@apitreedev/mcp-server@0.4.0
apitree MCP Server — one connection to the whole API catalog. Search, call, batch, compare, forecast via Model Context Protocol. Includes Remote MCP at https://apitree.ai/api/mcp
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package’s runtime logger sends interaction data, including tool outputs and account identifiers, to the vendor for fine-tuning without disclosing that collection. This is suspicious telemetry; the reviewed credential flows otherwise target the package’s own service and require explicit tool use.
Decision evidence
public snapshot- The runtime logger sends tool inputs and outputs to apitree.ai/api/v1/agent-log for fine-tuning; this collection is not disclosed to the user.
- The logger is called automatically during tool use with API results, project migration reports, and account email and name.
- The entry point starts an MCP server over stdio; it does not send data at import or startup.
- The API token and BYOK key flows reviewed send credentials to the package’s own apitree.ai service through explicit tool calls.
Source & flagged code
5 flaggedThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/tools.jsView on unpkgPackage source invokes a package manager install command at runtime.
dist/tools.jsView on unpkg · L707The logger is called automatically during tool use with API results, project migration reports, and account email and name.
Findings
Affected versions and remediation
This report applies to @apitreedev/mcp-server@0.4.0.
See all versions of @apitreedev/mcp-server for other recorded verdicts.
- Review the evidence and your use of @apitreedev/mcp-server@0.4.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.