MCP server · Org-owned · Audited from source
skybridge MCP server
by alpic-ai/skybridgeMIT licenceAudited 23 Oct 2026 · source 405a3e467ac0
npm @skybridge/vite-pluginstreamable-http★ 2,172
Is it safe? No — BLOCK, grade D (69/100). It exposes 80 tools: 69 read, 9 write and 2 destructive. The audit recorded 34 findings (0 critical, 1 high, 5 medium, 25 low). Maintainer's description: Skybridge is a full-stack TypeScript framework for MCP Apps and ChatGPT Apps. Type-safe. React-powered. Platform-agnostic.
Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
Cite
Cite this page
ModelsAtlas. “skybridge MCP server (alpic-ai/skybridge)”. Retrieved 23 Oct 2026. https://modelsatlas.com/mcp/alpic-ai/skybridge
Why this is BLOCK. The audit found 0 critical and 1 high findings; the most severe is Prompt injection at skills/chatgpt-app-builder/references/ecommerce.md:260. Each finding is listed below with its file and line.
Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.
Trust audit
Audit 0.4.1 · full source read 23 Oct 2026
Trust score69/100✕BLOCK D
0 critical1 high5 medium25 low3 info
34 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.
What the source does
- FilesystemDeclared4 observations
- NetworkDeclared2 observations
- ShellDeclared3 observations
- DependenciesNot pinnedSome ranges float
- SecretsNone foundNo keys in source
Findings (34)
Sorted by severity · the 25 most severe of 34 are listed
HIGHPrompt injectionprompt.hide_from_user · skills/chatgpt-app-builder/references/ecommerce.md:260
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
The view layer under `src/components/` and `src/views/`, built on the design system. Preview any component in Ladle (`{pm} run ladle`; each `*.stories.tsx` is a story); the devtools emulator shows a v- Why
- asks the agent to act without the user's knowledge
- Fix
- —
MEDIUMInventory / provenanceinv.symlink · skills/mcp-app-builder/references
F-13 Inventory / provenanceCWE-1104Layer L0
skills/mcp-app-builder/references
- Why
- link not followed
- Fix
- —
MEDIUMInventory / provenanceinv.symlink · skills/skybridge/references
F-13 Inventory / provenanceCWE-1104Layer L0
skills/skybridge/references
- Why
- link not followed
- Fix
- —
MEDIUMNetwork egressnet.beacon_words · packages/devtools/src/components/layout/toolbar-actions.tsx:227
F-04 Network egressCWE-200 · CWE-319Layer L1
`https://app.alpic.ai/beacon?url=${encodeURIComponent(`${tunnelUrl}/mcp`)}`- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMObfuscation / stealthobf.zero_width · packages/core/src/server/skills.ts:51
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
const FRONTMATTER_RE = /^?\s*---[ \t]*\r?\n([\s\S]*?)\r?\n---[ \t]*(?:\r?\n|$)/;
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMFilesystem / pathmcp.destructive_tools
F-05 Filesystem / pathCWE-22 · CWE-59Layer L3
clear-cart, delete_trip
- Why
- 2 tool(s) can delete or overwrite
- Fix
- prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenanceinv.symlink · CLAUDE.md
F-13 Inventory / provenanceCWE-1104Layer L0
CLAUDE.md
- Why
- link not followed
- Fix
- —
LOWInsecure cryptocrypto.weak_hash · examples/productivity/src/server.ts:14
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
const hash = createHash("md5").update(`${seed}-${day}-${type}`).digest();- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · .github/workflows/publish.yml:96
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
run: ../../scripts/publish-if-new.sh ${{ steps.version.outputs.tag }}- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · .github/workflows/publish.yml:100
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
run: ../../scripts/publish-if-new.sh ${{ steps.version.outputs.tag }}- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · .github/workflows/publish.yml:104
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
run: ../../scripts/publish-if-new.sh ${{ steps.version.outputs.tag }}- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · .github/workflows/publish.yml:108
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
run: ../../scripts/publish-if-new.sh ${{ steps.version.outputs.tag }}- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · .github/workflows/publish.yml:138
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
run: ../../scripts/publish-if-new.sh ${{ steps.version.outputs.tag }}- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · e2e/conformance/notte/conformance.py:369
F-04 Network egressCWE-200 · CWE-319Layer L1
url = f"http://127.0.0.1:{port}"- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · packages/core/src/cli/tunnel-control-server.test.ts:18
F-04 Network egressCWE-200 · CWE-319Layer L1
`http://127.0.0.1:${control.port}/__skybridge/tunnel/events`,- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · packages/core/src/cli/tunnel-control-server.test.ts:45
F-04 Network egressCWE-200 · CWE-319Layer L1
fetch(`http://127.0.0.1:${control.port}/__skybridge/tunnel/events`),- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · packages/core/src/server/events.test.ts:39
F-04 Network egressCWE-200 · CWE-319Layer L1
return { url: `http://127.0.0.1:${port}/hooks`, received, server, state };- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · packages/core/src/server/events.test.ts:207
F-04 Network egressCWE-200 · CWE-319Layer L1
url: `https://127.0.0.1:${privatePort}/hooks`,- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.base64_blob · docs/test/devtools.mdx:106
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
[](https://cursor.com/en/install-mcp?name=chrome-devtools&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsImNocm9tZS1kZXZ0b29scy1tY3BAb
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWObfuscation / stealthobf.zero_width · examples/supabase-triplog/src/constants.ts:22
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
family: { label: "Family", icon: "👨👩👧" },- Why
- No further detail recorded for this rule.
