rasmio-mcp@0.2.0
VERIFIED· not startedPublisher claims: "Unofficial read-only MCP server for Rasmio (rasmio.com), Iran's company registry: companies, board members, official gazette ads, products, brands." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry PyPI (MCP server)Publisher sepehr071 · publishing for 43 daysInstalls 378Last detonated 1 h ago
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
- no credential variables read in the code
- Where it talks to
- rasmio.com (its own)
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it under the guard. Not started: dependency install failed; the server itself was not observed. The code names no credential variable and talks to rasmio.com, its own; the guard pins the network to what the honeypot saw and logs every call.
$vet-skills run --net declared -- uvx rasmio-mcp
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-15 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.2sprocessdependency install exit 1 ·
0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run
Static findings
HIGH
Hidden zero-width characters detectedsrc/rasmio_mcp/common.py:179 · Hidden zero-width characters detected — may conceal content
AST07"نام سهام‌دار": "shareholder",Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/search_companies.json:1 · Hidden zero-width characters detected — may conceal content
AST07…g", "sourceId": 0, "issuerId": 75, "issuer": "دبیرخانه هیأت عالی نظارت بر سازمان‌های صنفی کشور/ اتحادیه صنفی"}, {"id": 7921, "title": "بهره‌برداری تولید نرم افزا…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/company_ikco.html:1 · Hidden zero-width characters detected — may conceal content
AST07…</a><div><button data-testid="categories-dropdown-trigger" type="button"><p>دسته‌بندی</p><span></span></button></div><div><div><div><div><input autocomplete="off…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Dense URL-encoded contenttests/fixtures/search_people.json:1 · Dense URL-encoded content — may be obfuscating payloads
AST07…efaultPerson", "information": "", "id": "2141682894", "link": "/person/7FA77CCE/%D8%AC%D8%B9%D9%81%D8%B1-%D9%85%D9%84%DA%A9-%D9%86%DA%98%D8%A7%D8%AF/", "level": 0, "type": 1, "personSe…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Dense URL-encoded contenttests/fixtures/search_all.json:1 · Dense URL-encoded content — may be obfuscating payloads
AST07…مل: محمدحسین ملک نژاد یزدی", "id": "14009396050", "link": "/company/14009396050/%D9%BE%DB%8C%D8%B4%DA%AF%D8%A7%D9%85%D8%A7%D9%86-%D8%B1%D8%B3%D9%85%DB%8C-%D9%BE%D8%B1%D8%AF%D8%A7%D8%B2%D8%B4-%D8%AF%D8%A7%D9%8…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Hidden zero-width characters detectedtests/fixtures/licenses.json:1 · Hidden zero-width characters detected — may conceal content
AST07[{"fa": "بهره‌برداری واحد تولیدی و صنعتی صنایع پیشرفته و دانش بنیان", "value": "73556", "icon"…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/search_all.json:1 · Hidden zero-width characters detected — may conceal content
AST07…g", "sourceId": 0, "issuerId": 75, "issuer": "دبیرخانه هیأت عالی نظارت بر سازمان‌های صنفی کشور/ اتحادیه صنفی"}, {"id": 7921, "title": "بهره‌برداری تولید نرم افزا…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Dense URL-encoded contenttests/fixtures/company_ikco.html:1 · Dense URL-encoded content — may be obfuscating payloads
AST07…roperty="og:description"/><meta content="https://rasmio.com/company/10100360794/%D8%A7%DB%8C%D8%B1%D8%A7%D9%86%20%D8%AE%D9%88%D8%AF%D8%B1%D9%88/" property="og:url"/><meta content="ایران خودرو" property="og:site_name"/><meta…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Dense URL-encoded contenttests/fixtures/company_limit.html:1 · Dense URL-encoded content — may be obfuscating payloads
