registry / AI-agent capability abuse / @caelo-cms/mcp-server / 0.10.42

@caelo-cms/mcp-server@0.10.42

MCP servers for Caelo CMS: `caelo_chat` (talk to Caelo's own AI) and the admin-scoped Power-MCP (the full chat-runner tool catalogue, driven by your own agent). Lets Claude Code (or any MCP-aware client) drive a Caelo install from outside the browser.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

The explicit command modifies files used by an AI coding agent, so this warrants a capability warning. The inspected credential flow is opt-in Google IAP signing, and the package declares no install lifecycle hook.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

The operator runs caelo-mcp-server export.

Impact

Those files can influence the external agent's later sessions; the source shows this is an explicit setup action, with no automatic install-time mutation established.

Mechanism

The command fetches context from the configured Caelo admin service and writes CLAUDE.md and skill files under .claude/skills.

AI rationale

Evidence

dist/index.jsdist/export.jsCLAUDE.md.claude/skills/<slug>/SKILL.md

Network endpoints2

/api/mcp/contextiamcredentials.googleapis.com/v1/projects/-/serviceAccounts/{serviceAccount}:signJwt

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The export command fetches live Caelo context, including skill bodies, and writes it into the selected output directory.
The export flow writes a CLAUDE.md file and skill files under .claude/skills, with a slug safety check.
The package entrypoint runs export only when the caller supplies the export command.
The package's only publish lifecycle script runs the build; no install lifecycle hook is declared.

Evidence against

IAP credentials are used only when CAELO_IAP_SERVICE_ACCOUNT is configured, and the signing request goes to Google's IAM Credentials API.
The export request uses the configured admin URL and Caelo token to fetch /api/mcp/context.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 10 file(s), 50.3 KB of source, external domains: admin.example.com, iamcredentials.googleapis.com, www.googleapis.com

Source & flagged code

3 flagged

dist/ingress-auth.jsView file

Lines 8-48javascript

8 * runs, so the shim has to satisfy both gates: IAP first, Caelo second

9 * (CLAUDE.md §11.B — IAP stays the first line of defense).

10 *

11 * Cloud Run native IAP uses a Google-managed OAuth client, which does not

12 * allow programmatic access with user tokens. What it does accept is a

13 * JWT signed by an allowlisted service account (Google's documented

14 * "service account JWT" path): `iss`/`sub` = the SA, `aud` = the admin

15 * origin with a path wildcard, signed via the IAM Credentials `signJwt`

16 * API. The provisioner creates that SA (`caelo-mcp@<project>`), allowlists

17 * it on IAP and lets every IAP-allowlisted operator impersonate it, so the

18 * operator's own `gcloud auth application-default login` is all the shim

19 * needs — no service-account keys on laptops (CLAUDE.md §11.C).

20 *

21 * Active only when `CAELO_IAP_SERVICE_ACCOUNT` is set (the admin's

22 * /security/mcp page puts it into the `claude mcp add` command on IAP

23 * installs); otherwise requests go out exactly as before.

24 */

25import { GoogleAuth } from "google-auth-library";

26/** Signed JWTs live at most 1 hour; refresh a minute before expiry. */

27const TOKEN_LIFETIME_S = 3600;

28const REFRESH_MARGIN_S = 60;

29/** `https://admin.example.com/anything` → `https://admin.example.com/*` (the JWT `aud`). */

30export function iapAudience(adminUrl) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/ingress-auth.jsView on unpkg · L28

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/ingress-auth.jsView on unpkg · L28

31 return `${new URL(adminUrl).origin}/*`;

32}

33async function adcAccessToken() {

34 const auth = new GoogleAuth({ scopes: ["https://www.googleapis.com/auth/cloud-platform"] });

35 const token = await auth.getAccessToken();

36 if (!token)

37 throw new Error("Application Default Credentials returned no access token");

38 return token;

39}

40export function createIngressAuth(env, deps = {}) {

41 const configured = env.CAELO_IAP_SERVICE_ACCOUNT?.trim();

42 if (!configured)

43 return null;

44 const serviceAccount = configured;

45 if (!env.CAELO_ADMIN_URL)

46 throw new Error("CAELO_IAP_SERVICE_ACCOUNT is set but CAELO_ADMIN_URL is not");

47 const audience = iapAudience(env.CAELO_ADMIN_URL);

48 const getAccessToken = deps.getAccessToken ?? adcAccessToken;

dist/export.jsView file

Lines 1-24javascript

1// SPDX-License-Identifier: MPL-2.0

2/**

3 * Issue #376 — `caelo-mcp-server export`: writes a CLAUDE.md + one

4 * `.claude/skills/<slug>/SKILL.md` per active skill into a working

5 * directory, generated from the install's live context

6 * (`/api/mcp/context` with skill bodies included). Check the files into

Medium

Ai Review Evidence

The export command fetches live Caelo context, including skill bodies, and writes it into the selected output directory.

dist/export.jsView on unpkg · L4

7 * the repo an external agent (Claude Code) works from so the site

8 * context loads automatically at session start; re-run after skills or

Source & flagged code

3 flagged · loading source

dist/ingress-auth.jsView file

28const REFRESH_MARGIN_S = 60; L29: /** `https://admin.example.com/anything` → `https://admin.example.com/*` (the JWT `aud`). */ L30: export function iapAudience(adminUrl) { ... L66: headers: { authorization: `Bearer ${accessToken}`, "content-type": "application/json" }, L67: body: JSON.stringify({ L68: payload: JSON.stringify({ ... L77: if (!res.ok) { L78: const detail = await res.text().catch(() => ""); L79: throw new Error(`IAP: could not sign an access token as ${serviceAccount} (HTTP ${res.status}). ` + ... L103: let processIngress; L104: /** Ingress headers for this process, configured from `process.env` on first use. */ L105: export async function ingressHeaders() {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/ingress-auth.jsView on unpkg · L28

28Trigger-reachable chain: manifest.main -> dist/index.js -> dist/admin-server.js -> dist/http.js -> dist/ingress-auth.js L28: const REFRESH_MARGIN_S = 60; L29: /** `https://admin.example.com/anything` → `https://admin.example.com/*` (the JWT `aud`). */ L30: export function iapAudience(adminUrl) { ... L66: headers: { authorization: `Bearer ${accessToken}`, "content-type": "application/json" }, L67: body: JSON.stringify({ L68: payload: JSON.stringify({ ... L77: if (!res.ok) { L78: const detail = await res.text().catch(() => ""); L79: throw new Error(`IAP: could not sign an access token as ${serviceAccount} (HTTP ${res.status}). ` + ... L103: let processIngress; L104: /** Ingress headers for this process, configured from `process.env` on first use. */ L105: export async function ingressHeaders

Findings

2 Critical4 Medium6 Low

CriticalHardcoded Runtime Data Exfiltrationdist/ingress-auth.js

CriticalTrigger Reachable Dangerous Capabilitydist/ingress-auth.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/export.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Affected versions and remediation

This report applies to @caelo-cms/mcp-server@0.10.42.

See all versions of @caelo-cms/mcp-server for other recorded verdicts.

Review the evidence and your use of @caelo-cms/mcp-server@0.10.42 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-13 12:24:58.125Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.