ModelsAtlas
Explore
Atlas / MCP servers / helv-io / skgate

skgateBLOCK

mcp/helv-io/skgate
MCP server by helv-io · docker · grok · homelab · Audited 2026-10-11
⚑ Report / re-scanSource ↗

Any MCP server. Anywhere. An OAuth-protected MCP gateway that can also run the servers, plus SI provider proxying with model aliases, and your Grok subscription as an OpenAI-compatible API with no API key.

Verdict
BLOCK
Grade
F
Trust score
59 /100
Exposed tools
1 1r · 0w · 0d
Transport
streamable-http
License
MIT
Stars
9
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

skgate

Serve your MCP servers and REST APIs from one OAuth-protected gateway. Also proxy your SI providers behind one address with model aliases, and use your Grok subscription as an OpenAI-compatible API, no API key needed.

Any MCP server. skgate can run them for you, so you do not need one container per server.

[](https://m8ven.ai/mcp/helv-io-skgate-k7i5y4?s=readme)

[](https://youtu.be/57oxqkjzb4w)

Name Origin

skgate /ɛsˈkɑːɡeɪt/ (ess-KAH-gate)

"sk" is how a lot of SI API keys start, and "gate" is for gateway. Not a great name, but it's ours.

The plane in the logo is an inside joke. The public wouldn't understand it, and I'm not about to explain it. Sorry.

Quality

Is it good?

Yes

Quick start

You need an OIDC provider with a confidential client for skgate. Admin login is OIDC only. Trying it on one machine? docs/quickstart.md runs skgate with a bundled provider and no accounts.

# docker-compose.yml
services:
skgate:
container_name: skgate
image: ghcr.io/helv-io/skgate:latest
restart: always
ports:
- 8080:8080
environment:
- PUBLIC_URL=https://skgate.example.com
- OIDC_ISSUER=https://auth.example.com
- OIDC_CLIENT_ID=skgate
- OIDC_CLIENT_SECRET=change-me
volumes:
- ./data:/data
healthcheck:
test: ["CMD", "/skgate", "healthcheck"]
interval: 30s
timeout: 5s
retries: 3
  1. docker compose up -d
  2. Open https://skgate.example.com/admin and sign in through your OIDC provider.
  3. mcp upstreams > Add upstream: a remote MCP server, or a GitHub re
Read from source at commit 2fcb1efc6639OBSERVED · 2026-10-11
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (oci)
claude mcp add skgate:0.24.2 --env OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET} --env OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET} -- docker run -i --rm ghcr.io/helv-io/skgate:0.24.2:None
claude-code (oci)
claude mcp add skgate:0.24.2-slim --env OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET} --env OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET} -- docker run -i --rm ghcr.io/helv-io/skgate:0.24.2-slim:None
03

Exposed tools (1)

1 read · 0 write · 0 destructive.

ToolRiskDescription
THING_KEYreadk
04

Trust audit

BLOCKgrade F · trust 59/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (6 observation(s))
Network
declared (6 observation(s))
Shell
declared (4 observation(s))
Dependencies
pinned
Secrets in source
none-found

