mcptoai@0.3.0
CAUTION· not startedPublisher claims: "MCPtoAI for Linux: chat with AI on your server from the web, your phone or the terminal" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry PyPI (MCP server)Publisher bkty-ltd-info · publishing for 39 daysInstalls 872Last detonated 13 h ago
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
- no credential variables read in the code
- Where it talks to
- mcptoai.com (its own)Also nvidia.com, replicate.com, cloudflare.com, deepseek.com, x.ai, groq.com, mistral.ai, openrouter.ai, together.xyz, fireworks.ai, cerebras.ai, moonshot.ai, ssyz.org.tr — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it under the guard. Not started: dependency install failed; the server itself was not observed. The code names no credential variable and talks to mcptoai.com, its own; the guard pins the network to what the honeypot saw and logs every call.
$vet-skills run --net declared -- uvx mcptoai
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-14 and scored it 75/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Privileged sudo command; Privileged sudo command; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 3 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessinstall script run in the sandbox
0.1sprocessexited 1: ModuleNotFoundError: No module named 'setuptools'
0.2sprocessdependency install exit 1 ·
0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.3sprocesssecond launch, clock +45 days, CI unset
0.3sprocessexited 1: ModuleNotFoundError: No module named 'setuptools'
Static findings
HIGH
Privileged sudo commandmcptoai_linux/cli.py:288 · Privileged sudo command — agent may execute with elevated privileges
AST05check("Start at boot (linger)", service.linger_enabled(), "on" if service.linger_enabled() else "sudo loginctl enable-linger $USER")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandmcptoai_linux/tools/host_tools.py:559 · Privileged sudo command — agent may execute with elevated privileges
AST05# current user already has permission through the OS; sudo is never used.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsmcptoai_linux/sensitive_paths.py:206 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if filename.startswith(".env") and filename not in ALLOWED_ENV_TEMPLATES:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandmcptoai_linux/service.py:73 · Privileged sudo command — agent may execute with elevated privileges
AST05notes.append("Linger is off: the service stops when you log out. Enable start-at-boot with: sudo loginctl enable-linger " + os.getenv("USER", ""))Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsmcptoai_linux/sensitive_paths.py:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05".netrc": "Network credentials",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsmcptoai_linux/sensitive_paths.py:67 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05ALLOWED_ENV_TEMPLATES = frozenset({".env.example", ".env.sample", ".env.template"})Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedmcptoai_linux/cli.py:183 · Python subprocess execution detected
AST05result = subprocess.run(command)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedmcptoai_linux/service.py:28 · Python subprocess execution detected
AST05return subprocess.run(["systemctl", "--user", *args], env=_env(), capture_output=True, text=True, check=check)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedmcptoai_linux/security_php.py:31 · Python subprocess execution detected
AST05result = subprocess.run([executable, "-v"], capture_output=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedmcptoai_linux/tools/host_tools.py:563 · Python subprocess execution detected
AST05system = subprocess.run(["systemctl",action,name], capture_output=True, text=True, errors="replace", stdin=subprocess.DEVNULL, env=_command_env())Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedmcptoai_linux/service.py:57 · Python subprocess execution detected
AST05out = subprocess.run(["loginctl", "show-user", str(os.getuid()), "-p", "Linger"], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedmcptoai_linux/jobs.py:287 · Python subprocess execution detected
AST05subprocess.run(["taskkill", "/PID", str(pid), "/T", "/F"], capture_output=True, timeout=30,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedmcptoai_linux/tools/host_tools.py:89 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedmcptoai_linux/cli.py:722 · Python subprocess execution detected
AST05subprocess.run(["journalctl", "--user", "-u", service.UNIT_NAME, "-n", str(a.lines), "--no-pager", *(["-f"] if a.follow else [])],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedmcptoai_linux/tools/host_tools.py:560 · Python subprocess execution detected
AST05user = subprocess.run(["systemctl","--user",action,name], capture_output=True, text=True, errors="replace", stdin=subprocess.DEVNULL, env=_command_env())Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedmcptoai_linux/build_info.py:21 · Python subprocess execution detected
AST05commit = subprocess.check_output(['git','rev-parse','HEAD'],cwd=root,text=True,stderr=subprocess.DEVNULL).strip()Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedmcptoai_linux/jobs.py:255 · Python subprocess execution detected
AST05proc = subprocess.Popen(args, stdin=subprocess.DEVNULL, stdout=out, stderr=subprocess.STDOUT,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedmcptoai_linux/build_info.py:22 · Python subprocess execution detected
AST05dirty = bool(subprocess.check_output(['git','status','--porcelain'],cwd=root,text=True,stderr=subprocess.DEVNULL).strip())Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedmcptoai_linux/cli.py:189 · Python subprocess execution detected
AST05verify = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Instructions loaded
≈56 tok
1 file · 77 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for mcptoai@0.3.0 as of 12 h ago. This is the package itself, not its dependencies.
What would make this Verified
5 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim bkty-ltd-info: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
- Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim bkty-ltd-infoPropose a patch to the maintainer