neo-mcp@0.5.16
CAUTION· not startedPublisher claims: "Neo MCP server — bring Neo, the autonomous AI engineer for ML, LLM, GenAI & data workflows, into Claude Code, Cursor, Codex & other editors. Describe a task; Neo builds it and writes results to your repo." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry PyPI (MCP server)Publisher neoresearchai · publishing for 236 daysInstalls 371Last detonated 36 h ago
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
NEO_AUTH_URLNEO_SECRET_KEYConfiguration, not credentials: NEO_API_URL, NEO_BYOK_KEY, NEO_BYOK_MODEL, NEO_BYOK_PROVIDER, NEO_COMMAND_STATE_MAX, NEO_DEPLOYMENT_ID, NEO_DEPLOYMENT_ID_MODE, NEO_ENV, NEO_ENVIRONMENT, NEO_HEALTH_PORT, NEO_HOME, NEO_INIT_CHAT_TIMEOUT_SECONDS, NEO_INTEGRATIONS_BACKEND, NEO_JOB_MAX_LOG_BYTES, NEO_JOB_MAX_RUNTIME_SECONDS, NEO_POLL_DRAIN_EMPTY, NEO_POLL_PARK_TICK, NEO_POLL_STATUS_CHECK_AFTER, NEO_POLLER_READY_TIMEOUT_SECONDS, NEO_PUBLIC_URL, NEO_READ_ONLY, NEO_RELAY_URL, NEO_THREAD_STATUSES_MAX, NEO_THREAD_WORKSPACES_MAX, NEO_THREAD_WORKSPACES_TTL_SECONDS, NEO_TRACE_ROUTING, NEO_WORKSPACE_DIR, NEO_WORKSPACE_REGISTRATION_WAIT_SECONDS- Where it talks to
- no vendor host named in the codeAlso heyneo.com, openrouter.ai, heyneo.so, huggingface.co, kaggle.com, amazonaws.com, wandb.ai — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names heyneo.com, openrouter.ai, heyneo.so, huggingface.co, kaggle.com, amazonaws.com, wandb.ai as well as its own vendor. The guard injects NEO_AUTH_URL, NEO_SECRET_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.
$vet-skills run --net declared -- uvx neo-mcp
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run
Static findings
HIGH
Access to sensitive file pathssrc/neo_mcp/integrations/providers/s3.py:26 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"""Insert or replace the [neo] profile in ~/.aws/credentials."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/neo_mcp/server.py:1798 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05- anthropic/openrouter: one location (either keyring entry or 0o600 .env)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/neo_mcp/skills/neo.md:91 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…b_pat_`) to infer the provider when unstated. Do NOT suggest the user create a `.env` file — this tool IS the registration path. | Stored locally only — `~/.neo/int…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/neo_mcp/integrations/providers/wandb.py:14 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05NETRC_FILE = Path.home() / ".netrc"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/neo_mcp/server.py:2328 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"filename": "../../../../etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/neo_mcp/integrations/secret_store.py:54 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"""Store one .env file per provider under ``~/.neo/integrations/`` at 0o600."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
References a credential file in the home directorysrc/neo_mcp/integrations/providers/wandb.py:1 · References a credential file in the home directory
AST03"""Weights & Biases API key — stored via SecretStore + ~/.netrc."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/neo_mcp/integrations/_fsutil.py:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05On any failure the tempfile is unlinked so we don't leave ``.env.tmp``Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
URL with embedded credentialssrc/neo_mcp/integrations/providers/github.py:29 · URL with embedded credentials — may be phishing or credential leaking
AST07kept.append(f"https://{username}:{pat}@github.com")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
References a credential file in the home directorysrc/neo_mcp/integrations/providers/s3.py:1 · References a credential file in the home directory
AST03"""AWS S3 credentials — stored via SecretStore + ~/.aws/credentials [neo] profile."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/neo_mcp/integrations/providers/wandb.py:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"""Weights & Biases API key — stored via SecretStore + ~/.netrc."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/neo_mcp/integrations/providers/wandb.py:25 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"""Insert or replace the api.wandb.ai block in ~/.netrc."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/neo_mcp/integrations/providers/s3.py:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"""AWS S3 credentials — stored via SecretStore + ~/.aws/credentials [neo] profile."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/neo_mcp/byok/profile_manager.py:7 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05(``~/.neo/integrations/byok-<id>.env`` at 0o600, or the OS keyring whenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/neo_mcp/server.py:1788 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"logged, never committed to git (~/.neo/ and .env are in .gitignore). "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/neo_mcp/integrations/providers/s3.py:58 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"""Remove the [neo] profile from ~/.aws/credentials. Returns True if removed."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/neo_mcp/integrations/secret_store.py:64 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05return self._dir / f"{provider}.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
References a credential file in the home directorysrc/neo_mcp/integrations/providers/s3.py:26 · References a credential file in the home directory
AST03"""Insert or replace the [neo] profile in ~/.aws/credentials."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/neo_mcp/integrations/secret_store.py:5 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05- ``FileStore`` — one ``~/.neo/integrations/<provider>.env`` file per provider,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/neo_mcp/paths.py:76 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# key=value .env files with mode 0o600.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/neo_mcp/server.py:666 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"DO NOT instead suggest the user create a .env file, export an "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/neo_mcp/server.py:680 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"~/.neo/integrations/<provider>.env, mode 0o600) and never sent "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