Findings (22)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
internal/app/testdata/codebox.js:35
const set = (sel, v) => pg.$eval(sel, (e, v) => { e.value = v; e.dispatchEvent(new Event("input", { bubbles: true })); }, v);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
internal/app/testdata/codebox.js:75
await pg.$eval(J, e => { e.value = '{"a": "' + "y".repeat(250000) + '"}'; e.dispatchEvent(new Event("input", { bubbles: true })); });
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
internal/app/testdata/inplace.js:109
const before = await pg.$eval(en, b => b.getAttribute("aria-checked"));
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
internal/app/testdata/inplace.js:117
let st = await pg.$eval(en, b => ({ c: b.getAttribute("aria-checked"), t: b.textContent }));
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
MEDIUMNetwork egress · net.beacon_words · CWE-200, CWE-319
tools/changelog/main.go:66
securityRE = regexp.MustCompile(`(?i)\b(vulnerab\w*|cve-\d+|go-\d{4}-\d+|harden\w*|ssrf|xss|csrf|injection|leak\w*|exfiltrat\w*|security (fix|issue|hole))\b`)
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
internal/app/codebox_test.go:41
for _, bad := range []string{"fetch(", "XMLHttpRequest", "importScripts", "eval(", "new Function(", "https://cdn", "unpkg.com", "jsdelivr"} {
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
internal/app/mcp_sso_test.go:269
"/admin/oidc/callback", "/admin/logout", "/v1/models", "/authorize/../../x", "\\\\evil.example", "/%0d%0aX: y",
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
internal/mcp/cimd_flow_test.go:234
for _, id := range []string{"https://localhost:" + u.Port() + "/client.json", "https://[::1]:" + u.Port() + "/client.json", "https://169.254.169.254/latest/client.json", "https://10.0.0.1/client.json"
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
internal/mcp/cimd_test.go:37
"127.0.0.1", "127.1.2.3", "10.0.0.1", "172.16.0.1", "172.31.255.255", "192.168.1.1", "169.254.169.254", "0.0.0.0", "100.64.0.1", "100.127.255.255",
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
internal/mcp/cimd_test.go:40
"::ffff:127.0.0.1", "::ffff:10.1.2.3", "::ffff:169.254.169.254", "100::1",
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
internal/mcp/cimd_test.go:75
"metadata": {"169.254.169.254"},
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.metadata_ip · CWE-200, CWE-319
internal/mcp/cimd_test.go:92
for _, a := range []string{"127.0.0.1:443", "[::1]:443", "10.0.0.1:80", "169.254.169.254:80"} {
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
internal/app/focus_test.go:26
br.post("/admin/upstreams/save", url.Values{"csrf": {csrf}, "mode": {"new"}, "kind": {"remote"}, "alias": {"plain"}, "url": {"http://127.0.0.1:1/mcp"}, "auth_kind": {"none"}, "enabled": {"1"}})
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
internal/app/inplace_test.go:19
if err := a.MCP.Upstreams.Create(mcp.Upstream{Alias: fmt.Sprintf("u%02d", i), URL: "http://127.0.0.1:1/mcp", AuthKind: mcp.AuthNone, Enabled: true}); err != nil {
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
internal/app/layout_test.go:62
br.post("/admin/upstreams/save", url.Values{"csrf": {csrf}, "mode": {"new"}, "kind": {"remote"}, "alias": {"r"}, "url": {"http://127.0.0.1:1/mcp"},
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
internal/app/layout_test.go:94
br.post("/admin/upstreams/save", url.Values{"csrf": {csrf}, "mode": {"new"}, "kind": {"remote"}, "alias": {"docs"}, "url": {"http://127.0.0.1:1/mcp"},
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
internal/app/managed_admin_test.go:436
form := url.Values{"csrf": {csrf}, "mode": {"new"}, "kind": {"remote"}, "alias": {"r"}, "url": {"http://127.0.0.1:1/mcp"}, "auth_kind": {"header"},
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
AGENT.md:36
- No page is rendered by a POST. Screens are GET and can be refreshed; a change is a POST that answers 303 to a screen, or JSON when the page script posts it in place. What a change has to show once (
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
AGENT.md:81
- **It just works: spec and auth probing.** The person gives an address and a key; skgate works out the rest and shows none of it. `openapi.Discover` (the one list `SpecPaths`, plus the documentation
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
docs/keys-and-clients.md:55
Discovery: `PUBLIC_URL/.well-known/oauth-authorization-server`. It names `revocation_endpoint` (`POST /revoke`, RFC 7009): the client authenticates as at `/token` and sends `token`. An unknown token i
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
docs/oidc.md:7
skgate authenticates at the token endpoint with `client_secret_basic` or `client_secret_post`, whichever the provider's discovery lists (basic first), and retries once with post if basic is refused.
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
INFOPrompt injection · prompt.credential_read · CWE-94, CWE-1427
internal/admin/templates/upstream_form.html:14
{{if or .New (eq .U.Kind "git")}}<div class="field" data-show-for="git"><label>Access token<input type="password" name="git_token" placeholder="{{if .TokenMasked}}{{.TokenMasked}}{{else}}Private repos
Why it matters. asks the agent to read credentials

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 2fcb1efc6639full audit observations/trust-audit/mcp-server/helv-io__skgate.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-112fcb1efc6639BLOCKF59first audit
06

Questions

What is the skgate MCP server?

Any MCP server. Anywhere. An OAuth-protected MCP gateway that can also run the servers, plus SI provider proxying with model aliases, and your Grok subscription as an OpenAI-compatible API with no API key.

What tools does skgate expose?

1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is skgate safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (59/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does skgate need?

It reads OIDC_CLIENT_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does skgate run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as skgate-codemirror-bundle at 1.0.0.

How current is this page?

The grade is for one exact copy of the source (2fcb1efc6639), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement