@caelo-cms/mcp-server
MCP servers for Caelo CMS: `caelo_chat` (talk to Caelo's own AI) and the admin-scoped Power-MCP (the full chat-runner tool catalogue, driven by your own agent). Lets Claude Code (or any MCP-aware client) drive a Caelo install from outside the browser.
This report shows the evidence for @caelo-cms/mcp-server@0.10.40. 1 of 30 known versions is blocked or flagged. The newest version, 0.10.62, is allowed. See all versions.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe runtime behavior inspected is consistent with explicit export and configured Google IAP authentication, and no credential theft or install-time attack was established. However, the source comment explicitly invokes a scanner finding and asserts benignness, which the review policy treats as evidence of reviewer manipulation and malicious intent.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A reviewer or static scanner inspects dist/export.js.
Impact
It may steer reviewers toward dismissing a finding based on package-authored reassurance.
Mechanism
The comment uses the scanner finding and a benignness assertion to influence the review of reachable network-to-file behavior.
Attack narrative
The package includes reviewer-directed reassurance about a real network-to-file flow. The export operation itself requires an explicit user command, but that does not make the comment independent evidence that the behavior is safe.
AI rationale
The runtime behavior inspected is consistent with explicit export and configured Google IAP authentication, and no credential theft or install-time attack was established. However, the source comment explicitly invokes a scanner finding and asserts benignness, which the review policy treats as evidence of reviewer manipulation and malicious intent.
Evidence
dist/export.js
Decision evidence
public snapshotAI called this Malicious at 88.0% confidence as Malware with low false-positive risk.
Evidence for block
- dist/export.js contains a comment that calls out CodeQL's network-to-file finding and asserts the flow is a feature, attempting to reassure reviewers about a flagged behavior.
- The discussed flow is real: the export command fetches live context from the configured admin service before writing generated files.
- Ingress authentication is opt-in through an operator-set service account, and its signing request sends the application-default token to Google's IAM Credentials endpoint.
Evidence against
- The export runs only when the user invokes the export command; the inspected manifest has no install hook.
- The inspected credential transfer supports Google IAP signing, and admin requests use the configured admin URL.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
CopyleftLicense
Source & flagged code
3 flagged · loading sourcedist/ingress-auth.jsView file
28const REFRESH_MARGIN_S = 60;
L29: /** `https://admin.example.com/anything` → `https://admin.example.com/*` (the JWT `aud`). */
L30: export function iapAudience(adminUrl) {
...
L66: headers: { authorization: `Bearer ${accessToken}`, "content-type": "application/json" },
L67: body: JSON.stringify({
L68: payload: JSON.stringify({
...
L77: if (!res.ok) {
L78: const detail = await res.text().catch(() => "");
L79: throw new Error(`IAP: could not sign an access token as ${serviceAccount} (HTTP ${res.status}). ` +
...
L103: let processIngress;
L104: /** Ingress headers for this process, configured from `process.env` on first use. */
L105: export async function ingressHeaders() {
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/ingress-auth.jsView on unpkg · L2828Trigger-reachable chain: manifest.main -> dist/index.js -> dist/admin-server.js -> dist/http.js -> dist/ingress-auth.js
L28: const REFRESH_MARGIN_S = 60;
L29: /** `https://admin.example.com/anything` → `https://admin.example.com/*` (the JWT `aud`). */
L30: export function iapAudience(adminUrl) {
...
L66: headers: { authorization: `Bearer ${accessToken}`, "content-type": "application/json" },
L67: body: JSON.stringify({
L68: payload: JSON.stringify({
...
L77: if (!res.ok) {
L78: const detail = await res.text().catch(() => "");
L79: throw new Error(`IAP: could not sign an access token as ${serviceAccount} (HTTP ${res.status}). ` +
...
L103: let processIngress;
L104: /** Ingress headers for this process, configured from `process.env` on first use. */
L105: export async function ingressHeaders
Findings
2 Critical1 High3 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationdist/ingress-auth.js
CriticalTrigger Reachable Dangerous Capabilitydist/ingress-auth.js
HighAi Review Evidencedist/export.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowCopyleft License
Affected versions and remediation
This report applies to @caelo-cms/mcp-server@0.10.40.
The versions list below shows the verdict for each recorded version.
- Avoid installing @caelo-cms/mcp-server@0.10.40. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.