refs-mcp@0.2.2
CAUTION· not startedPublisher claims: "FastMCP server for managing the refs/ reference-repo tree" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
- no credential variables read in the code
- Where it talks to
- no vendor host named in the codeAlso microsoft.com, astral.sh, docker.com, freedesktop.org — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it under the guard. Not started: dependency install failed; the server itself was not observed. The code names no credential variable; the guard pins the network to what the honeypot saw and logs every call.
$vet-skills run --net declared -- uvx refs-mcp
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-15 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Destructive file system command detected. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.2sprocessdependency install exit 1 ·
0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run
Static findings
HIGH
Access to sensitive file pathsrefs_mcp/path_safety.py:105 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05must defend against ``../../etc/passwd`` traversal even though weFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedrefs_mcp/git_runner.py:170 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedrefs_mcp/operations.py:84 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathsrefs_mcp/path_safety.py:149 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# ``"/etc/passwd"`` PurePosixPath anchor="/" on every hostFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedrefs_mcp/runner.py:122 · Python subprocess execution detected
AST05completed = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedrefs_mcp/search.py:310 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Destructive file system command detectedrefs_mcp/_link.py:58 · Destructive file system command detected
AST05NOT a reference. Downstream rm / mutationFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandrefs_mcp/cli.py:365 · Process kill command — agent can terminate processes
AST05kill switch.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
URL with embedded credentialsrefs_mcp/discovery.py:107 · URL with embedded credentials — may be phishing or credential leaking
AST07contain ``%`` (URL-encoded credentials, e.g. ``https://user:pass%40@…``,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedrefs_mcp/server.py:216 · Python subprocess execution detected
AST05# --- Absolute-path discipline for subprocess.run(rg) ----------------Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedrefs_mcp/gh_runner.py:121 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedrefs_mcp/run_metadata.py:332 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathsrefs_mcp/operations.py:428 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# dependent (``Path("/etc/passwd").is_absolute()`` is FalseFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Remote installer piped to shellrefs_mcp/host_tools.py:497 · Remote installer piped to shell
AST07" `curl -LsSf https://astral.sh/uv/install.sh | sh`."Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedrefs_mcp/git_runner.py:157 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.CRITICAL
Pipe-to-shell patternrefs_mcp/host_tools.py:497 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06" `curl -LsSf https://astral.sh/uv/install.sh | sh`."Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedrefs_mcp/host_tools.py:658 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_search.py:302 · Python subprocess execution detected
AST05so a later ``subprocess.run(..., cwd=other)`` swap can't silentlyFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathsrefs_mcp/path_safety.py:118 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* POSIX absolute — ``/etc/passwd``Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
URL with embedded credentialstests/test_discovery.py:84 · URL with embedded credentials — may be phishing or credential leaking
AST07"\turl = https://user:p%[email protected]/owner/bad-pct.git\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedrefs_mcp/gh_runner.py:87 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedrefs_mcp/_link.py:188 · Python subprocess execution detected
AST05proc = subprocess.run( # noqa: S603 - argv-list, hardened, no shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Instructions loaded
≈49 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
Not checked against OSV yet; the weekly check has not reached this version.
What would make this Verified
10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- Unclaimed publisher≈ +8 on the totalClaim pypi: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim pypiPropose a patch to the maintainer