Millimetric Mcp Setup

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:23 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward setup guide for connecting agents to Millimetric analytics, with disclosed credentialed access and no hidden execution behavior.

Use a least-privilege read-only key when possible, avoid account-wide keys unless you need multi-project access, do not commit MCP config files containing bearer tokens, and pin or isolate the optional MCP Inspector package before running it on a trusted machine.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:83

Finding

Unpinned Third-Party Package Download and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:83
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Complete Code Snippet:

bash

npx @modelcontextprotocol/inspector

Technical Analysis

The documented command invokes npx without specifying an exact version of @modelcontextprotocol/inspector. If the package is not already available locally, npx can retrieve it from the configured package registry and immediately execute its package entry point with the invoking user's privileges.

Because neither a version nor an integrity hash is pinned, the code executed by users may differ from the code that existed when this Skill was audited. This creates a supply-chain risk if the package, its maintainer account, one of its transitive dependencies, or the configured registry is compromised. It also permits unexpected behavior from an ordinary incompatible or unsafe future release.

Attack Path

1. An attacker compromises the package, a maintainer account, a transitive dependency, or the package source used by the victim's npm configuration.
2. The attacker publishes or serves a modified release containing malicious installation or runtime code.
3. A user follows the Skill documentation and runs npx @modelcontextprotocol/inspector.
4. npx resolves and downloads the unpinned package release.
5. The downloaded package executes with the user's local account permissions.
6. Malicious code can access files, environment variables, credentials, and network resources available to that user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's account. The accessible scope may include project files, user-readable configuration and credential files, environment variables such as MILLIMETRIC_KEY, and network services reachable from the host. It does not inherently grant administrator privileges, but the impact c ...[truncated 77 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to an exact reviewed version, for example:

  bash

  npx --yes @modelcontextprotocol/inspector@<reviewed-exact-version>
  

• Prefer installing the dependency through a project manifest and committing a lockfile with integrity metadata.

• Review the pinned package and its transitive dependency tree before recommending execution.

• Configure npm to use a trusted registry and retain integrity verification.

• Run the inspector as an unprivileged user in an isolated environment with access only to the required files and credentials.

• Avoid exposing production or account-wide keys during interactive testing; use a least-privilege read-only key where possible.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (13)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

Claude Code / Claude Desktop

Edit ~/.claude/config.json (or use the UI):

json

{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: millimetric-mcp-setup
description: Connect AI agents (Claude Code, Claude Desktop, Cursor, MCP Inspector, OpenClaw) to the Millimetric MCP server so they can natively call track_event, query_events, get_stats, top_sources, and compare_projects. Use when the user wants their AI to read or write Millimetric analytics directly.
metadata: { "openclaw": { "requires": { "env": ["MILLIMETRIC_KEY"], "bins": ["curl"] }, "primaryEnv": "MILLIMETRIC_KEY", "emoji": "🧠", "homepage": "https://api.millimetric.ai/mcp" } }
---

# Millimetric MCP Setup

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

---
name: millimetric-mcp-setup
description: Connect AI agents (Claude Code, Claude Desktop, Cursor, MCP Inspector, OpenClaw) to the Millimetric MCP server so they can natively call track_event, query_events, get_stats, top_sources, and compare_projects. Use when the user wants their AI to read or write Millimetric analytics directly.
metadata: { "openclaw": { "requires": { "env": ["MILLIMETRIC_KEY"], "bins": ["curl"] }, "primaryEnv": "MILLIMETRIC_KEY", "emoji": "🧠", "homepage": "https://api.millimetric.ai/mcp" } }
---

