Skills/PyPI/opensearch-mcp-server

opensearch-mcp-server@2.1.9

VERIFIED· not started

Publisher claims: "MCP Server for interacting with Elasticsearch and OpenSearch" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher pypi · publishing for 723 daysInstalls 5,269Last detonated 15 h ago
$claude mcp add opensearch-mcp-server -- uvx opensearch-mcp-server
WatchReport an issue

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
MCP_API_KEYConfiguration, not credentials: DEFAULT_CLUSTER, DISABLE_HIGH_RISK_OPERATIONS, DISABLE_OPERATIONS, REQUEST_TIMEOUT, RESPONSE_FORMAT, VERIFY_CERTS
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard. It asks for MCP_API_KEY and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --net declared -- uvx opensearch-mcp-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 87/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

MEDIUM
File permission modification commandDockerfile:48 · File permission modification command — agent changes file ownership/permissionsRUN chmod +x /app/entrypoint.shFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Destructive file system command detectedDockerfile:37 · Destructive file system command detected&& rm -rf /var/lib/apt/lists/* \Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/e2e/k8s/conftest.py:66 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/e2e/k8s/conftest.py:149 · Python subprocess execution detectedprocess = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commanddocker-compose-elasticsearch.yml:47 · File permission modification command — agent changes file ownership/permissionsfind . -type f -exec chmod 640 \{\} \;;Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commanddocker-compose-elasticsearch.yml:46 · File permission modification command — agent changes file ownership/permissionsfind . -type d -exec chmod 750 \{\} \;;Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Access to sensitive file pathsdocker-compose-elasticsearch.yml:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho "Set the ELASTICSEARCH_PASSWORD environment variable in the .env file";Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/e2e/k8s/conftest.py:38 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Privileged sudo command.github/workflows/test.yaml:116 · Privileged sudo command — agent may execute with elevated privilegesrun: sudo sysctl -w vm.max_map_count=262144Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification command.github/workflows/test.yaml:178 · File permission modification command — agent changes file ownership/permissionschmod +x kindFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedtests/e2e/containers/conftest.py:171 · Python subprocess execution detectedprocess = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commanddocker-compose-elasticsearch.yml:45 · File permission modification command — agent changes file ownership/permissionschown -R root:root config/certs;Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Privileged sudo command.github/workflows/test.yaml:179 · Privileged sudo command — agent may execute with elevated privilegessudo mv kind /usr/local/bin/kindFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Privileged sudo command.github/workflows/test.yaml:156 · Privileged sudo command — agent may execute with elevated privilegesrun: sudo sysctl -w vm.max_map_count=262144Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/e2e/k8s/conftest.py:257 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/e2e/package/conftest.py:29 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with embedded credentialstests/unit/clients/test_error_report.py:28 · URL with embedded credentials — may be phishing or credential leaking("http://user:pw@host:9200/idx/_search", "/idx/_search"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)tests/unit/server/test_health_routes.py:46 · MCP server using network transport (SSE/HTTP) — data sent over networkasync def _request(server: SearchMCPServer, path: str) -> httpx.Response:Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
URL with embedded credentialstests/unit/server/test_log_redaction.py:39 · URL with embedded credentials — may be phishing or credential leaking("POST", httpx.URL("http://u:p@h:9200/idx/_doc/1?q=s"), "HTTP/1.1", 200, "OK"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
URL with embedded credentialstests/unit/server/test_log_redaction.py:100 · URL with embedded credentials — may be phishing or credential leaking("HTTPS://u:p@h:9200/x?q=1 done", "/x done"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
URL with embedded credentialstests/unit/server/test_log_redaction.py:76 · URL with embedded credentials — may be phishing or credential leakinglogger.info("POST http://u:p@h:9200/_query?x=1 [status:400]")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
URL with embedded credentialstests/unit/server/test_log_redaction.py:66 · URL with embedded credentials — may be phishing or credential leakingrecord = _record("%d http://u:p@h:9200/x", ("notanint",))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Python subprocess execution detectedtests/e2e/package/conftest.py:34 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with embedded credentialstests/unit/clients/test_exceptions.py:179 · URL with embedded credentials — may be phishing or credential leakingurl = "http://MARKER_USER:MARKER_PW@MARKER_HOST:9200/idx/_search?MARKER_Q=1"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
URL with embedded credentialstests/unit/server/test_log_redaction.py:47 · URL with embedded credentials — may be phishing or credential leakingrecord = _record("GET %s done", ("https://u:p@h:9200/a/_search?x=1",))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
URL with embedded credentialstests/unit/clients/test_error_report.py:148 · URL with embedded credentials — may be phishing or credential leakingdef _httpx_error(status, body, method="POST", url="http://user:pw@host:9200/_query?secretparam=1",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
URL with embedded credentialstests/unit/clients/test_proxy.py:395 · URL with embedded credentials — may be phishing or credential leaking"http://user:SECRETPW@proxy:0",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07

Cost to the agent

Instructions loaded
≈56 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for opensearch-mcp-server@2.1.9 as of 14 h ago. This is the package itself, not its dependencies.

opensearch-mcp-server@2.1.9 safety verdict: Verified (not started) — KillerSkills