Verdict

No malicious behavior observed

We ran it 4 times, with a normal setup, the clock moved a year ahead, a GitHub Actions environment and an AI agent using it. It contacted example.com and raw.githubusercontent.com. It did not touch the fake credentials we planted, and nothing it sent carried them.

3 findings. Scanned 25 Oct 2026 by detonator 0.5.1.

Target: @modelcontextprotocol/server-everything
Source: npm 1.0.0
SHA-256: 564b83331f296eac
Files: 49

RecommendationNo action needed

Nothing observed calls for action. This is evidence, not a guarantee.

Findings

F01 Low

Network destinations contacted

Confidence: Info The package connected to these hosts.
Observed in: mcp:baseline, mcp-agent:agent

Description

Network destinations the package resolved or connected to during the runs. All traffic was captured by the sandbox; nothing reached the internet.

Impact

Context only. Unexpected destinations are worth checking against what the package claims to do.

Evidence

example.com

raw.githubusercontent.com

Remediation

Confirm each host is expected (the package's API, its registry). Allowlist expected egress in production.

F02 Low

A tool read its own credentials (e.g. gh, aws, ssh)

Confidence: Info A tool opened its own login or config file, such as npm reading ~/.npmrc.
Observed in: mcp:baseline

Description

A tool opened its own configuration or login file, such as npm reading ~/.npmrc or gh reading its hosts file.

Impact

None in itself: this is how those tools work. Listed so the report shows every credential access.

Evidence

~/.npmrc (by npm)

Remediation

No action needed.

Exploration log

4 runs

mcp:baseline ok · 38.1s

new behavior: dns:example.com, dns:raw.githubusercontent.com, ownread:~/.npmrc, write:<skill>/node_modules/.bin/mcp-server-everything · install scripts: exit 0; 52 tool calls
mcp:time-travel ok · 13.7s

no new behavior · install scripts: exit 0; 52 tool calls
mcp:ci-github ok · 38.2s

no new behavior · install scripts: exit 0; 52 tool calls
mcp-agent:agent ok · 18.9s

no new behavior · install scripts: exit 0

$ server_everything__echo({"message": "Hello from the MCP everything server test run!"}) $ server_everything__get-annotated-message({"messageType": "success", "includeImage": true}) $ server_everything__get-env({}) $ server_everything__get-resource-links({"count": 5}) $ server_everything__get-resource-reference({"resourceType": "Text", "resourceId": 2}) $ server_everything__get-structured-content({"location": "Chicago"}) $ server_everything__get-sum({"a": 42, "b": 58}) $ server_everything__get-tiny-image({}) $ server_everything__gzip-file-as-resource({"name": "README.md.gz", "data": "https://raw.githubusercontent.com/modelcontextprotocol/servers/refs/heads/main/README.) $ server_everything__toggle-simulated-logging({}) model said: I called every tool on the `server_everything` server once. Here's what each returned: | Tool | Sample input | Result | |---|---|---| | `echo` | "Hello from the MCP everything server test run!" | Echoed the message back verbatim. | | `get-annotated-message` | `messageType: success`, `includeImage: true` | Returned "Operation completed successfully" (annotated content; the image wasn't surfaced in

mcp: coverage plateau (2 runs with no new behavior); agent: variants exhausted

Note

Observed behavior only. A clean result does not prove a package is safe. Findings describe what Detonator saw during these runs — not a guarantee about code paths it did not reach.