Skills/PyPI/mfa-servicenow-mcp

mfa-servicenow-mcp@1.25.39

CAUTION· not started

Publisher claims: "A Model Context Protocol (MCP) server implementation for ServiceNow" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher jshsakura · publishing for 255 daysInstalls 11,550Last detonated 34 h ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
SERVICENOW_API_KEYSERVICENOW_API_KEY_HEADERSERVICENOW_AUTH_TYPESERVICENOW_BROWSER_PASSWORDSERVICENOW_CLIENT_SECRETSERVICENOW_MCP_HTTP_AUTH_TOKENSERVICENOW_PASSWORDSERVICENOW_TOKEN_URL or --http-auth-token / --client-secret / --browser-passwordConfiguration, not credentials: LOG_FILE, MCP_TOOL_PACKAGE, PLAYWRIGHT_BROWSERS_PATH, SERVICENOW_ACTIVE_INSTANCE, SERVICENOW_BROWSER_DEBUG, SERVICENOW_BROWSER_HEADLESS, SERVICENOW_BROWSER_LOGIN_URL, SERVICENOW_BROWSER_PROBE_PATH, SERVICENOW_BROWSER_SESSION_TTL, SERVICENOW_BROWSER_TIMEOUT, SERVICENOW_BROWSER_USER_DATA_DIR, SERVICENOW_BROWSER_USERNAME, SERVICENOW_CLIENT_ID, SERVICENOW_DEBUG, SERVICENOW_INSTANCE_URL, SERVICENOW_MCP_HTTP_ALLOWED_HOSTS, SERVICENOW_MCP_HTTP_HOST, SERVICENOW_MCP_HTTP_PATH, SERVICENOW_MCP_HTTP_PORT, SERVICENOW_MCP_SERVER_NAME, SERVICENOW_MCP_TRANSPORT, SERVICENOW_TIMEOUT, SERVICENOW_USERNAME, TOOL_PACKAGE_CONFIG_PATH
Where it talks to
no vendor host named in the codeAlso service-now.com, evil.example, opencode.ai — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names service-now.com, evil.example, opencode.ai as well as its own vendor. The guard injects SERVICENOW_API_KEY, SERVICENOW_API_KEY_HEADER, SERVICENOW_AUTH_TYPE, SERVICENOW_BROWSER_PASSWORD, SERVICENOW_CLIENT_SECRET, SERVICENOW_MCP_HTTP_AUTH_TOKEN, SERVICENOW_PASSWORD, SERVICENOW_TOKEN_URL only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx mfa-servicenow-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 73/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

MEDIUM
Python subprocess execution detectedsrc/servicenow_mcp/browser/window.py:1145 · Python subprocess execution detectedprocess = subprocess.Popen( # noqa: S603 - executable path comes from PlaywrightFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/servicenow_mcp/auth/auth_manager.py:650 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathssrc/servicenow_mcp/cli.py:973 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# from the real environment, not from .env).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/servicenow_mcp/cli.py:498 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Attempt to load from .env if not provided via args/env vars directly in parse_argsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandsrc/servicenow_mcp/auth/_process.py:17 · Process kill command — agent can terminate processesbooting on Windows would kill the first host's in-flight login and then refuseFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/servicenow_mcp/auth/_keepalive.py:102 · Process kill command — agent can terminate processes# first wait() — otherwise stop() would permanently kill keepalive.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/servicenow_mcp/auth/auth_manager.py:1177 · Process kill command — agent can terminate processescrashed mid-login (kill -9, OOM, panic), our own `.lock` fileFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/servicenow_mcp/browser/window.py:987 · Python subprocess execution detectedstarted = subprocess.run( # noqa: S603,S607 - fixed argv, no shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/servicenow_mcp/browser/window.py:1208 · Python subprocess execution detectedsubprocess.run( # noqa: S603,S607 - fixed argv, no shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathssrc/servicenow_mcp/cli.py:976 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Load environment variables from .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandsrc/servicenow_mcp/browser/window.py:1203 · Process kill command — agent can terminate processesOn Windows os.kill maps every signal other than CTRL_C/CTRL_BREAK to anFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/servicenow_mcp/auth/auth_manager.py:2626 · Process kill command — agent can terminate processes# Do NOT close or kill it. Keep login_in_progress=True so thatFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/servicenow_mcp/browser/window.py:1201 · Process kill command — agent can terminate processes"""Ask a pid to exit. Never uses os.kill on Windows.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/check_real_identities.py:231 · Python subprocess execution detectedout = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/servicenow_mcp/browser/window.py:1225 · Python subprocess execution detectedsubprocess.run( # noqa: S603,S607Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandsrc/servicenow_mcp/auth/auth_manager.py:704 · File permission modification command — agent changes file ownership/permissions# User-chosen base: create it private if missing, but NEVER chmod aFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedscripts/check_real_identities.py:248 · Python subprocess execution detectedout = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
CRITICAL
Prompting user to enter sensitive credentialssrc/servicenow_mcp/browser/login.py:547 · Prompting user to enter sensitive credentials — social engineeringnot, and the user can always type the password themselves. Every outcome isFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Python subprocess execution detectedsrc/servicenow_mcp/browser/window.py:965 · Python subprocess execution detectedcommand = subprocess.run( # noqa: S603,S607 - fixed argv, no shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/build_desktop_release.py:50 · Python subprocess execution detectedsubprocess.run(cmd, cwd=ROOT, env=env, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandsrc/servicenow_mcp/browser/window.py:1245 · Process kill command — agent can terminate processesits own kill policy is how one of them ends up SIGKILLing a browser thatFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filessrc/servicenow_mcp/server.py:450 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file# This used to add "CLAUDE.md asks authors to keep descriptions ≤80Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedsrc/servicenow_mcp/setup_installer.py:792 · Python subprocess execution detectedsubprocess.run(cmd, check=True, timeout=600)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandsrc/servicenow_mcp/server.py:899 · Process kill command — agent can terminate processes# Broad on purpose (one broken peer must never kill startup), butFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/servicenow_mcp/server.py:872 · Process kill command — agent can terminate processes# var) must NOT kill server startup — the Playwright lesson: aFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionsrc/servicenow_mcp/tools/log_tools.py:34 · File type combined with upload action — agent may exfiltrate local data files"hint": "Script errors, warnings, gs.log output, platform messages",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedsrc/servicenow_mcp/tools/repo_tools.py:51 · Python subprocess execution detectedcompleted = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandsrc/servicenow_mcp/browser/window.py:1402 · Process kill command — agent can terminate processes# not permission to kill somebody's browser.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/servicenow_mcp/browser/window.py:1237 · Process kill command — agent can terminate processeslogger.debug("Could not force-kill debug window pid %s: %s", pid, exc)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈57 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mfa-servicenow-mcp@1.25.39 as of 32 h ago. This is the package itself, not its dependencies.

What would make this Verified

7 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Prompting user to enter sensitive credentials≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. Unclaimed publisher≈ +8 on the totalClaim jshsakura: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  5. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim jshsakuraPropose a patch to the maintainer