mcpscore@1.32.0
CAUTION· not startedPublisher claims: "Audit an MCP server and get a scored, actionable quality report in seconds." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry PyPI (MCP server)Publisher mcp-box · publishing for 160 daysInstalls 5,928Last detonated 3d ago
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
MCPSCORE_TOKENor--oauthConfiguration, not credentials: SSL_CERT_DIR, SSL_CERT_FILE- Where it talks to
- mcpscore.dev, mcpscore.invalid (its own)Also jsonrpc.org, deepwiki.com, your-server.example, server.com, schemastore.org — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names jsonrpc.org, deepwiki.com, your-server.example, server.com, schemastore.org as well as its own vendor. The guard injects MCPSCORE_TOKEN only into requests to mcpscore.dev (and its subdomains) and refuses the rest.
$vet-skills run --secrets MCPSCORE_TOKEN=mcpscore.dev -- uvx mcpscore
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-11 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: URL with embedded credentials; Hex-encoded URL; URL with embedded credentials. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run
Static findings
MEDIUM
URL with embedded credentialstests/test_probe_guidance.py:522 · URL with embedded credentials — may be phishing or credential leaking
AST07auditor.audit_data.protocol_version = "HTTPS://user:[email protected]/?token=Token123"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstests/test_packages.py:107 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"npm:../../etc/passwd", # path traversalFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
URL to the cloud instance metadata addresstests/test_auth_rules.py:297 · URL to the cloud instance metadata address — reads the VM's credentials
AST07internal = "http://169.254.169.254/latest"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
URL with embedded credentialstests/test_redirects.py:147 · URL with embedded credentials — may be phishing or credential leaking
AST07_redirect(303, "/mcp/?token=s3cret#frag", url="https://user:[email protected]/mcp")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagemcpscore/packages.py:5 · npx invocation of non-well-known package — may execute untrusted code
AST06auditable from the CLI (``mcpscore --stdio npx -y <pkg>``) but not from a publicFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
URL to the cloud instance metadata addresstests/test_probes.py:2944 · URL to the cloud instance metadata address — reads the VM's credentials
AST07assert await _discovery_url_refusal("http://169.254.169.254/prm", "https://gone.example/mcp") == "private"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
URL with embedded credentialsmcpscore/smoke_network.py:128 · URL with embedded credentials — may be phishing or credential leaking
AST07("backslash_confusion", "http://127.0.0.1:{denied}\\@127.0.0.1:{allowed}/v/backslash_confusion"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
URL with embedded credentialstests/test_redirects.py:134 · URL with embedded credentials — may be phishing or credential leaking
AST07with_credentials = unfollowed_redirect(_redirect(303, "https://u:[email protected]/mcp/"))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Hex-encoded URLmcpscore/smoke_network.py:121 · Hex-encoded URL — attempt to bypass URL filtering
AST07("hex_ipv4", "http://0x7f000001:{denied}/v/hex_ipv4"),Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
URL to the cloud instance metadata addresstests/test_probes.py:2951 · URL to the cloud instance metadata address — reads the VM's credentials
AST07assert await _discovery_url_refusal("http://169.254.169.254/prm", "https://server.example/mcp") == "private"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
URL to the cloud instance metadata addresstests/test_probes.py:2623 · URL to the cloud instance metadata address — reads the VM's credentials
AST07internal = "http://169.254.169.254/latest/meta-data"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
URL with embedded credentialstests/test_redirects.py:139 · URL with embedded credentials — may be phishing or credential leaking
AST07assert unfollowed_redirect(_redirect(307, "https://user:[email protected]/mcp")) == RefusedRedirect(Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
URL with embedded credentialstests/test_probe_guidance.py:234 · URL with embedded credentials — may be phishing or credential leaking
AST07"nested": {"url": "HTTPS://user:[email protected]/mcp?scope=read&token=Token123#section"},Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
URL with embedded credentialsmcpscore/smoke_network.py:126 · URL with embedded credentials — may be phishing or credential leaking
AST07("userinfo_confusion", "http://127.0.0.1:{allowed}@127.0.0.1:{denied}/v/userinfo_confusion"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
URL with embedded credentialsmcpscore/smoke_network.py:129 · URL with embedded credentials — may be phishing or credential leaking
AST07("fragment_confusion", "http://127.0.0.1:{denied}/v/fragment_confusion#@127.0.0.1:{allowed}"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
URL with embedded credentialstests/test_probe_guidance.py:571 · URL with embedded credentials — may be phishing or credential leaking
AST07data.probes[rule.probe_id].details[key] = ["HTTPS://user:Secret123@host/path?token=Token123", "工具🔎" * 50]Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
