@apso/cli@0.46.3
Apso CLI
AI Security Review
scanned 18h ago · by lpm-firewall-aiThe package's MCP wrapper automatically sends tool error messages and exception objects to its telemetry services, although the first-run notice does not disclose error reporting. This is a runtime telemetry privacy risk, so warn rather than block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user starts the MCP server and an MCP tool handler throws.
Impact
Exception messages or details may disclose user-provided input or tool data beyond the collection described in the notice.
Mechanism
The wrapper records the error message in a PostHog event and forwards the exception object to Sentry.
AI rationale
The package's MCP wrapper automatically sends tool error messages and exception objects to its telemetry services, although the first-run notice does not disclose error reporting. This is a runtime telemetry privacy risk, so warn rather than block.
Evidence
dist/commands/mcp/serve.jsdist/lib/telemetry/telemetry.js
Network endpoints2
us.i.posthog.como4509208616435714.ingest.us.sentry.io
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Whenever an MCP tool handler throws, the wrapper sends the exception to Sentry and includes its message in a PostHog event; exceptions can contain user or tool data.
- The first-run notice describes usage fields and says no code, schema, or file contents are collected, but does not disclose sending MCP tool errors.
Evidence against
- Telemetry is sent to the package's own PostHog and Sentry services.
- Telemetry can be disabled through configuration or environment variables.
- The MCP tool error reporting only runs after a user starts the MCP server and a tool handler throws.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
4 flaggeddist/lib/verify/index.jsView file
10const tslib_1 = require("tslib");
L11: const child_process_1 = require("child_process");
L12: const fs = tslib_1.__importStar(require("fs"));
L13: const http = tslib_1.__importStar(require("http"));
L14: const net = tslib_1.__importStar(require("net"));
...
L32: return new Promise((resolve) => {
L33: const p = (0, child_process_1.spawn)(cmd, args, { cwd, env: { ...process.env, ...env } });
L34: let output = "";
L35: p.stdout.on("data", (d) => {
L36: output += d;
...
L286: done(step(name, r));
L287: return r.ok ? JSON.parse(r.output.trim().split("\n").pop()) : undefined;
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/lib/verify/index.jsView on unpkg · L10bin/dev.cmdView file
•path = bin/dev.cmd
kind = build_helper
sizeBytes = 30
magicHex = [redacted]
Medium
dist/commands/mcp/serve.js
Findings
1 Critical6 Medium5 Low
CriticalCredential Exfiltrationdist/lib/verify/index.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbin/dev.cmd
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/commands/mcp/serve.js
MediumAi Review Evidencedist/lib/telemetry/telemetry.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @apso/cli@0.46.3.
See all versions of @apso/cli for other recorded verdicts.
- Review the evidence and your use of @apso/cli@0.46.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.