opencode-samcp@0.0.4
VERIFIEDPublisher claims: "Sub-agent MCP: let Devin, Codex, Claude Code and other agents spawn opencode sessions to do work" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-01 and scored it 86/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.2sprocessexec /usr/bin/timeout
0.2sprocessexec /app/apps/web/node_modules/.bin/uvx
0.2sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/uvx
0.2sprocessexec /app/node_modules/.bin/uvx
0.2sprocessexec /pnpm/uvx
0.2sprocessexec /usr/local/sbin/uvx
0.2sprocessexec /usr/local/bin/uvx
0.2sprocessexec /usr/sbin/uvx
0.2sprocessexec /usr/bin/uvx
0.2sprocessexec /sbin/uvx
0.2sprocessexec /bin/uvx
0.2sprocessexec /app/apps/web/node_modules/.bin/uv
0.2sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/uv
0.2sprocessexec /app/node_modules/.bin/uv
0.2sprocessexec /pnpm/uv
0.2sprocessexec /usr/local/sbin/uv
0.2sprocessexec /usr/local/bin/uv
0.2sprocessexec /usr/sbin/uv
0.2sprocessexec /usr/bin/uv
0.2sprocessexec /sbin/uv
0.2sprocessexec /bin/uv
0.2sprocessexited 1: opencode-samcp failed: uv is not installed on machine (needed to run the Python server). Install it from https://docs.astral.sh/uv/getting-started/installation/
0.2sclaimedno tools/list reply (exit 1)
0.2sprocessscript backend runs setup only
Static findings
LOW
Unpinned dependency.github/workflows/publish.yml:47 · Unpinned dependencyFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06No other findings across 830 lines in 15 files.