- Fix
- —
LOWSupply chainsupply.unpinned · docs/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
mintlify
- Why
- 1 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · e2e/conformance/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@alpic-ai/ui, @modelcontextprotocol/sdk, lucide-react, react, react-dom, skybridge, tw-animate-css, vite
- Why
- 18 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
LOWSupply chainsupply.unpinned · examples/auth-auth0/package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
@alpic-ai/insights, dotenv, react, react-dom, skybridge, vite, zod, @skybridge/devtools
- Why
- 18 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
Tools it exposes
80 declared in source · 2 destructive
69 read9 write2 destructive
2 tools can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.
| Tool | What it does | Risk |
|---|---|---|
clear-cart | Empty the user | destructive |
delete_trip | Delete a trip from the log by its ID. Get the ID from a prior browse-trips call. | destructive |
checkout | Place an order. Requires sign-in with the | write |
chess_make_move | Play a move | write |
create-checkout | Start a checkout for one product. The user must be signed in. | write |
create_trip | Add a new trip to the personal trip log. Use this when the user wants to log a trip. Infer country from place if not explicitly provided. Date defaults to today if not mentioned. | write |
guess | Submit your guess for the secret word based on the user | write |
murder-in-the-valley | Use this tool to start a game of murder in the valley. | write |
start | Start | write |
start_game | Open an interactive chess board. The user first picks a side (White or Black) in the view; you play the other color. If they pick Black, you are White and move first. Drive your side with the tools the view exposes — | write |
update_trip | Update one or more fields of an existing trip. Requires the trip ID — get it from a prior browse-trips call. Only pass the fields the user wants to change; everything else stays untouched. | write |
Trip | A great trip | read |
a-tool | d | read |
app-only-tool | Only the widget can call this tool | read |
array-content | Test tool | read |
browse-catalog | Browse the public coffee catalog. Works signed out, and greets you by name when a token is present. | read |
browse-trips | Browse the personal trip log. Always call this tool EXACTLY ONCE — it loads all trips and the UI handles all filtering. Never call it multiple times for different statuses or categories. Pass status and/or category arrays to pre-select the relevant filters in the UI (e.g. status=[ | read |
calculate-price | Calculate trip price | read |
conformance | Render the Skybridge hooks conformance runner. It steps through every web hook and reports whether the current host supports it. | read |
csp-tool | Test tool | read |
demo | A demo skill | read |
dual-visibility-tool | Both the agent and the widget can call this tool | read |
echo | Echo back the input message | read |
echo-card | Echo back the input message and render it in a widget | read |
echo-url | Echoes the request URL. | read |
every-input-type | Exercises every common input type the form renderer handles. | read |
explore-capitals | Use this tool to explore world capitals. Displays an interactive map with detailed information about capital cities including population, currencies, and beautiful photos. Always use it when users ask about capitals, countries, or want to explore geography. | read |
flight-booking | Search and display available flights between two airports with pricing and schedule details. | read |
flip-coin | Flips a coin and checks if the user | read |
folder-view | Second tool | read |
get-fortune-cookie | Get fortune cookie | read |
get-openui-prompt | Returns the OpenUI Lang component prompt and an example program. Call this before render to learn the available components and syntax. | read |
get-trip-details | Get trip details | read |
get-ui-catalog | Returns the full UI component catalog. Call this before render to learn available components, their props, and the spec format. | read |
git-workflow | Team git conventions | read |
greet | greet | read |
hello-world | A hero widget with customizable title and subtitle. | read |
hints | Reads client hints. | read |
inferred-output-view | View with output inferred from callback | read |
