registry / @avidian/mcp-slack / 0.2.0

@avidian/mcp-slack@0.2.0

TOON-first Model Context Protocol server for Slack, with dual-token auth and both stdio and Streamable HTTP transports.

AI Security Review

scanned 18d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs mcp-slack via bin and invokes MCP tools over stdio or authenticated HTTP

Impact

Agent or client with access can read a specified local file path for Slack upload and perform Slack actions under configured tokens

Mechanism

Slack MCP tool bridge with optional local file upload

Policy narrative

At runtime, the package starts an MCP server backed by Slack tokens from the environment. Registered tools perform expected Slack API operations, including message mutation, search, and file upload. The notable risk is that slack_upload_file can take a local file_path and send that file to Slack when a connected MCP client invokes it, but this is documented, runtime-only, and aligned with the Slack MCP server purpose rather than hidden malware.

Rationale

Static inspection supports a warn-level dangerous capability rather than malicious behavior: the package exposes powerful Slack and local-file upload tools to MCP clients, but no unconsented lifecycle mutation, persistence, credential harvesting, or off-purpose exfiltration was found. Scanner child_process/eval hits come from bundled dependencies and benign helper patterns.

Evidence

package.jsondist/index.jsREADME.md

Network endpoints2

slack.com/api/<host>:<port>/mcp

@avidian/mcp-slack@0.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code