Skills/PyPI/rayonne-mcp

rayonne-mcp@0.13.2

CAUTION· not started

Publisher claims: "Rayonne MCP server — pilote un ou tous les espaces d'une organisation Rayonne (audit marketing, analyse produit, contenus, vidéos, métriques AARRR) depuis tout agent compatible MCP." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher sponge-theory-contact · publishing for 0 daysInstalls 1,089Last detonated 29 min ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
RAYONNE_API_KEYRAYONNE_CREDENTIALS_FILERAYONNE_PLUGIN_API_KEYUV_PUBLISH_TOKENConfiguration, not credentials: CLAUDE_CONFIG_DIR, CLAUDE_SECURESTORAGE_CONFIG_DIR, RAYONNE_API_URL, RAYONNE_READ_ONLY
Where it talks to
no vendor host named in the codeAlso sponge-theory.dev — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names sponge-theory.dev as well as its own vendor. The guard injects RAYONNE_API_KEY, RAYONNE_CREDENTIALS_FILE, RAYONNE_PLUGIN_API_KEY, UV_PUBLISH_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx rayonne-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-15 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Prompting user to enter sensitive credentials; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.3sprocessdependency install exit 1 ·
0.3sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.3sprocessscript backend runs setup only
0.3sprocessno install scripts to re-run

Static findings

CRITICAL
Prompting user to enter sensitive credentialsrayonne-codex/scripts/connection.py:49 · Prompting user to enter sensitive credentials — social engineeringraise SetupError("Enter the API key without spaces or the Bearer prefix")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Process kill commandsrc/rayonne_mcp/server.py:1026 · Process kill command — agent can terminate processes"""Keep, kill or extend an experiment whose end date passed — confirmingFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Stripe-like API key pattern detectedtests/test_credentials.py:111 · Stripe-like API key pattern detected — possible hardcoded or harvested keymonkeypatch.setattr("sys.stdin", io.StringIO("sk_live_not_rayonne"))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathssrc/rayonne_mcp/server.py:481 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesbrief's facts cite. Secrets files (.env, keys, credentials) are refusedFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsrayonne-codex/skills/rayonne-from-code/SKILL.md:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- **Jamais de secret ni de donnée client.** Ne lis pas `.env`, les clés, lesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandsrc/rayonne_mcp/server.py:64 · Process kill command — agent can terminate processesdecide_experiment (keep / kill / extend at the end date)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandbuild/publish_pypi.sh:10 · File permission modification command — agent changes file ownership/permissions# 2. ~/.pypirc [pypi] password (the global PyPI token, chmod 600)Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
URL with embedded credentialstests/test_codex_adapter.py:72 · URL with embedded credentials — may be phishing or credential leaking@pytest.mark.parametrize('url', ['http://example.com', 'https://user:[email protected]',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Process kill commandsrc/rayonne_mcp/server.py:1007 · Process kill command — agent can terminate processesthen gives the keep / kill / extend recommendation. Ask the founder forFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/rayonne_mcp/cli.py:60 · Python subprocess execution detectedreturn subprocess.run(cmd, capture_output=True, text=True, check=False).stdoutFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/rayonne_mcp/cli.py:71 · Python subprocess execution detectedout = subprocess.run(["osascript", "-e", script], capture_output=True, text=True, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandsrc/rayonne_mcp/server.py:1032 · Process kill command — agent can terminate processescontent_marketing, geo); past that, too little volume is a « kill »."""Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedrayonne-codex/scripts/native_keychain.py:65 · Python subprocess execution detectedresult = subprocess.run(command, input=json.dumps(request), capture_output=True,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandsrc/rayonne_mcp/server.py:909 · Process kill command — agent can terminate processes`recommendation` keep / kill / extend waiting for the founder."""Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsclaude_code_plugin/commands/rayonne-from-code.md:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- **Jamais de secret ni de donnée client.** Ne lis pas `.env`, les clés, lesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedrayonne-codex/scripts/configure.py:23 · Python subprocess execution detectedresult = subprocess.run(["/usr/bin/osascript", "-e", script, prompt, default], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathssrc/rayonne_mcp/client.py:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesr"^(\.env(\.[\w.-]+)?|\.npmrc|\.pypirc|\.netrc|id_(rsa|dsa|ecdsa|ed25519)"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsclaude_code_plugin/commands/rayonne-setup.md:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesdans un dépôt, un `.env` ou un fichier versionné. Ne demande JAMAIS laFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedbuild/build_codex_plugin.py:11 · Python subprocess execution detectedsubprocess.run([sys.executable, str(mcp / 'build/sync_codex_skills.py'), '--check'], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_source_documents.py:37 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files@pytest.mark.parametrize("name", [".env", ".env.production", "server.pem", "id_rsa", "credentials.json"])Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈12,595 tok
12 files · 75 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Not checked against OSV yet; the weekly check has not reached this version.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Prompting user to enter sensitive credentials≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. Unclaimed publisher≈ +8 on the totalClaim sponge-theory-contact: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Stripe-like API key pattern detected≈ +2 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim sponge-theory-contactPropose a patch to the maintainer