@finchagentic/mcp@4.7.4
The runtime layer for Agentic AI. Persistent memory, autonomous agents, and workflows that survive every session.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package forwards configured third-party AI keys to its Finch backend on backend requests, including keys unrelated to the specific request. The BYOK documentation supports an intended server-side use, so this is a warning-level credential handling risk rather than a clearly malicious collection flow.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A Finch backend request occurs while one or more provider API keys are set in the environment.
Impact
The Finch backend receives third-party API credentials; keys may be sent even when unrelated to the specific backend request.
Mechanism
The request helper adds every configured provider key to `X-User-*` headers, including for requests beyond the server-side LLM proxy.
AI rationale
The package forwards configured third-party AI keys to its Finch backend on backend requests, including keys unrelated to the specific request. The BYOK documentation supports an intended server-side use, so this is a warning-level credential handling risk rather than a clearly malicious collection flow.
Evidence
dist/convex.jsdist/agent-loop.js
Network endpoints1
valuable-fish-533.convex.site
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Backend requests attach configured Anthropic, OpenAI, Grok, and Bankr API keys in `X-User-*` headers.
- The default Finch backend host is `valuable-fish-533.convex.site`.
- The agent loop sends requests to Finch’s `/llm/complete` endpoint through the backend request helper.
Evidence against
- The README describes these keys as BYOK credentials for server-side reasoning features.
- Direct Anthropic agent requests send the Anthropic key to Anthropic’s own API.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/local-vault.jsView file
61// "not found", matching callConvex's own 404 format.
L62: const VAULT_DIR = path.join(os.homedir(), ".finch", "vault");
L63: // Local vault is enabled purely by config - it needs no server, just the
...
L82: const raw = fs.readFileSync(indexPath(cfg), "utf8");
L83: const parsed = JSON.parse(raw);
L84: return { entries: parsed.entries ?? {}, links: parsed.links ?? [] };
...
L168: agentId: input.agentId, tags, pinned: false, currentVersion: 1,
L169: createdAt: ts, updatedAt: ts, metadata: input.metadata,
L170: versions: [{ version: 1, commitMsg: input.commitMsg, agentId: input.agentId, size: Buffer.byteLength(input.content), createdAt: ts }],
Low
Weak Crypto
Package source references weak cryptographic algorithms.
dist/local-vault.jsView on unpkg · L61dist/agent-loop.jsView file
30async function runAgent(userMessage, history, onToolCall) {
L31: const provider = process.env.FINCH_PROVIDER?.toLowerCase().trim();
L32: const bankrKey = process.env.BANKR_API_KEY;
...
L144: const sendTurn = async (messages, tools) => {
L145: const res = await fetch("https://api.anthropic.com/v1/messages", {
L146: method: "POST",
...
L151: },
L152: body: JSON.stringify({ model, max_tokens: 4096, system: SYSTEM_PROMPT, tools, messages }),
L153: signal: AbortSignal.timeout(90000),
...
L155: if (!res.ok) {
L156: const body = await res.text().catch(() => "");
L157: throw new Error(`Anthropic ${res.status}: ${body.slice(0, 300)}`);
Findings
1 Critical3 High2 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/cli-setup.js
HighCredential Exfiltrationdist/agent-loop.js
HighTrigger Reachable Credential Exfiltrationdist/agent-loop.js
HighSemantic Analysis Limiteddist/agent-loop.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/local-vault.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @finchagentic/mcp@4.7.4.
See all versions of @finchagentic/mcp for other recorded verdicts.
- Review the evidence and your use of @finchagentic/mcp@4.7.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.