Is med-lit-mcp@0.4.0 safe to install?

med-lit-mcp@0.4.0

CAUTION· not started

Publisher claims: "MCP server for staged, auditable medical literature review that builds an evidence-linked wiki" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher junhewk · publishing for 46 daysInstalls 966Last detonated 3d ago

What would fix this Watch Dispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.

Tested: install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · the dependency install step · every file read, file written and host contacted by what ran
Not tested: server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: NCBI_API_KEYS2_API_KEYSCOPUS_API_KEYSCOPUS_INSTTOKENSEMANTIC_SCHOLAR_API_KEYConfiguration, not credentials: CODEX_HOME, MED_LIT_CLIENT, MED_LIT_CONFIG_DIR, MED_LIT_LAUNCH_COMMAND, MED_LIT_PROJECTS_DIR, MED_LIT_RESPONSE_BYTES, MED_LIT_SCOPE, MED_LIT_STAGES, MED_LIT_STATE_DIR, NCBI_EMAIL, PI_CODING_AGENT_DIR
Where it talks to: no vendor host named in the codeAlso nih.gov, openalex.org, semanticscholar.org, elsevier.com, doi.org, astral.sh, ebi.ac.uk, europepmc.org, unpaywall.org, crossref.org — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names nih.gov, openalex.org, semanticscholar.org, elsevier.com, doi.org, astral.sh, ebi.ac.uk, europepmc.org, unpaywall.org, crossref.org as well as its own vendor. The guard injects NCBI_API_KEY, S2_API_KEY, SCOPUS_API_KEY, SCOPUS_INSTTOKEN, SEMANTIC_SCHOLAR_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx med-lit-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-11 and scored it 76/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Pipe-to-shell pattern. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 3 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessexited 1:

0.2sprocessdependency install exit 1 ·

0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed

0.2sprocessscript backend runs setup only

0.2sprocesssecond launch, clock +45 days, CI unset

0.2sprocessexited 1:

Static findings

MEDIUM

Remote installer piped to shellscripts/install.sh:60 · Remote installer piped to shellecho " curl -LsSf https://astral.sh/uv/install.sh | sh"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST07

MEDIUM

npx invocation of non-well-known packagescripts/build_mcpb.py:124 · npx invocation of non-well-known package — may execute untrusted codenpx = shutil.which("npx") or "npx"Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Python subprocess execution detectedsrc/med_lit_mcp/onboarding.py:60 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

CRITICAL

Pipe-to-shell patternscripts/install.sh:60 · Pipe-to-shell pattern — downloads and immediately executes remote codeecho " curl -LsSf https://astral.sh/uv/install.sh | sh"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST06

MEDIUM

Python subprocess execution detectedsrc/med_lit_mcp/cli_bot.py:284 · Python subprocess execution detectedsubprocess.run([*editor.split(), str(path)], check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/med_lit_mcp/platforms.py:71 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/med_lit_mcp/cli_setup.py:78 · Python subprocess execution detectedreturn subprocess.run(command, input=stdin, capture_output=True, text=True, timeout=timeout, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/med_lit_mcp/search.py:683 · Python subprocess execution detectedprocess = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscripts/build_mcpb.py:125 · Python subprocess execution detectedsubprocess.run([npx, "-y", MCPB_CLI, "validate", str(bundle / "manifest.json")], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscripts/build_mcpb.py:127 · Python subprocess execution detectedsubprocess.run([npx, "-y", MCPB_CLI, "pack", str(bundle), str(target)], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/med_lit_mcp/setup_ui.py:68 · Python subprocess execution detectedresult = subprocess.run(command, env=env, capture_output=True, text=True, encoding="utf-8", timeout=180, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

LOW

HTML that renders invisible but is read by the agentsrc/med_lit_mcp/setup/index.html:28 · HTML that renders invisible but is read by the agent · informational: not an instruction file<h1>Setup closed</h1><p class="muted">Run the med-lit install script again when you’re ready to continue.</p>Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

MEDIUM

Python subprocess execution detectedtests/test_platforms.py:32 · Python subprocess execution detectedresult = subprocess.run([sys.executable, "-c", probe, str(path)], timeout=10, capture_output=True, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_clients.py:107 · Python subprocess execution detected

result = subprocess.run([codex, "mcp", "get", "med-lit", "--json"], capture_output=True, text=True, timeout=20, env=os.environ, check=False)

Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_server.py:275 · Python subprocess execution detectedcompleted = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

File type combined with upload actionsrc/med_lit_mcp/search.py:671 · File type combined with upload action — agent may exfiltrate local data files*command, "run", str(path / manifest.get("search_question", "question.json")), "--output", str(output),Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

npx invocation of non-well-known packagetests/test_bot.py:298 · npx invocation of non-well-known package — may execute untrusted code

"mcp list") printf '  Name   Transport\\n  ────   ─────\\n  med-lit   uv run   all\\n  github   npx   all\\n' ;;

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Python subprocess execution detectedtests/test_platforms.py:15 · Python subprocess execution detectedprocess = subprocess.Popen([sys.executable, "-c", "import time; time.sleep(60)"], start_new_session=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

File type combined with upload actionsrc/med_lit_mcp/search.py:668 · File type combined with upload action — agent may exfiltrate local data filesif (output / "strategy.json").is_file() and (output / "manifest.json").is_file():Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)tests/test_clients.py:35 · MCP server using network transport (SSE/HTTP) — data sent over networkpath.write_text('[mcp_servers.med-lit]\nurl = "https://example.org/mcp"\n')Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

Python subprocess execution detectedtests/test_platforms.py:35 · Python subprocess execution detectedresult = subprocess.run([sys.executable, "-c", probe, str(path)], timeout=10, capture_output=True, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

Cost to the agent

Instructions loaded

≈59 tok

1 file · 81 in bundle

Tool list per prompt

≈0 tok

0 tools · 0 per tool

Handshake

no reply

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for med-lit-mcp@0.4.0 as of 3d ago. This is the package itself, not its dependencies.

What would make this Verified

4 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%

Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Unclaimed publisher≈ +8 on the totalClaim junhewk: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
Remote installer piped to shell≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.

Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim junhewk Propose a patch to the maintainer