Skills/PyPI/permisapi-mcp

permisapi-mcp@0.6.1

VERIFIED· not started

Publisher claims: "Serveur MCP pour PermisAPI : 18 outils en lecture seule pour interroger plus de 3 millions de permis de construire en France (autorisés depuis 2013) depuis Claude, ChatGPT, Claude Desktop, Cursor, Windsurf et tout client MCP. Argument facultatif type (PC, DP, PA ou PD) sur les outils qui prennent un numéro, champs type_autorisation et identifiant, connexion OAuth au serveur hébergé, année de dépôt filtrable dès 2000." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher evan-crx · publishing for 188 daysInstalls 451Last detonated 1 h ago
$claude mcp add permisapi-mcp -- uvx permisapi-mcp
WatchReport an issue

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
DATABASE_URLMCP_SECRET_RELAISPERMISAPI_KEYPOSTHOG_API_KEYSECRET_KEYConfiguration, not credentials: MCP_BASE_URL, MCP_CLE_JETONS, MCP_DUREE_JETON_ACCES, MCP_REPONDRE_DISCOVER, PERMISAPI_BASE_URL, POSTHOG_HOST
Where it talks to
permisapi.fr (its own)Also posthog.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names posthog.com as well as its own vendor. The guard injects DATABASE_URL, MCP_SECRET_RELAIS, PERMISAPI_KEY, POSTHOG_API_KEY, SECRET_KEY only into requests to permisapi.fr (and its subdomains) and refuses the rest.

$vet-skills run --secrets DATABASE_URL=permisapi.fr,MCP_SECRET_RELAIS=permisapi.fr,PERMISAPI_KEY=permisapi.fr,POSTHOG_API_KEY=permisapi.fr,SECRET_KEY=permisapi.fr -- uvx permisapi-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-14 and scored it 80/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

MEDIUM
URL to the cloud instance metadata addresstests/test_cimd.py:273 · URL to the cloud instance metadata address — reads the VM's credentialsself.send_header("Location", "http://169.254.169.254/latest/meta-data/")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Stripe-like API key pattern detectedtests/test_annotations.py:82 · Stripe-like API key pattern detected — possible hardcoded or harvested keyentetes = {"Authorization": "Bearer pk_live_validlooking", "Accept": "application/json, text/event-stream"}Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
HTTP URL with a raw public IP addresstests/test_cimd.py:92 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot name("https://8.8.8.8/doc.json", "adresse_ip_ecrite"),Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Stripe-like API key pattern detectedtests/test_sse_server.py:149 · Stripe-like API key pattern detected — possible hardcoded or harvested key"/mcp/?key=pk_test_fromqueryparam",Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Stripe-like API key pattern detectedtests/test_journal.py:30 · Stripe-like API key pattern detected — possible hardcoded or harvested key"1.2.3.4:5", "GET", "/sse?key=pk_live_secretvalue", "1.1", 401,Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
URL to the cloud instance metadata addresstests/test_cimd.py:91 · URL to the cloud instance metadata address — reads the VM's credentials("https://169.254.169.254/latest/meta-data", "adresse_ip_ecrite"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
URL with embedded credentialstests/test_cimd.py:95 · URL with embedded credentials — may be phishing or credential leaking("https://utilisateur:[email protected]/oauth/doc", "adresse_identifiant"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Stripe-like API key pattern detectedtests/test_journal_echecs.py:187 · Stripe-like API key pattern detected — possible hardcoded or harvested keycle = "pk_live_CleTresSecrete123"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Stripe-like API key pattern detectedtests/test_inscription.py:29 · Stripe-like API key pattern detected — possible hardcoded or harvested keyCLE_EXISTANTE = "pk_live_cleDuCompteExistant0123456789"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Python subprocess execution detectedtests/test_configuration.py:56 · Python subprocess execution detectedr = subprocess.run([sys.executable, "-c", "import permisapi_mcp.sse_server"], env=env,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathspermisapi_mcp/depot_oauth.py:137 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"MCP dans le .env commun ; en créer une : "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_cimd.py:88 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files("file:///etc/passwd", "adresse_schema"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Stripe-like API key pattern detectedtests/test_sse_server.py:169 · Stripe-like API key pattern detected — possible hardcoded or harvested keyr = client.get("/sse?key=pk_live_fromqueryparam")Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Stripe-like API key pattern detectedtests/test_analytics.py:89 · Stripe-like API key pattern detected — possible hardcoded or harvested keykw = await _capture(monkeypatch, api_key="pk_live_bobInvalidKey")Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Stripe-like API key pattern detectedtests/test_sse_server.py:131 · Stripe-like API key pattern detected — possible hardcoded or harvested keyheaders={"authorization": "Bearer pk_test_lowercasekey"},Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Stripe-like API key pattern detectedtests/test_sonde_ere.py:12 · Stripe-like API key pattern detected — possible hardcoded or harvested keyCLE = "Bearer pk_live_validlooking"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Stripe-like API key pattern detectedtests/test_oauth_base.py:37 · Stripe-like API key pattern detected — possible hardcoded or harvested keyCLE = "pk_live_cleDuCompteDeTest0123456789"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
URL using a raw public IP addresstests/test_cimd.py:92 · URL using a raw public IP address — may bypass domain-based filtering("https://8.8.8.8/doc.json", "adresse_ip_ecrite"),Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Stripe-like API key pattern detectedtests/test_cimd.py:34 · Stripe-like API key pattern detected — possible hardcoded or harvested keyCLE = "pk_live_cleDuCompteDeTest0123456789"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
URL with embedded credentialstests/test_cimd.py:507 · URL with embedded credentials — may be phishing or credential leaking"http://localhost:[email protected]/callback",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Access to sensitive file pathspermisapi_mcp/cimd.py:121 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# `.env` rend le comportement d'avant le lot C3 sans reconstruire l'image : lesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_configuration.py:51 · Python subprocess execution detectedr = subprocess.run([sys.executable, "-c", "import permisapi_mcp.sse_server"], env=env,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
URL to a private-network addresstests/test_cimd.py:133 · URL to a private-network address — a LAN or development targetassert _refus(cimd.verifier_client_id, "http://10.0.0.1/doc") == "adresse_schema"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Stripe-like API key pattern detectedtests/test_sse_server.py:220 · Stripe-like API key pattern detected — possible hardcoded or harvested key"Authorization": "Bearer pk_test_frombearer",Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Stripe-like API key pattern detectedtests/test_sse_server.py:271 · Stripe-like API key pattern detected — possible hardcoded or harvested key"Authorization": "Bearer pk_test_injectedbymiddleware",Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03

Cost to the agent

Instructions loaded
≈142 tok
1 file · 45 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for permisapi-mcp@0.6.1 as of 55 min ago. This is the package itself, not its dependencies.