스킬 cargo-mcp

📦

cargo-mcp

Name: cargo-mcp
Author: getcargohq

v1.0.3 콘텐츠 리비전 r1 중간 위험 ⚙️ 외부 명령어🌐 네트워크 접근📁 파일 시스템 접근

Connect Cargo MCP and Run Workspace Actions

Using Cargo through an AI client requires correct authentication, workspace selection, and action inputs. This skill guides hosted MCP connections, cost inspection, batch execution, and result reporting.

지원: Claude Codex Code(CC)

📊 72 적절함

Maintain this Skill? Claim it 📊 72 적절함

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "cargo-mcp" from https://skillstore.io/skills/getcargohq-cargo-mcp.md and its manifest at https://skillstore.io/api/skills/getcargohq-cargo-mcp/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/getcargohq-cargo-mcp.md 서명된 manifest GET /api/skills/getcargohq-cargo-mcp/manifest 서명된 lockfile GET /api/skills/getcargohq-cargo-mcp/lockfile

테스트해 보기

"cargo-mcp" 사용 중입니다. Explain how Cargo MCP authenticates and checks my workspace.

예상 결과:

OAuth-capable clients discover authentication from the initial 401 challenge.
Headless clients can use a workspace-scoped token supplied through the environment.
Check workspace identity and report its name before performing actions.

"cargo-mcp" 사용 중입니다. Explain whether query_models can join models and calculate totals.

예상 결과:

query_models retrieves records from one model using a limit and offset.
It does not support joins, aggregates, or expression filters.
Use the separate Cargo storage CLI workflow for those queries.

"cargo-mcp" 사용 중입니다. What should the summary contain after my approved batch finishes?

예상 결과:

Record count: the number processed by the completed batch.
Hit rate: the share producing usable results.
Credits spent: the actual reported charge.
Download: the output CSV link returned by the batch.

보안 감사

중간 위험

v1 • 2026. 10. 12. 버전별 보고서 열기

All 69 static findings are false positives involving Markdown formatting, documentation links, or intended Cargo connectivity and workspace checks. One semantic concern remains: paid pilot execution precedes the explicit approval step. No evidence found of prompt injection, credential exfiltration, or malicious command execution in the supplied files; hosted service implementation was not reviewed.

스캔된 파일

213

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (1)

중간

SKILL.md:172-175

Paid Pilot Before Explicit Approval

The instruction says "Run 10–20 records first" and requests user approval only after reporting the sample and quoting the full batch. An agent following this sequence can spend credits and process personal records before explicit pilot authorization.

The documented sequence explicitly places the pilot before approval of the full run. Prior user authorization could mitigate this, but the skill does not require it.

위험 요인

⚙️ 외부 명령어 (47)

🌐 네트워크 접근 (9)

SKILL.md:3 SKILL.md:5 SKILL.md:6 SKILL.md:18 SKILL.md:24 SKILL.md:65 SKILL.md:72 SKILL.md:82 SKILL.md:97

📁 파일 시스템 접근 (8)

SKILL.md:32 SKILL.md:42 SKILL.md:43 SKILL.md:44 SKILL.md:45 SKILL.md:177 SKILL.md:182 SKILL.md:191

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/getcargohq-cargo-mcp/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/getcargohq-cargo-mcp/security.svg)](https://skillstore.io/skills/getcargohq-cargo-mcp?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/getcargohq-cargo-mcp?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/getcargohq-cargo-mcp/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/getcargohq-cargo-mcp.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

getcargohq. (2026). cargo-mcp security audit report (audit version 1) [Author version 1.0.3]. Skillstore. https://skillstore.io/skills/getcargohq-cargo-mcp/audits/1

BibTeX 인용

@techreport{getcargohq-getcargohq-cargo-mcp-2026,
  author = {getcargohq},
  title = {cargo-mcp security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/getcargohq-cargo-mcp/audits/1},
  note = {Author version 1.0.3}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "cargo-mcp security audit report (audit version 1)"
version: "1.0.3"
type: report
authors:
  - name: "getcargohq"
date-released: "2026-10-12"
url: "https://skillstore.io/skills/getcargohq-cargo-mcp/audits/1"
identifiers:
  - type: other
    value: "skillstore:getcargohq-cargo-mcp:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

100

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Connect an AI Client

Configure hosted Cargo access and verify the correct workspace without installing the Cargo CLI for MCP operations.

Enrich an Approved Batch

Inspect action pricing, obtain pilot approval, test a small sample, and submit an approved batch with a downloadable result.

Configure Headless Access

Connect a headless client with an environment-supplied workspace token and inspect available tools, schemas, and recent usage.

이 프롬프트를 사용해 보세요

Connect Cargo

Guide me through connecting Cargo MCP to Claude Desktop with OAuth. Verify and report the workspace before running any action.

Find and Price an Action

Find available company enrichment actions in my workspace. Show their credit costs and required inputs. Do not execute any action.

Plan a Controlled Batch

Plan enrichment for my approved records. Request pilot budget approval before execution. Report sample results, then request separate approval for the remaining batch.

Prepare Headless Automation

Plan headless Cargo MCP access using an environment token. Verify workspace identity, discover tools, inspect schemas, and define polling without exposing credentials.

모범 사례

Verify and report the authenticated workspace before reading data or running actions.
Approve pilot costs and data processing before execution, then approve the full batch estimate separately.
Inspect action schemas, preserve returned action descriptors, and supply inputs through data or records.

피하기

Running paid pilot records without explicit user authorization.
Placing action inputs in config or looping single-record calls instead of using batch execution.
Treating a limited model query as complete SQL analysis or counting truncated results.

자주 묻는 질문

Does hosted Cargo MCP require the Cargo CLI?

Hosted MCP operations do not require the Cargo CLI. Separate platform administration tasks use CLI skills; some installer metadata also declares the CLI.

Which AI tools can use this skill?

The skill declares Claude, Codex, and Claude Code support. Actual execution requires a client configured for the hosted Cargo MCP server.

Why does the first connection return 401?

The initial unauthenticated response provides OAuth discovery information. Continued failures after authentication require checking client configuration and credentials.

How should I handle an API token?

Use a workspace-scoped token from Cargo Settings and supply it through the environment. Do not paste its value into configuration or reports.

Can actions spend credits or process personal data?

Yes. Approve pilot and batch budgets before execution, and confirm a lawful basis, suppression checks, and relevance before processing personal records.

Why do tools differ between workspaces?

The endpoint includes platform tools and workspace-published tools. Inspect the connected tool list and verify the workspace before choosing an action.