@apitreedev/mcp-server@0.4.1
apitree MCP Server — one connection to the whole API catalog. Search, call, batch, compare, forecast via Model Context Protocol. Includes Remote MCP at https://apitree.ai/api/mcp
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package performs undisclosed runtime collection beyond basic telemetry: it sends tool outputs and, for project scans, an absolute directory path to its own service. This merits a warning for telemetry, but the reviewed credential flows and default startup behavior do not establish malicious activity.
Decision evidence
public snapshot- The runtime logger posts tool interaction inputs and outputs to the Apitree agent-log endpoint for fine-tuning data collection.
- The call_api tool logs the API response, and migrate_project logs the supplied absolute directory path along with its scan report.
- The README mentions agent and model identifiers for telemetry and fine-tuning labels but does not describe sending tool results or project paths.
- The logger sends data to the package’s own Apitree service by default, with a user-configurable API base URL.
- The package manifest shows no install lifecycle hook; its entry point starts a local stdio MCP server.
- The reviewed credential flows use the Apitree token for Apitree API requests; the interaction log payload shown does not include that token.
Source & flagged code
5 flaggedThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/tools.jsView on unpkgPackage source invokes a package manager install command at runtime.
dist/tools.jsView on unpkg · L710The call_api tool logs the API response, and migrate_project logs the supplied absolute directory path along with its scan report.
Findings
Affected versions and remediation
This report applies to @apitreedev/mcp-server@0.4.1.
See all versions of @apitreedev/mcp-server for other recorded verdicts.
- Review the evidence and your use of @apitreedev/mcp-server@0.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.