Skills/PyPI/qdrant-memory-mcp

qdrant-memory-mcp@0.3.5

VERIFIED· not started

Publisher claims: "Metadata-only stdio MCP distribution of the Qdrant Memory Runtime" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher cnkang · publishing for 33 daysInstalls 9,612Last detonated 58 min ago
$claude mcp add qdrant-memory-mcp -- uvx qdrant-memory-mcp
WatchReport an issue

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
GITHUB_TOKENConfiguration, not credentials: GITHUB_EVENT_NAME, GITHUB_OUTPUT, GITHUB_REPOSITORY, GITHUB_SHA
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard. It asks for GITHUB_TOKEN and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --net declared -- uvx qdrant-memory-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-15 and scored it 88/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.2sprocessdependency install exit 1 ·
0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

MEDIUM
Python subprocess execution detectedscripts/check_release_gate.py:25 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/codex_plugin_e2e.py:443 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/dsh_bundle_release.py:26 · Python subprocess execution detectedreturn subprocess.check_output(['git', '-C', str(root), *args], text=True, stderr=subprocess.DEVNULL).strip()Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/codex_plugin_e2e.py:126 · Python subprocess execution detectedcompleted = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/codex_plugin_e2e.py:452 · Process kill command — agent can terminate processespass # the child exited between the probe and the killFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/codex_plugin_e2e.py:456 · Process kill command — agent can terminate processes"""Initialize over raw stdio, then kill the launcher and its Runtime child.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/build_runtime_locks.py:133 · Python subprocess execution detectedcompleted = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/codex_plugin_e2e.py:462 · Python subprocess execution detectedprocess = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_workbuddy_mcp.py:38 · Python subprocess execution detectedresult = subprocess.run([*launch, "--help"], env=env, capture_output=True, timeout=180)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/verify_metadata.py:61 · Python subprocess execution detectedsubprocess.check_output(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/registry_publish.py:34 · Python subprocess execution detectedsubprocess.run([".publisher/mcp-publisher", "publish"], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_workbuddy_mcp.py:111 · Python subprocess execution detectedresult = subprocess.run([*launch, "--home", str(profile), "mcp"], input="", text=True, env=env, capture_output=True, timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_workbuddy_mcp.py:83 · Python subprocess execution detectedresult = subprocess.run([*launch, "--home", str(profile), "mcp"], input="", text=True, env=env, capture_output=True, timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/pack_launcher.py:80 · Python subprocess execution detectedraw = subprocess.check_output(["npm", "pack", "--json", "--ignore-scripts"], cwd=source, env=env, text=True, timeout=120)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/prepare_runtime.py:35 · Python subprocess execution detectedsubprocess.run([sys.executable, "-m", "pip", "download", "--no-deps", "--only-binary=:all:", "--dest", str(artifacts), f"hermes-plugin-qdrant-memory=={version}"], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/dsh_bundle_release.py:46 · Python subprocess execution detectedif subprocess.run(['git', '-C', str(root), 'merge-base', '--is-ancestor', sha, main_ref], capture_output=True).returncode:Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_cross_harness.py:190 · Python subprocess execution detectedresult = subprocess.run([node, './scripts/validate-host.mjs'],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/pack_dsh_bundle.py:112 · Python subprocess execution detectedraw = subprocess.check_output(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/prepare_runtime.py:44 · Python subprocess execution detectedsubprocess.run(["git", "clone", "--no-checkout", source["repository"], str(target)], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/pack_launcher.py:78 · Python subprocess execution detectedraw = subprocess.check_output(["npm.cmd", "pack", "--json", "--ignore-scripts"], cwd=source, env=env, text=True, timeout=120)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/conftest.py:116 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_distribution.py:136 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/prepare_runtime.py:45 · Python subprocess execution detectedsubprocess.run(["git", "-C", str(target), "checkout", "--detach", sha], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/prepare_runtime.py:46 · Python subprocess execution detectedsubprocess.run([sys.executable, "-m", "build", "--wheel", "--outdir", str(artifacts), str(target)], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_protocol.py:187 · Python subprocess execution detectedprocess = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/registry_publish.py:33 · Python subprocess execution detectedsubprocess.run([".publisher/mcp-publisher", "login", "github-oidc"], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_distribution.py:48 · Python subprocess execution detectedsubprocess.check_output(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_workbuddy_mcp.py:74 · Python subprocess execution detectedresult = subprocess.run([*launch, "--home", str(profile), "mcp"], input="", text=True, env=env, capture_output=True, timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈55 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for qdrant-memory-mcp@0.3.5 as of 25 min ago. This is the package itself, not its dependencies.