References a credential file in the home directorysrc/neo_mcp/integrations/providers/s3.py:58 · References a credential file in the home directory
AST03"""Remove the [neo] profile from ~/.aws/credentials. Returns True if removed."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
References a credential file in the home directorysrc/neo_mcp/integrations/providers/wandb.py:25 · References a credential file in the home directory
AST03"""Insert or replace the api.wandb.ai block in ~/.netrc."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedsrc/neo_mcp/service.py:398 · Python subprocess execution detected
AST05return subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_hardening.py:343 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
AWS access key pattern detectedtests/test_system.py:4195 · AWS access key pattern detected — possible hardcoded or harvested key
AST03self.assertIn("AKIAIOSFODNN7EXAMPLE", content)Fix: Never read or enumerate credential locations; accept a documented environment variable instead.MEDIUM
File permission modification commandsrc/neo_mcp/integrations/_fsutil.py:31 · File permission modification command — agent changes file ownership/permissions
AST05owner — there is no write-then-chmod window.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
URL with embedded credentialstests/test_system.py:2286 · URL with embedded credentials — may be phishing or credential leaking
AST07"https://user:[email protected]\n"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedsrc/neo_mcp/service.py:593 · Python subprocess execution detected
AST05r = subprocess.run(["claude", "mcp", "remove", "--scope", scope, "neo"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/neo_mcp/service.py:368 · Python subprocess execution detected
AST05subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/neo_mcp/login.py:52 · Python subprocess execution detected
AST05subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Destructive file system command detectedtests/test_system.py:325 · Destructive file system command detected
AST05r = arun(self.h.handle_command(self.cmd(filename="../../evil.sh", code="rm -rf /")))Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Access to sensitive file pathstests/test_system.py:2453 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Plaintext .env file was NOT writtenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstests/test_system.py:1111 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05self.assertFalse(self.allowed("/etc/passwd"))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
URL with embedded credentialstests/test_system.py:2681 · URL with embedded credentials — may be phishing or credential leaking
AST07raise RuntimeError("connection refused from https://user:[email protected]")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstests/test_system.py:2081 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05return self.td / "integrations" / f"{provider}.env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedsrc/neo_mcp/setup.py:308 · Python subprocess execution detected
AST05result = subprocess.run(cmd, capture_output=True, text=True, timeout=15)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandsrc/neo_mcp/job_manager.py:204 · Process kill command — agent can terminate processes
AST05# with a hard timeout to kill hung subprocesses.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/neo_mcp/service.py:360 · Process kill command — agent can terminate processes
AST05editor cannot suspend or kill it. All stdio is detached to DEVNULL.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedsrc/neo_mcp/integrations/providers/github.py:50 · Python subprocess execution detected
AST05subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Destructive command against a filesystem root or devicetests/test_system.py:325 · Destructive command against a filesystem root or device
AST05r = arun(self.h.handle_command(self.cmd(filename="../../evil.sh", code="rm -rf /")))Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedsrc/neo_mcp/service.py:461 · Python subprocess execution detected
AST05subprocess.run(["loginctl", "enable-linger", user],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Access to sensitive file pathstests/test_system.py:1150 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05self.assertNotEqual(Path("/etc/passwd").read_text(), "evil")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstests/test_system.py:410 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05r = arun(self.h.handle_command(self.cmd(file_path="../../etc/passwd")))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedsrc/neo_mcp/service.py:156 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/neo_mcp/setup.py:152 · Python subprocess execution detected
AST05subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
AWS access key pattern detectedtests/test_system.py:4192 · AWS access key pattern detected — possible hardcoded or harvested key
AST03s3.write_secret({"aws_access_key_id": "AKIAIOSFODNN7EXAMPLE", "aws_secret_access_key": "wJalrXUtn", "region": "eu-west-1"})Fix: Never read or enumerate credential locations; accept a documented environment variable instead.Cost to the agent
Instructions loaded
≈85 tok
1 file · 70 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for neo-mcp@0.5.16 as of 34 h ago. This is the package itself, not its dependencies.
What would make this Verified
12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim neoresearchai: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- References a credential file in the home directory≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- AWS access key pattern detected≈ +2 on the totalNever read or enumerate credential locations; accept a documented environment variable instead.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim neoresearchaiPropose a patch to the maintainer