URL to the cloud instance metadata addresstests/test_probes.py:2869 · URL to the cloud instance metadata address — reads the VM's credentials
AST07refusal = await _discovery_url_refusal("http://169.254.169.254/latest/meta-data", "https://server.example/mcp")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
URL with embedded credentialstests/test_probe_guidance.py:209 · URL with embedded credentials — may be phishing or credential leaking
AST07("https://alice:can'[email protected]/a/SKILL.md", "https://skills.example/a/SKILL.md"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.CRITICAL
Pipe-to-shell patternmcpscore/packages.py:97 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06``curl … | sh``. See the design doc for why the CLI's arbitrary-commandFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
URL with embedded credentialstests/test_redirects.py:156 · URL with embedded credentials — may be phishing or credential leaking
AST07endpoint = "https://user:[email protected]/mcp"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File permission modification commandmcpscore/mcp_client.py:165 · File permission modification command — agent changes file ownership/permissions
AST05f"Permission denied launching '{command}'. Make it executable (chmod +x) "Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
URL with embedded credentialstests/test_redirects.py:159 · URL with embedded credentials — may be phishing or credential leaking
AST07assert policy_refusal(_redirect(308, "https://user:[email protected]/mcp/", url=endpoint)) is NoneFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Remote installer piped to shellmcpscore/packages.py:97 · Remote installer piped to shell
AST07``curl … | sh``. See the design doc for why the CLI's arbitrary-commandFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
URL with embedded credentialstests/test_probe_guidance.py:210 · URL with embedded credentials — may be phishing or credential leaking
AST07("see 'https://u:[email protected]/x' here", "see 'https://host.example/x' here"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
URL with embedded credentialstests/test_skills.py:1029 · URL with embedded credentials — may be phishing or credential leaking
AST07odd["frontmatter"]["allowed-tools"] = f"Fetch(https://user:{secret}@api.example/)"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Dense URL-encoded contenttests/test_skills_rules.py:691 · Dense URL-encoded content — may be obfuscating payloads
AST07body = "[a](<assets/b c.png>) [b](assets/b%20c.png) [c](数据/表.md) [d](%E6%95%B0%E6%8D%AE/%E8%A1%A8.md)\n"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
URL with embedded credentialstests/test_sarif.py:225 · URL with embedded credentials — may be phishing or credential leaking
AST07("https://user:[email protected]/mcp?sig=abc", "mcp.example.com/mcp"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagetests/test_sarif.py:443 · npx invocation of non-well-known package — may execute untrusted code
AST06assert key("npx -y @a/server") == key("npx -y @b/server")Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
URL with embedded credentialstests/test_skills.py:1030 · URL with embedded credentials — may be phishing or credential leaking
AST07odd["resources"].append({"uri": f"https://user:{secret}@skills.example/a/scripts/run.py", "size": 1})Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Stripe-like API key pattern detectedtests/test_security_rules.py:249 · Stripe-like API key pattern detected — possible hardcoded or harvested key
AST03result = rule.check(_leak_audit("upstream error: api_key=sk-live-1a2B3c4D5e6F7g8H"))Fix: Never read or enumerate credential locations; accept a documented environment variable instead.MEDIUM
URL with embedded credentialstests/test_skills.py:1028 · URL with embedded credentials — may be phishing or credential leaking
AST07odd["uri"] = f"https://user:{secret}@skills.example/a/SKILL.md"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
URL with embedded credentialstests/test_skills_rules.py:1483 · URL with embedded credentials — may be phishing or credential leaking
AST07unknown = f"https://user:{password}@skills.example/acme/mcpscore-no-such-skill/SKILL.md"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Dense URL-encoded contenttests/test_skills_rules.py:1083 · Dense URL-encoded content — may be obfuscating payloads
AST07("references/指南.md", "references/%e6%8c%87%e5%8d%97.md", True),Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
URL with embedded credentialstests/test_sarif.py:330 · URL with embedded credentials — may be phishing or credential leaking
AST07target = "https://user:[email protected]:8443/mcp?sig=abc123#frag"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Bidirectional text override characters detectedtests/test_skills_rules.py:494 · Bidirectional text override characters detected — may hide content direction
AST07entry = skill("code-review", {"SKILL.md": skill_md("code-review", body="```\nrm -rf\n```\n")})Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
npx invocation of non-well-known packagetests/test_sarif.py:445 · npx invocation of non-well-known package — may execute untrusted code
AST06assert key("npx -y @a/server") != key("uvx a-server")Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Dense URL-encoded contenttests/test_skills.py:118 · Dense URL-encoded content — may be obfuscating payloads
