Is paybito-mcp@0.2.26 safe to install?

paybito-mcp@0.2.26

VERIFIED· not started

Publisher claims: "PayBito infrastructure knowledge helper for AI agents — injects PayBito API expertise (Resources + Prompts, no live actions) into any MCP-capable AI platform." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher pypi · publishing for 723 daysInstalls 150Last detonated 58 min ago

$claude mcp add paybito-mcp -- uvx paybito-mcp

Watch Report an issue

Coverage

Not started: dependency install failed; the server itself was not observed.

Tested: the dependency install step · every file read, file written and host contacted by what ran
Not tested: server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: BITOCIRCLE_ACCESS_TOKENBITOCIRCLE_API_KEYBITOCIRCLE_SECRETBITOCIRCLE_TOKENPAYBITO_ACCESS_TOKENPAYBITO_API_KEYPAYBITO_CLIENT_SECRETPAYBITO_SECRETPAYBITO_SECRET_HASHPAYBITO_SECRET_KEYPAYBITO_TOKENConfiguration, not credentials: PAYBITO_CLIENT_ID, PAYBITO_MODEL, PAYBITO_PUBLIC_KEY, PAYBITO_UUID
Where it talks to: paybito.com (its own)Also coinstrendexchange.com, hashcashconsultants.com, axada.co, bitocircle.com — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names coinstrendexchange.com, hashcashconsultants.com, axada.co, bitocircle.com as well as its own vendor. The guard injects BITOCIRCLE_ACCESS_TOKEN, BITOCIRCLE_API_KEY, BITOCIRCLE_SECRET, BITOCIRCLE_TOKEN, PAYBITO_ACCESS_TOKEN, PAYBITO_API_KEY, PAYBITO_CLIENT_SECRET, PAYBITO_SECRET, PAYBITO_SECRET_HASH, PAYBITO_SECRET_KEY, PAYBITO_TOKEN only into requests to paybito.com (and its subdomains) and refuses the rest.

$vet-skills run --secrets BITOCIRCLE_ACCESS_TOKEN=paybito.com,BITOCIRCLE_API_KEY=paybito.com,BITOCIRCLE_SECRET=paybito.com,BITOCIRCLE_TOKEN=paybito.com,PAYBITO_ACCESS_TOKEN=paybito.com,PAYBITO_API_KEY=paybito.com,PAYBITO_CLIENT_SECRET=paybito.com,PAYBITO_SECRET=paybito.com,PAYBITO_SECRET_HASH=paybito.com,PAYBITO_SECRET_KEY=paybito.com,PAYBITO_TOKEN=paybito.com -- uvx paybito-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-14 and scored it 82/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 1 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.1sprocessdependency install exit 1 ·

0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed

0.2sprocessscript backend runs setup only

0.2sprocessno install scripts to re-run

Static findings

HIGH

Access to sensitive file pathssrc/paybito_mcp/server.py:117 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"`cp .env.example .env` (real `.env` NOT shipped) → `npm install --legacy-peer-deps` (plain "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

LOW

Financial transfer languagespecs/build-your-payment-app.yaml:2833 · Financial transfer language — potential advance-fee scam · informational: not an instruction filedescription: Crypto wallet balances per currency.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

HIGH

Stripe-like API key pattern detectedspecs/build-your-payments-platform.yaml:11033 · Stripe-like API key pattern detected — possible hardcoded or harvested keyexample: "pk_live_xxxxxxxxxxxxxxxxx"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.

AST03

HIGH

Stripe-like API key pattern detectedspecs/payments.yaml:10021 · Stripe-like API key pattern detected — possible hardcoded or harvested keyexample: "pk_test_51T9tOJEexb8mYbI2SyBQJlIst9KypkM4lFnlig1SjcXsLbVjIh1rfJQeFd6UTjL1tt6wnCxzxXFXXH61OchPAfbMS00ebGWwMNJ"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.

AST03

LOW

Prompt injectionREADME.md:121 · Prompt injection — known jailbreak technique reference · informational: not an instruction file**ChatGPT (Developer mode / connectors)** — host the server over HTTP and add it as aFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.

AST01

HIGH

Stripe-like API key pattern detectedspecs/build-your-payments-platform.yaml:11116 · Stripe-like API key pattern detected — possible hardcoded or harvested keyapiKey: "pk_live_xxxxxxxxxxxxxxxxx"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.

AST03

HIGH

Stripe-like API key pattern detectedspecs/payments-merchant-live.yaml:9071 · Stripe-like API key pattern detected — possible hardcoded or harvested keyexample: "sk_test_51T9tOJEexb8mYbI2Uiqz0vk1JGku8Ud4IYVteDWfOqopreDxQSb3q3AoJRctb7zBmhi37114TJEmCYnUZedzUlYJ00gS1GGW75"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.

AST03

HIGH

Stripe-like API key pattern detectedspecs/build-your-payments-platform.yaml:10845 · Stripe-like API key pattern detected — possible hardcoded or harvested keyexample: "pk_live_7HGK98AJSK123456"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.

AST03

HIGH

Stripe-like API key pattern detectedspecs/build-your-payments-platform.yaml:10874 · Stripe-like API key pattern detected — possible hardcoded or harvested keypublishable_key: "pk_live_7HGK98AJSK123456"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.

