powerbi-mcp@0.1.2
CAUTION· not startedPublisher claims: "Model Context Protocol server for PowerBI REST API integration" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry PyPI (MCP server)Publisher gurvinder-dhillon · publishing for 283 daysInstalls 126Last detonated 3 h ago
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
POWERBI_CLIENT_SECRETConfiguration, not credentials: MCP_TRANSPORT, POWERBI_CLIENT_ID, POWERBI_TENANT_ID- Where it talks to
- no vendor host named in the codeAlso powerbi.com, microsoftonline.com, windows.net — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names powerbi.com, microsoftonline.com, windows.net as well as its own vendor. The guard injects POWERBI_CLIENT_SECRET only into requests to the host you bind (and its subdomains) and refuses the rest.
$vet-skills run --net declared -- uvx powerbi-mcp
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-15 and scored it 79/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Instructs the agent to modify its persistent memory or instruction files; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run
Static findings
LOW
Instructs the agent to modify its persistent memory or instruction files.claude/skills/claude-md-improver/references/update-guidelines.md:1 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01# CLAUDE.md Update GuidelinesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Access to sensitive file pathspowerbi_mcp/auth.py:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05load_dotenv(dotenv_path=os.path.join(os.getcwd(), '.env'), override=False)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Instructs the agent to modify its persistent memory or instruction files.claude/skills/claude-md-improver/SKILL.md:115 · Instructs the agent to modify its persistent memory or instruction files
AST01- Which CLAUDE.md file to updateFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
Remote installer piped to shell.claude/skills/uv-package-manager/SKILL.md:58 · Remote installer piped to shell
AST07curl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathsCLAUDE.md:70 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05Required in `.env` (loaded from `os.getcwd()`) or MCP client config:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Instructs the agent to modify its persistent memory or instruction files.claude/skills/claude-md-improver/SKILL.md:11 · Instructs the agent to modify its persistent memory or instruction files
AST01**This skill can write to CLAUDE.md files.** After presenting a quality report and getting user approval, it updates CLAUDE.md files with targeted improvements.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Instructs the agent to modify its persistent memory or instruction files.claude/skills/claude-md-improver/SKILL.md:3 · Instructs the agent to modify its persistent memory or instruction files
AST01--- name: claude-md-improver description: Audit and improve CLAUDE.md files in repositories. Use when user asks to check, audit, update, improve, or fix CLAUDE.md files. Scans for all CLAUDE.md files, evaluates qual…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Access to sensitive file pathspowerbi_mcp/auth.py:101 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"Please set these variables in your .env file or environment configuration."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file paths.claude/skills/powerbi-mcp-server-tester/SKILL.md:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05- "Please confirm your PowerBI environment variables (POWERBI_TENANT_ID, POWERBI_CLIENT_ID, POWERBI_CLIENT_SECRET) are set in your `.env` file"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Pipe-to-shell pattern.claude/skills/uv-package-manager/SKILL.md:58 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06curl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file paths.claude/skills/powerbi-mcp-server-tester/SKILL.md:14 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST051. **Environment Variables**: PowerBI credentials must be set in `.env` fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathspowerbi_mcp/auth.py:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05logger.info(f"Attempted to load .env from: {os.getcwd()}")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known package.claude/skills/powerbi-mcp-server-tester/SKILL.md:19 · npx invocation of non-well-known package — may execute untrusted code
AST062. **MCP Inspector**: Installed globally via npx (no manual installation needed)Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Instructs the agent to modify its persistent memory or instruction files.claude/skills/claude-md-improver/SKILL.md:122 · Instructs the agent to modify its persistent memory or instruction files
AST01### Update: ./CLAUDE.mdFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Access to sensitive file pathsCLAUDE.md:75 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05See DEVELOPER_GUIDE.md for Azure AD setup and `.env` loading behavior (project-specific credentials from working directory).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathspowerbi_mcp/auth.py:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# This allows .env files to be project-specific rather than server-specificFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.Cost to the agent
Instructions loaded
≈19,855 tok
7 files · 51 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for powerbi-mcp@0.1.2 as of 2 h ago. This is the package itself, not its dependencies.
What would make this Verified
1 point to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim gurvinder-dhillon: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Pipe-to-shell pattern≈ +4 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- Remote installer piped to shell≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim gurvinder-dhillonPropose a patch to the maintainer