AST07("skill://acme/%E6%95%B0%E6%8D%AE/SKILL.md", "skill://acme/%E6%95%B0%E6%8D%AE", "数据"),Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Bidirectional text override characters detectedtests/test_skills_rules.py:173 · Bidirectional text override characters detected — may hide content direction
AST07("skills_hidden_unicode", data(skill("code-review", description="Reviewweiver")),Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
URL with embedded credentialstests/test_tls.py:488 · URL with embedded credentials — may be phishing or credential leaking
AST07"https://user:[email protected]:8443",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Dense URL-encoded contenttests/test_skills_rules.py:628 · Dense URL-encoded content — may be obfuscating payloads
AST07entry["uri"] = "skill://acme/%E6%95%B0%E6%8D%AE/SKILL.md"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
URL with embedded credentialstests/test_smoke_network.py:277 · URL with embedded credentials — may be phishing or credential leaking
AST07assert fixture.url(template) == f"http://127.0.0.1:{fixture.allowed_port}@127.0.0.1:{fixture.denied_port}/"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagetests/test_sarif.py:318 · npx invocation of non-well-known package — may execute untrusted code
AST06("npx -y @modelcontextprotocol/server-everything", "npx"),Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
URL with embedded credentialstests/test_sarif.py:273 · URL with embedded credentials — may be phishing or credential leaking
AST07partial_reason="gated at https://user:[email protected]/x?sig=1",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
URL with embedded credentialstests/test_sarif.py:359 · URL with embedded credentials — may be phishing or credential leaking
AST07"❌ The challenge's resource_metadata 'https://user:[email protected]/.well-known/x?sig=abc123#f' "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.LOW
URL to a private-network addresstests/test_probes.py:2806 · URL to a private-network address — a LAN or development target
AST07await _fetch_auth_server_metadata(client, "http://10.0.0.5", URL, details)Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
Bidirectional text override characters detectedtests/test_skills_rules.py:539 · Bidirectional text override characters detected — may hide content direction
AST07body = "```bash\nls\n```\n"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
Bidirectional text override characters detectedtests/test_skills_rules.py:734 · Bidirectional text override characters detected — may hide content direction
AST07"frontmatter": {"name": "code-review", "description": "Review"},Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
Dense URL-encoded contenttests/test_skills.py:895 · Dense URL-encoded content — may be obfuscating payloads
AST07("skill://a/指南 x", "skill://a/%E6%8C%87%E5%8D%97%20x"),Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
URL with embedded credentialstests/test_smoke_network.py:278 · URL with embedded credentials — may be phishing or credential leaking
AST07assert fixture.display(template) == "http://127.0.0.1:<allowed-port>@127.0.0.1:<denied-port>/"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
URL with embedded credentialstests/test_skills_rules.py:1481 · URL with embedded credentials — may be phishing or credential leaking
AST07secret_root = f"https://user:{password}@skills.example/acme/code-review"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
URL with embedded credentialstests/test_smoke_network.py:276 · URL with embedded credentials — may be phishing or credential leaking
AST07template = "http://127.0.0.1:{allowed}@127.0.0.1:{denied}/"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
URL with embedded credentialstests/test_sarif.py:303 · URL with embedded credentials — may be phishing or credential leaking
AST07("https://user:[email protected]:8443/mcp?sig=abc123#frag", "https://mcp.example.com:8443/mcp"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Bidirectional text override characters detectedtests/test_skills_rules.py:1290 · Bidirectional text override characters detected — may hide content direction
AST07later = {**b, "frontmatter": {**b["frontmatter"], "description": "Review code."}}Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
npx invocation of non-well-known packagetests/test_sarif.py:338 · npx invocation of non-well-known package — may execute untrusted code
AST06command = "npx --token hunter2 @scope/server --root /tmp/hunter2"Fix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Instructions loaded
≈54 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for mcpscore@1.32.0 as of 3d ago. This is the package itself, not its dependencies.
What would make this Verified
12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- Unclaimed publisher≈ +8 on the totalClaim mcp-box: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Hex-encoded URL≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
- URL with embedded credentials≈ +2 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Access to sensitive file paths≈ +2 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- URL to the cloud instance metadata address≈ +2 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim mcp-boxPropose a patch to the maintainer