AST03

HIGH

Stripe-like API key pattern detectedspecs/payments-merchant-live.yaml:9068 · Stripe-like API key pattern detected — possible hardcoded or harvested keyexample: "pk_test_51T9tOJEexb8mYbI2SyBQJlIst9KypkM4lFnlig1SjXcLbVjIh1rfJQeFd6UTjL1tt6wnCxzxXFXXH61OchPAfbMS00ebGWwMNJ"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.

AST03

MEDIUM

File type combined with upload actionsrc/paybito_mcp/model.py:19 · File type combined with upload action — agent may exfiltrate local data filesBUILD_MODEL = ROOT / "build" / "model.json" # dev outputFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

LOW

Authorization escalation languageREADME.md:121 · Authorization escalation language · informational: not an instruction file**ChatGPT (Developer mode / connectors)** — host the server over HTTP and add it as aFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

HIGH

Stripe-like API key pattern detectedspecs/payments.yaml:9958 · Stripe-like API key pattern detected — possible hardcoded or harvested keyexample: "pk_test_51T9tOJEexb8mYbI2SyBQJlIst9KypkM4lFnlig1SjXcLbVjIh1rfJQeFd6UTjL1tt6wnCxzxXFXXH61OchPAfbMS00ebGWwMNJ"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.

AST03

HIGH

Stripe-like API key pattern detectedspecs/payments.yaml:9961 · Stripe-like API key pattern detected — possible hardcoded or harvested keyexample: "sk_test_51T9tOJEexb8mYbI2Uiqz0vk1JGku8Ud4IYVteDWfOqopreDxQSb3q3AoJRctb7zBmhi37114TJEmCYnUZedzUlYJ00gS1GGW75"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.

AST03

HIGH

Stripe-like API key pattern detectedspecs/payments-merchant-live.yaml:552 · Stripe-like API key pattern detected — possible hardcoded or harvested key_Example_: `pk_test_123456abcdef...`Fix: Never read or enumerate credential locations; accept a documented environment variable instead.

AST03

HIGH

Stripe-like API key pattern detectedspecs/payments.yaml:545 · Stripe-like API key pattern detected — possible hardcoded or harvested key_Example_: `pk_test_123456abcdef...`Fix: Never read or enumerate credential locations; accept a documented environment variable instead.

AST03

HIGH

Stripe-like API key pattern detectedspecs/payments-merchant-live.yaml:9130 · Stripe-like API key pattern detected — possible hardcoded or harvested keyexample: "pk_test_51T9tOJEexb8mYbI2SyBQJlIst9KypkM4lFnlig1SjcXsLbVjIh1rfJQeFd6UTjL1tt6wnCxzxXFXXH61OchPAfbMS00ebGWwMNJ"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.

AST03

HIGH

Stripe-like API key pattern detectedspecs/payments-merchant-live.yaml:9133 · Stripe-like API key pattern detected — possible hardcoded or harvested keyexample: "sk_test_51T9tOJEexb8mYbI2Uiqz0vk1JGku8Ud4IYVtuTyWfOqopreDxQSb3q3AoJRctb7zBmhi37114TJEmCYnUZedzUlYJ00gS1GGW75"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.

AST03

HIGH

Stripe-like API key pattern detectedspecs/build-your-payments-platform.yaml:4430 · Stripe-like API key pattern detected — possible hardcoded or harvested keyexample: "sk_live_y4FOUWjrt3BHPWXhsu06HQWYltv5DJRY"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.

AST03

HIGH

Stripe-like API key pattern detectedspecs/payments.yaml:10024 · Stripe-like API key pattern detected — possible hardcoded or harvested keyexample: "sk_test_51T9tOJEexb8mYbI2Uiqz0vk1JGku8Ud4IYVtuTyWfOqopreDxQSb3q3AoJRctb7zBmhi37114TJEmCYnUZedzUlYJ00gS1GGW75"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.

AST03

HIGH

Access to sensitive file pathstypescript/src/server.ts:99 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"`cp .env.example .env` (real `.env` NOT shipped) → `npm install --legacy-peer-deps` (plain " +Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

LOW

Financial transfer languagespecs/payments.yaml:8457 · Financial transfer language — potential advance-fee scam · informational: not an instruction fileAdd or update crypto wallet addresses for specific currencies and networks.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

LOW

Financial transfer languagespecs/payments-merchant-live.yaml:7563 · Financial transfer language — potential advance-fee scam · informational: not an instruction fileAdd or update crypto wallet addresses for specific currencies and networks.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

LOW

Financial transfer languagesrc/paybito_mcp/playbooks/custom-checkout.md:76 · Financial transfer language — potential advance-fee scam · informational: not an instruction file

…ide convenience for the country field; don't make payment logic depend on it. - Crypto wallet interaction (EIP-6963 / `eth_requestAccounts` / `wallet_addEthereumChain` / ERC-…

Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

LOW

Financial transfer languagespecs/build-your-payments-platform.yaml:5739 · Financial transfer language — potential advance-fee scam · informational: not an instruction fileAdd or update crypto wallet addresses for specific currencies and networks.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

Cost to the agent

Instructions loaded

≈76 tok

1 file · 76 in bundle

Tool list per prompt

≈0 tok

0 tools · 0 per tool

Handshake

no reply

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for paybito-mcp@0.2.26 as of 34 min ago. This is the package itself, not its dependencies.