inferred-tool | Tool with output inferred from callback | read |
inspect-file | Read a file the user uploaded and echo it back as a downloadable reference. | read |
large-output | Test tool | read |
library | library | read |
meta-tool | Test tool | read |
model-only-tool | Only the agent can call this tool | read |
my-view | Test tool | read |
no-input | no-input | read |
no-input-view | View with no input | read |
override-tool | Test tool | read |
pick-part | Asks the user to pick a part through a form | read |
plain-tool | No view | read |
play | Draws a new card containing the secret word that only the user can see. The user will give hints based on that word, and you will try to guess it. | read |
private-whoami | Private. | read |
product-details | Get the full details of one product by its id. Call search-products first to find the id. | read |
public-whoami | Public. | read |
refunds | Process refunds | read |
render | Render a dynamic UI from a json-render spec. Call get-ui-catalog first to learn available components and the spec format. | read |
scalar | Returns a scalar structuredContent. | read |
search | search | read |
search-coffee-paris | Search for coffee shops in Paris. Shows personalized results with your favorites highlighted and sorted first. Requires authentication. | read |
search-products | Search the ski shop catalog by category. Use this whenever the user asks what is available, what you sell, or looks for a kind of gear. Categories are | read |
search-trip | Search for trips | read |
shake | First tool | read |
shake-v2 | Second tool | read |
show | show | read |
show-everything | A simple greeting tool | read |
show-productivity-insights | Display user | read |
single-block | Test tool | read |
slow | slow | read |
string-content | Test tool | read |
t1 | t1 | read |
tool-with-metadata | Tool that returns response metadata | read |
undeclared-whoami | Registered without auth or securitySchemes. | read |
unknown-view | Test tool | read |
view-with-metadata | View that returns response metadata | read |
view-with-mixed-returns | View with mixed return paths (some with _meta, some without) | read |
whoami | Return the signed-in user. No auth declared, so it falls back to the secure default (sign-in required). | read |
withSchema | withSchema | read |
withoutSchema | withoutSchema | read |
zip-file | Compress one file into a downloadable .zip archive. Call without a file to open the picker widget. | read |
Safer alternatives
chrome-devtools-mcp✓SAFE
ChromeDevTools/chrome-devtools-mcp
Chrome DevTools for coding agents
2 destructiveGrade B
Chrome DevTools✓SAFE
chromedevtools/chrome-devtools-mcp
Chrome DevTools for coding agents
2 destructiveGrade B
Portview✓SAFE
mapika/portview
List ports and their processes on Linux, macOS, and Windows.
Grade B
Audit history
- ✕BLOCK D 69 / 100
First audit ·
405a3e467ac0
README badge
Badges show the current verdict, BLOCK included
A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.
Questions about skybridge MCP server
What is the skybridge MCP server?
Skybridge is a full-stack TypeScript framework for MCP Apps and ChatGPT Apps. Type-safe. React-powered. Platform-agnostic.
What tools does skybridge expose?
80 in total: 69 read-only, 9 that write, and 2 that can delete or overwrite (clear-cart, delete_trip). Every one is listed on this page with its risk.
Is skybridge safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does skybridge need?
It reads GITHUB_TOKEN, MEDUSA_PUBLISHABLE_KEY, NOTTE_API_KEY, SHOPIFY_STOREFRONT_TOKEN and TYPESAFE_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does skybridge run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as @skybridge/vite-plugin at 0.0.0.
How current is this page?
The grade is for one exact copy of the source (405a3e467ac0), read on 2026-10-23. The repository is watched and re-audited when it changes.
I already installed skybridge. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.
Sources
- alpic-ai/skybridge on GitHub — the source we read, its licence, stars and activityObserved · 23 Oct 2026
- ModelsAtlas trust audit — BLOCK verdict for commit 405a3e467ac0Observed · 23 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What is the skybridge MCP server?
- What tools does skybridge expose?
- Is skybridge safe to connect to an agent?