Skills/PyPI/moneybird-mcp

moneybird-mcp@0.10.0

CAUTION· static only

Publisher claims: "Read-first MCP server for Moneybird bookkeeping, with experimental supervised writes behind an explicit capability policy." Observed in sandbox: static analysis only — behavior not yet observed.

Registry PyPI (MCP server)Publisher espaye · publishing for 9 daysInstalls 0Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Before you give it your token

It will ask for
MCP_AUTH_TOKENMONEYBIRD_ACCESS_TOKENConfiguration, not credentials: MCP_HOST, MCP_PORT, MCP_TOOL_DISCOVERY, MCP_TRANSPORT, MONEYBIRD_ADMINISTRATION_ID, MONEYBIRD_MCP_DATA_DIR, MONEYBIRD_TOOL_DISCOVERY
Where it talks to
moneybird.com (its own)Also githubusercontent.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
nothing has run yet
What we could not test
everything: the server has not run yet

Run it before you trust it. Nothing has run yet: the code was read, the server was not. `vet-skills try` runs this exact version in the honeypot in about a minute.

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-11 and scored it 57/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

HIGH
Access to sensitive file pathsscripts/check_dist_hygiene.py:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env.example",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)moneybird_mcp/server.py:328 · MCP server using network transport (SSE/HTTP) — data sent over network``python moneybird_mcp_server.py`` wrapper passes ``False`` to keep itsFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathsmoneybird_mcp/client.py:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import resolve_credentials, set_active_administration_idFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmoneybird_mcp/server.py:283 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import credentials_are_configured, missing_credentials_messageFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/build_mcpb.py:40 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsmoneybird_mcp/tools/core.py:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom ..credentials import (Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/healthcheck_readonly.py:5 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesSupply configuration in the parent process; no working-directory ``.env`` is loaded:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/build_sbom.py:67 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsscripts/check_dist_hygiene.py:117 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# instruction. `.env.example` is deliberately not matched -- it ships on purposeFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmoneybird_mcp/safety.py:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import (Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmoneybird_mcp/server.py:91 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"environment win. No .env file is discovered automatically."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmoneybird_mcp/auth_cli.py:368 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import (Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmoneybird_mcp/server.py:26 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import (Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmoneybird_mcp/server.py:370 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import CredentialModeMiddlewareFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmoneybird_mcp/oauth.py:126 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesoperator-selected ``--env-file``. No ``.env`` is ever discoveredFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmoneybird_mcp/embed.py:44 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import (Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmoneybird_mcp/auth_cli.py:576 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"already present in the parent environment win. No .env file "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathspyproject.toml:75 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env.example",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmoneybird_mcp/auth_cli.py:195 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import CREDENTIAL_MODE_HOSTED_REQUEST_ONLY, get_credential_modeFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)moneybird_mcp/server.py:6 · MCP server using network transport (SSE/HTTP) — data sent over network``python moneybird_mcp_server.py`` keeps its historical default (legacy SSEFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathsmoneybird_mcp/sync.py:316 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import (Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/check_dist_hygiene.py:120 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Prompt injectiondocs/getting-started.nl.md:47 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…s in een andere map afwezig terwijl de server verbonden is, controleer de scope dan met `claude mcp get moneybird`. ## Installeren met `pip` ```bash python -m pi…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Python subprocess execution detectedscripts/check_docs.py:92 · Python subprocess execution detectednames = subprocess.check_output( # noqa: S603 - resolved Git, fixed read-only argumentsFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_dist_hygiene.py:132 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# .env.example holds no values and is included on purpose.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Prompt injectionREADME.nl.md:85 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileSluit op Windows eerst de MCP-client. Als een eerdere poging met `WinError 32` mislukte, voer dan dezelfde opdracht opnieuw uit terwijl de client gesloten blijft.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Access to sensitive file pathstests/test_attachments.py:195 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesself.assertEqual(safe_attachment_filename("../../etc/passwd"), "etc_passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Prompt injectiondocs/getting-started.nl.md:148 · Prompt injection — known jailbreak technique reference · informational: not an instruction file… de tokens worden bewaard vóórdat ze geverifieerd worden: mislukt die controle, dan meldt het commando dat en houdt het de gegevens, in plaats van je opnieuw te la…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Python subprocess execution detectedscripts/check_reproducible_build.py:17 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/check_reproducible_build.py:67 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_oauth_cli.py:909 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""A working-directory .env must never be picked up implicitly."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Prompt injectiondocs/getting-started.nl.md:73 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileZonder deze extra afhankelijkheid blijft de rest van de server werken. De bijlagetool meldt dan dat PDF-ondersteuning ontbreekt.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Python subprocess execution detectedscripts/build_sbom.py:78 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Prompt injectiondocs/getting-started.nl.md:105 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileSluit op Windows eerst de MCP-client. Als een eerdere poging `WinError 32` meldde, voer de opdracht dan opnieuw uit terwijl de client gesloten blijft.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Access to sensitive file pathstests/test_oauth_cli.py:911 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(Path(cwd) / ".env").write_text(Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_dist_hygiene.py:134 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesCLEAN_WHEEL, [*CLEAN_SDIST, f"moneybird_mcp-{VERSION}/.env.example"]Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Prompt injectionREADME.nl.md:58 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…e mcp list` verbonden meldt maar een ander project geen tools toont, controleer dan `claude mcp get moneybird` en voeg de configuratie opnieuw toe met userscope. G…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Access to sensitive file pathstests/test_server_entry.py:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""os.environ without any MCP_* server settings leaking in from .env."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
URL with embedded credentialstests/test_attachments.py:471 · URL with embedded credentials — may be phishing or credential leaking"https://user:[email protected]/file",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Python subprocess execution detectedscripts/smoke_dist_install.py:62 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/smoke_dist_install.py:84 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/smoke_dist_install.py:49 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Prompt injectionREADME.nl.md:56 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…t meebrengen. Bestaan er zowel een persoonlijk token als een OAuth-verbinding, dan wint het persoonlijke token; `moneybird-mcp auth status` vertelt welke actief i…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Access to sensitive file pathstests/test_dist_hygiene.py:154 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"moneybird_mcp/.env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Prompt injectionREADME.nl.md:75 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…elde consoleprogramma niet vervangen. Meldt `pip` `WinError 32`, houd de client dan gesloten en voer de installatieopdracht opnieuw uit om de gedeeltelijke install…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01

Cost to the agent

Instructions loaded
≈466 tok
2 files · 81 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for moneybird-mcp@0.10.0 as of 3d ago. This is the package itself, not its dependencies.

What would make this Verified

23 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim espaye: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
  4. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  5. URL with embedded credentials≈ +2 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim espayePropose a patch to the maintainer