云效 DevOps MCP

• Risk level: Low
• Analyzed: Mar 31, 2026, 9:45 AM
• Findings: 0
• Version: 1.2.1

Overview

The skill's code, docs, and runtime instructions are consistent with a local MCP SSE client for 阿里云 云效 DevOps; it does not request unrelated credentials or contain surprising behavior, though deploying the companion MCP Server does require Alibaba Cloud credentials and must be done manually as documented.

This skill appears to be a local MCP SSE client and is internally consistent. Before installing or running it: - Do not hand your Alibaba Cloud RAM AccessKey/Secret to the agent; if you deploy the MCP Server (DEPLOY.md), follow the doc and perform deployment manually. The server Docker image will require those credentials. - Review and verify the Docker image source (build-steps-public-registry.cn-beijing...) before running it. - npm install will fetch a public dependency (eventsource-parser); run installs in a controlled environment and review dependencies if you have strict supply-chain requirements. - The client talks to a user-configurable baseUrl (defaults to localhost:3000). Ensure you only point it at a server you trust. If you want higher assurance, ask for: the publisher identity, a signed release or official upstream repo, and an audit of the Docker image used by the MCP Server.