic fetch configuration — agent may load new code at runtimehot_reload: bool = TrueFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathssrc/mcpkernel/cli.py:1198 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesUse this for any shared-secret value MCPKernel asks for in .env —Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Remote installer piped to shellsrc/mcpkernel/integrations/skill_scanner.py:6 · Remote installer piped to shell- Dangerous shell commands (rm -rf, curl|bash, etc.)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Access to sensitive file pathssrc/mcpkernel/cli.py:655 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Drop a starter .env so the env-var configuration path is discoverable.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcpkernel/sandbox/wasm_backend.py:145 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈84 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcpkernel@0.3.0 as of 4d ago. This is the package itself, not its dependencies.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. OS command execution function call detected≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  2. Unclaimed publisher≈ +8 on the totalClaim piyushptiwari1: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  5. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  6. Unicode escape sequence detected≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim piyushptiwari1Propose a patch to the maintainer