@extenshi/mcp@0.17.0
Extenshi MCP server — bring the extension catalog (search, security, market research) and pre-publish scanning into your AI tools
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe package’s runtime telemetry is enabled by default and records MCP tool usage without disclosure in its README, so this is a warning-level telemetry finding. The inspected instrumentation removes tool inputs and outputs, and the postinstall ping requires previously recorded consent.
Static reason
One or more suspicious static signals were detected.
Trigger
Starting the MCP server and making tool calls, unless telemetry is disabled.
Impact
Usage patterns are reported under an anonymous per-install identity; the README does not disclose this runtime telemetry.
Mechanism
The server initializes PostHog telemetry and records tool names, session identifiers, outcomes, and durations. Instrumentation removes tool arguments, results, and error messages. The separate install ping is gated on recorded telemetry consent.
AI rationale
The package’s runtime telemetry is enabled by default and records MCP tool usage without disclosure in its README, so this is a warning-level telemetry finding. The inspected instrumentation removes tool inputs and outputs, and the postinstall ping requires previously recorded consent.
Evidence
dist/index.jsdist/telemetry.jsdist/tools.jsdist/mcp-analytics.jsscripts/postinstall.cjs~/.extenshi/config.json
Network endpoints5
eu.i.posthog.comeu.i.posthog.com/i/v0/e/bff.extenshi.ioscan.extenshi.iodocs.extenshi.io
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Runtime telemetry is enabled by default and can be disabled with environment variables or a config setting.
- MCP tool calls automatically emit events containing tool names and session identifiers, plus success or failure and duration data.
- The MCP analytics instrumentation drops tool arguments, results, and error messages before sending events.
- The postinstall ping requires telemetry:true in the existing config and sends only package/runtime metadata and an anonymous install ID.
Evidence against
- The package is an MCP server for the Extenshi catalog and documents its expected service endpoints.
- The telemetry code uses a PostHog host and anonymous install identity; the inspected flow does not send the Extenshi API key.
- The install-time telemetry path requires recorded consent and skips machines without it.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
4 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/index.jsView file
30import { checkForUpdate } from './update-check.js';
L31: const require = createRequire(import.meta.url);
L32: const pkg = require('../package.json');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/index.jsView on unpkg · L30Findings
2 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSemantic Analysis Limiteddist/development-guide.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @extenshi/mcp@0.17.0.
See all versions of @extenshi/mcp for other recorded verdicts.
- Review the evidence and your use of @extenshi/mcp@0.17.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.