@finchagentic/mcp@4.7.2
The runtime layer for Agentic AI. Persistent memory, autonomous agents, and workflows that survive every session.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe shared Convex request helper forwards configured Anthropic, OpenAI, Grok, and Bankr credentials to Finch’s backend, including on requests made for ordinary tools. Because this third-party credential forwarding is not clearly disclosed, the package performs credential exfiltration.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Runtime use of a tool that calls the Finch Convex backend, including the agent loop’s proxy path.
Impact
The Finch service receives credentials for unrelated AI providers without clear disclosure that they are forwarded there.
Mechanism
The shared Convex request helper adds configured Anthropic, OpenAI, Grok, and Bankr keys to X-User headers sent to the default Finch host.
Attack narrative
When Finch tools make backend requests, the shared request helper attaches configured third-party AI API keys and sends them to valuable-fish-533.convex.site. The forwarding is not clearly disclosed: setup presents keys as enabling Finch’s own reasoning, while provider-specific direct calls send keys to their corresponding APIs. This exposes credentials to the Finch backend whenever the relevant runtime path is used.
AI rationale
The shared Convex request helper forwards configured Anthropic, OpenAI, Grok, and Bankr credentials to Finch’s backend, including on requests made for ordinary tools. Because this third-party credential forwarding is not clearly disclosed, the package performs credential exfiltration.
Evidence
dist/convex.jsdist/agent-loop.jsdist/cli.jsdist/llm.js
Network endpoints2
valuable-fish-533.convex.siteapi.anthropic.com/v1/messages
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- The Finch backend defaults to https://valuable-fish-533.convex.site.
- Every Convex request attaches configured Anthropic, OpenAI, Grok, and Bankr API keys as X-User headers.
- When no direct provider key is selected for the agent loop, it uses Finch’s Convex proxy; other package tools also call the same Convex request helper.
- Setup describes provider keys as enabling Finch’s own reasoning, without disclosing that requests to Finch also forward those credentials.
Evidence against
- The package has no install, preinstall, or postinstall script.
- Direct LLM calls send provider keys to their matching provider APIs.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
6 flaggeddist/local-vault.jsView file
68// vault handlers already catch and format that).
L69: const VAULT_DIR = path.join(os.homedir(), ".finch", "vault");
L70: // Local vault is enabled purely by config - it needs no server, just the
...
L89: const raw = fs.readFileSync(indexPath(cfg), "utf8");
L90: const parsed = JSON.parse(raw);
L91: return { entries: parsed.entries ?? {}, links: parsed.links ?? [] };
...
L175: agentId: input.agentId, tags, pinned: false, currentVersion: 1,
L176: createdAt: ts, updatedAt: ts, metadata: input.metadata,
L177: versions: [{ version: 1, commitMsg: input.commitMsg, agentId: input.agentId, size: Buffer.byteLength(input.content), createdAt: ts }],
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/local-vault.jsView on unpkg · L68dist/agent-loop.jsView file
30async function runAgent(userMessage, history, onToolCall) {
L31: const provider = process.env.FINCH_PROVIDER?.toLowerCase().trim();
L32: const bankrKey = process.env.BANKR_API_KEY;
...
L144: const sendTurn = async (messages, tools) => {
L145: const res = await fetch("https://api.anthropic.com/v1/messages", {
L146: method: "POST",
...
L151: },
L152: body: JSON.stringify({ model, max_tokens: 4096, system: SYSTEM_PROMPT, tools, messages }),
L153: signal: AbortSignal.timeout(90000),
...
L155: if (!res.ok) {
L156: const body = await res.text().catch(() => "");
L157: throw new Error(`Anthropic ${res.status}: ${body.slice(0, 300)}`);
Findings
1 Critical4 High2 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/server.js
HighCredential Exfiltrationdist/agent-loop.js
HighCredential Redirect Persistencedist/cli.js
HighTrigger Reachable Credential Exfiltrationdist/agent-loop.js
HighSemantic Analysis Limiteddist/agent-loop.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowWeak Cryptodist/local-vault.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @finchagentic/mcp@4.7.2.
See all versions of @finchagentic/mcp for other recorded verdicts.
- Avoid installing @finchagentic/mcp@4.7.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.