quicklab-mcp@0.2.1

CAUTION

Publisher claims: "QuickLab MCP Server - Production Tabular ML Experimentation Control Plane for AI Agents" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher aldrin-joan · joined 0 days agoInstalls 0Last detonated 1 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.2sprocessdependency install exit 1

0.2sprocessexec /usr/bin/timeout

0.2sprocessexec .venv/bin/quicklab

0.2sprocessexited 127: timeout: failed to run command '.venv/bin/quicklab': No such file or directory

0.2sclaimedno tools/list reply (exit 127)

0.2sprocessscript backend runs setup only

Static findings

CRITICAL

Destructive file system command detectedREADME.md:313 · Destructive file system command detected

AST05

HIGH

Outbound HTTP to raw IP addressREADME.md:238 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

URL using raw IP addresssrc/QuickLab_MCP.egg-info/PKG-INFO:290 · URL using raw IP address — may bypass domain-based filtering

AST07

CRITICAL

Credential pass-through configurationsrc/ml_mcp/server/http.py:37 · Credential pass-through configuration — agent relays sensitive credentials

AST02

HIGH

Outbound HTTP to raw IP addresssrc/QuickLab_MCP.egg-info/PKG-INFO:290 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

CRITICAL

Access to sensitive file pathssrc/ml_mcp/config/settings.py:182 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathssrc/ml_mcp/config/settings.py:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

MEDIUM

URL using raw IP addresssrc/QuickLab_MCP.egg-info/PKG-INFO:291 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addresssrc/QuickLab_MCP.egg-info/PKG-INFO:289 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressREADME.md:236 · URL using raw IP address — may bypass domain-based filtering

AST07

CRITICAL

Destructive file system command detectedsrc/QuickLab_MCP.egg-info/PKG-INFO:366 · Destructive file system command detected

AST05

HIGH

Outbound HTTP to raw IP addressREADME.md:236 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Outbound HTTP to raw IP addressREADME.md:237 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

CRITICAL

Access to sensitive file pathssrc/ml_mcp/config/settings.py:164 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Outbound HTTP to raw IP addresssrc/QuickLab_MCP.egg-info/PKG-INFO:289 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

CRITICAL

Access to sensitive file pathssrc/ml_mcp/server/app.py:136 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

MEDIUM

URL using raw IP addressREADME.md:237 · URL using raw IP address — may bypass domain-based filtering

AST07

HIGH

Outbound HTTP to raw IP addresssrc/QuickLab_MCP.egg-info/PKG-INFO:291 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

URL using raw IP addressREADME.md:238 · URL using raw IP address — may bypass domain-based filtering

AST07