# Millimetric MCP Setup

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

---
name: millimetric-mcp-setup
description: Connect AI agents (Claude Code, Claude Desktop, Cursor, MCP Inspector, OpenClaw) to the Millimetric MCP server so they can natively call track_event, query_events, get_stats, top_sources, and compare_projects. Use when the user wants their AI to read or write Millimetric analytics directly.
metadata: { "openclaw": { "requires": { "env": ["MILLIMETRIC_KEY"], "bins": ["curl"] }, "primaryEnv": "MILLIMETRIC_KEY", "emoji": "🧠", "homepage": "https://api.millimetric.ai/mcp" } }
---

# Millimetric MCP Setup

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

The configuration instructs the agent client to automatically attach a bearer token to requests sent to a third-party MCP server. That is the intended integration, but it creates persistent credentialed external access from the local agent, so compromise or misuse of the client/session could expose analytics data or allow event writes depending on key scope.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

{
  "mcpServers": {
    "millimetric": {
      "url": "https://api.millimetric.ai/mcp",
      "transport": "http",
      "headers": {
        "Authorization": "Bearer rk_live_…"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

This Cursor config similarly establishes automatic authenticated communication with an external MCP server. Because the token is embedded in client configuration, any compromise of the local environment or accidental sharing of config files could leak a credential with analytics access.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

{
  "mcpServers": {
    "millimetric": {
      "url": "https://api.millimetric.ai/mcp",
      "transport": "http",
      "headers": { "Authorization": "Bearer rk_live_…" }
    }

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 81% confidence

Finding

The skill instructs users to run npx @modelcontextprotocol/inspector without pinning a version, which causes execution of the latest package from the registry at install time. If the package, a dependency, or the publisher account is compromised, users could execute attacker-controlled code on their workstation during setup.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 77% confidence

Finding

The inspector setup explicitly directs users to connect to an external URL with an Authorization header. This is expected for testing, but it still sends a live credential to a remote service and may expose project analytics in an interactive debugging tool.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

bash

npx @modelcontextprotocol/inspector
# URL:  https://api.millimetric.ai/mcp   (or http://localhost:8787/mcp for local dev)
# Header: Authorization: Bearer rk_live_…

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

This configuration uses an ak_live_… account-wide key against /mcp/account, granting access across all projects visible to the account. In context this is intentional for multi-project use, but the blast radius is substantially larger than single-project read keys, so credential leakage or misuse could expose broad analytics data across an organization.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

{
  "mcpServers": {
    "millimetric-account": {
      "url": "https://api.millimetric.ai/mcp/account",
      "transport": "http",
      "headers": { "Authorization": "Bearer ak_live_…" }
    }

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The URL reference here is part of a concrete authenticated curl example that transmits a bearer token to the external API. The skill context makes this expected rather than deceptive, but it remains a genuine security-sensitive action because it sends secrets and enables access to analytics resources.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

bash

# List available tools
curl -s -X POST https://api.millimetric.ai/mcp \
  -H "Authorization: Bearer $MILLIMETRIC_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | jq

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The URL reference here is part of a concrete authenticated curl example that transmits a bearer token to the external API. The skill context makes this expected rather than deceptive, but it remains a genuine security-sensitive action because it sends secrets and enables access to analytics resources.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

bash

# List available tools
curl -s -X POST https://api.millimetric.ai/mcp \
  -H "Authorization: Bearer $MILLIMETRIC_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | jq

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This URL reference is likewise embedded in a live authenticated API call that can retrieve analytics data. The behavior is intended, but the combination of outbound transmission and bearer authentication means misuse or leakage can expose sensitive operational data.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | jq

# Call top_sources directly
curl -s -X POST https://api.millimetric.ai/mcp \
  -H "Authorization: Bearer $MILLIMETRIC_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This URL reference is likewise embedded in a live authenticated API call that can retrieve analytics data. The behavior is intended, but the combination of outbound transmission and bearer authentication means misuse or leakage can expose sensitive operational data.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | jq

# Call top_sources directly
curl -s -X POST https://api.millimetric.ai/mcp \
  -H "Authorization: Bearer $MILLIMETRIC_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Static analysis

No suspicious patterns detected.