Snipara Mcp

• Analyzed: May 12, 2026, 3:09 AM
• Findings: 1
• Version: 0.1.0
• Hash: 88f45208de59dfd9cdd3fa984acf34f02d759fd051e1e45ca029fb7088eef56b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides tools for documentation search and AI agent coordination via the Snipara API. The `skill.md` instructions clearly define tool usage without attempting prompt injection or instructing the agent to perform malicious actions. The Python code handles authentication by reading `SNIPARA_API_KEY` and `SNIPARA_PROJECT_ID` from environment variables and securely storing OAuth tokens in `~/.snipara/tokens.json` with appropriate permissions. All network calls are directed to `snipara.com` for legitimate API interactions. The `rlm_read` tool, despite its name, is implemented as an API call to read indexed documentation on the Snipara platform, not arbitrary local files. No evidence of data exfiltration, malicious execution, persistence, or obfuscation was found.