registry / AI-agent capability abuse / @caelo-cms/mcp-server / 0.10.39

@caelo-cms/mcp-server@0.10.39

MCP servers for Caelo CMS: `caelo_chat` (talk to Caelo's own AI) and the admin-scoped Power-MCP (the full chat-runner tool catalogue, driven by your own agent). Lets Claude Code (or any MCP-aware client) drive a Caelo install from outside the browser.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The agent configuration write is reachable through an explicit export command, so it is a guarded agent capability rather than an automatic install attack. The flagged IAP credential flow is configured for Google signing and the configured admin origin; inspected source does not show unrelated credential disclosure.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A user runs the caelo-mcp-server export command.

Impact

The generated project files may guide a later Claude Code session using that project.

Mechanism

The command fetches /api/mcp/context from the configured admin URL and writes CLAUDE.md and valid skill files under .claude/skills.

AI rationale

Evidence

dist/index.jsdist/export.jsCLAUDE.md.claude/skills/<slug>/SKILL.md

Network endpoints1

opts.adminUrl/api/mcp/context

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The `export` command runs only when explicitly selected and writes to the chosen output directory or the current directory.
Export fetches live admin context with skill bodies and writes a CLAUDE.md file plus valid skills under .claude/skills.
package.json lists typecheck, build, and prepublishOnly scripts; it has no install hook for these writes.
IAP signing is enabled only when CAELO_IAP_SERVICE_ACCOUNT is configured and sends the access token to Google IAM Credentials to sign a JWT for the configured admin origin.

Evidence against

The inspected source does not show automatic install-time agent configuration changes or a credential transfer to an unrelated recipient.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 9 file(s), 39.9 KB of source, external domains: admin.example.com, iamcredentials.googleapis.com, www.googleapis.com

Source & flagged code

3 flagged

dist/ingress-auth.jsView file

Lines 8-48javascript

8 * runs, so the shim has to satisfy both gates: IAP first, Caelo second

9 * (CLAUDE.md §11.B — IAP stays the first line of defense).

10 *

11 * Cloud Run native IAP uses a Google-managed OAuth client, which does not

12 * allow programmatic access with user tokens. What it does accept is a

13 * JWT signed by an allowlisted service account (Google's documented

14 * "service account JWT" path): `iss`/`sub` = the SA, `aud` = the admin

15 * origin with a path wildcard, signed via the IAM Credentials `signJwt`

16 * API. The provisioner creates that SA (`caelo-mcp@<project>`), allowlists

17 * it on IAP and lets every IAP-allowlisted operator impersonate it, so the

18 * operator's own `gcloud auth application-default login` is all the shim

19 * needs — no service-account keys on laptops (CLAUDE.md §11.C).

20 *

21 * Active only when `CAELO_IAP_SERVICE_ACCOUNT` is set (the admin's

22 * /security/mcp page puts it into the `claude mcp add` command on IAP

23 * installs); otherwise requests go out exactly as before.

24 */

25import { GoogleAuth } from "google-auth-library";

26/** Signed JWTs live at most 1 hour; refresh a minute before expiry. */

27const TOKEN_LIFETIME_S = 3600;

28const REFRESH_MARGIN_S = 60;

29/** `https://admin.example.com/anything` → `https://admin.example.com/*` (the JWT `aud`). */

30export function iapAudience(adminUrl) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/ingress-auth.jsView on unpkg · L28

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/ingress-auth.jsView on unpkg · L28

31 return `${new URL(adminUrl).origin}/*`;

32}

33async function adcAccessToken() {

34 const auth = new GoogleAuth({ scopes: ["https://www.googleapis.com/auth/cloud-platform"] });

35 const token = await auth.getAccessToken();

36 if (!token)

37 throw new Error("Application Default Credentials returned no access token");

38 return token;

39}

40export function createIngressAuth(env, deps = {}) {

41 const configured = env.CAELO_IAP_SERVICE_ACCOUNT?.trim();

42 if (!configured)

43 return null;

44 const serviceAccount = configured;

45 if (!env.CAELO_ADMIN_URL)

46 throw new Error("CAELO_IAP_SERVICE_ACCOUNT is set but CAELO_ADMIN_URL is not");

47 const audience = iapAudience(env.CAELO_ADMIN_URL);

48 const getAccessToken = deps.getAccessToken ?? adcAccessToken;

dist/export.jsView file

Lines 1-24javascript

1// SPDX-License-Identifier: MPL-2.0

2/**

3 * Issue #376 — `caelo-mcp-server export`: writes a CLAUDE.md + one

4 * `.claude/skills/<slug>/SKILL.md` per active skill into a working

5 * directory, generated from the install's live context

6 * (`/api/mcp/context` with skill bodies included). Check the files into

Medium

Ai Review Evidence

Export fetches live admin context with skill bodies and writes a CLAUDE.md file plus valid skills under .claude/skills.

dist/export.jsView on unpkg · L4

7 * the repo an external agent (Claude Code) works from so the site

8 * context loads automatically at session start; re-run after skills or

Source & flagged code

3 flagged · loading source

dist/ingress-auth.jsView file

28const REFRESH_MARGIN_S = 60; L29: /** `https://admin.example.com/anything` → `https://admin.example.com/*` (the JWT `aud`). */ L30: export function iapAudience(adminUrl) { ... L66: headers: { authorization: `Bearer ${accessToken}`, "content-type": "application/json" }, L67: body: JSON.stringify({ L68: payload: JSON.stringify({ ... L77: if (!res.ok) { L78: const detail = await res.text().catch(() => ""); L79: throw new Error(`IAP: could not sign an access token as ${serviceAccount} (HTTP ${res.status}). ` + ... L103: let processIngress; L104: /** Ingress headers for this process, configured from `process.env` on first use. */ L105: export async function ingressHeaders() {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/ingress-auth.jsView on unpkg · L28

28Trigger-reachable chain: manifest.main -> dist/index.js -> dist/admin-server.js -> dist/http.js -> dist/ingress-auth.js L28: const REFRESH_MARGIN_S = 60; L29: /** `https://admin.example.com/anything` → `https://admin.example.com/*` (the JWT `aud`). */ L30: export function iapAudience(adminUrl) { ... L66: headers: { authorization: `Bearer ${accessToken}`, "content-type": "application/json" }, L67: body: JSON.stringify({ L68: payload: JSON.stringify({ ... L77: if (!res.ok) { L78: const detail = await res.text().catch(() => ""); L79: throw new Error(`IAP: could not sign an access token as ${serviceAccount} (HTTP ${res.status}). ` + ... L103: let processIngress; L104: /** Ingress headers for this process, configured from `process.env` on first use. */ L105: export async function ingressHeaders

Findings

2 Critical4 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationdist/ingress-auth.js

CriticalTrigger Reachable Dangerous Capabilitydist/ingress-auth.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/export.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Affected versions and remediation

This report applies to @caelo-cms/mcp-server@0.10.39.

See all versions of @caelo-cms/mcp-server for other recorded verdicts.

Review the evidence and your use of @caelo-cms/mcp-server@0.10.39 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-12 13:58:26.524Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.