AST07…roperty="og:description"/><meta content="https://rasmio.com/company/14007650912/%DA%AF%D8%B1%D9%88%D9%87%20%D8%AA%D8%AC%D8%A7%D8%B1%D8%AA%20%D8%A7%D9%84%DA%A9%D8%AA%D8%B1%D9%88%D9%86%DB%8C%DA%A9%20%D8%AF%DB%8C%D8%AC%DB%8C%20%DA%A9%D8%A7%D9…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Dense URL-encoded contenttests/fixtures/search_products.json:1 · Dense URL-encoded content — may be obfuscating payloads
AST07…oduct", "information": "No Brand", "id": "40879045", "link": "/product/40879045/%D8%B3%D9%86%D8%B3%D9%88%D8%B1%D8%8C-%D9%81%D8%B4%D8%A7%D8%B1-%D8%B1%D9%88%D8%BA%D9%86-%D9%85%D9%88%D8%AA%D9%88%D8%B…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Dense URL-encoded contenttests/fixtures/company_limit.html:2 · Dense URL-encoded content — may be obfuscating payloads
AST07…ین صورت بعد از گذشت 4 روز مجددا تلاش کنید.</p><div><a href="/blog/knowledgebase/%d8%a7%d8%b4%d8%aa%d8%b1%d8%a7%da%a9%d9%87%d8%a7%db%8c-%d8%b1%d8%b3%d9%85%db%8c%d9%88/">مطالعه بیشتر<span></span></a><div><button type…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Hidden zero-width characters detectedtests/fixtures/company_rasmio.html:1 · Hidden zero-width characters detected — may conceal content
AST07…</a><div><button data-testid="categories-dropdown-trigger" type="button"><p>دسته‌بندی</p><span></span></button></div><div><div><div><div><input autocomplete="off…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/trademark.json:1 · Hidden zero-width characters detected — may conceal content
AST07… کنار یک دروازه فانتزی و حرف ر فانتزی شکسته و یک لوزی زیر دروازه به رنگهای سرمه‌ای و زرشکی طبق نمونه", "picture": "https://minio.rasmio.com/ipm/fcec5a7a64824d6e…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Dense URL-encoded contenttests/fixtures/trademark.json:1 · Dense URL-encoded content — may be obfuscating payloads
AST07…697859c3-9b13-4509-92ae-2b171896e7db.png", "relativeUrl": "/company/14009396050/%D9%BE%DB%8C%D8%B4%DA%AF%D8%A7%D9%85%D8%A7%D9%86%20%D8%B1%D8%B3%D9%85%DB%8C%20%D9%BE%D8%B1%D8%AF%D8%A7%D8%B2%D8%B4%20%D8%AF%D8%A7%D9%86%D8%A7/"}], "productCate…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Dense URL-encoded contenttests/fixtures/search_companies.json:1 · Dense URL-encoded content — may be obfuscating payloads
AST07…7db.png", "information": "", "id": "14009396050", "link": "/company/14009396050/%D9%BE%DB%8C%D8%B4%DA%AF%D8%A7%D9%85%D8%A7%D9%86-%D8%B1%D8%B3%D9%85%DB%8C-%D9%BE%D8%B1%D8%AF%D8%A7%D8%B2%D8%B4-%D8%AF%D8%A7%D9%8…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Hidden zero-width characters detectedtests/fixtures/company_limit.html:1 · Hidden zero-width characters detected — may conceal content
AST07…</a><div><button data-testid="categories-dropdown-trigger" type="button"><p>دسته‌بندی</p><span></span></button></div><div><div><div><div><input autocomplete="off…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Hidden zero-width characters detectedtests/fixtures/categories.json:1 · Hidden zero-width characters detected — may conceal content
AST07…یست فروشندگان و واردکنندگان مواد شیمیایی، تجهیزات فلزکاری، محصولات پتروشیمی، رنگهای صنعتی و کانی‌ها دسترسی داشته باشید. بررسی قیمت عمده، مشخصات فنی و ارتباط مست…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Dense URL-encoded contenttests/fixtures/company_rasmio.html:1 · Dense URL-encoded content — may be obfuscating payloads
AST07…roperty="og:description"/><meta content="https://rasmio.com/company/14009396050/%D9%BE%DB%8C%D8%B4%DA%AF%D8%A7%D9%85%D8%A7%D9%86%20%D8%B1%D8%B3%D9%85%DB%8C%20%D9%BE%D8%B1%D8%AF%D8%A7%D8%B2%D8%B4%20%D8%AF%D8%A7%D9%86%D8%A7/" property="og:ur…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.Cost to the agent
Instructions loaded
≈72 tok
1 file · 35 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for rasmio-mcp@0.2.0 as of 55 min ago. This is the package itself, not its dependencies.