registry / @firfi/huly-mcp / 0.49.5
@firfi/huly-mcp@0.49.5
Huly MCP: feature-complete MCP server for Huly integration
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner's critical claims are not substantiated by the packaged entrypoint. Source shows an executable MCP server and bounded telemetry metadata, not malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User runs huly-mcp or configures it as an MCP server.
Impact
Normal MCP integration and limited operational telemetry; no concrete malicious chain established.
Mechanism
Configured Huly API client plus optional PostHog usage telemetry.
AI rationale
The scanner's critical claims are not substantiated by the packaged entrypoint. Source shows an executable MCP server and bounded telemetry metadata, not malicious behavior.
Evidence
package.jsondist/index.cjs
Network endpoints2
us.i.posthog.comregistry.npmjs.org/${NPM_PACKAGE_NAME2}/latest
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- Runtime telemetry sends package/session and tool-call metadata to PostHog when enabled.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The bundle starts only when used as the main executable.
- HULY credentials are loaded as redacted configuration for the configured Huly service; no source path sends them to telemetry.
- No package-owned code harvesting local config, archiving files, or executing fetched payloads was found.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsTelemetryUrlStrings
Oversized source lightweight scan
dist/index.cjs
Source & flagged code
13 flaggeddist/index.cjsView file
37L38: // node_modules/.pnpm/undici@8.10.0/node_modules/undici/lib/core/symbols.js
L39: var require_symbols = __commonJS({
...
L63: kBodyUsed: /* @__PURE__ */ Symbol("used"),
L64: kBody: /* @__PURE__ */ Symbol("abstracted request body"),
L65: kRunning: /* @__PURE__ */ Symbol("running"),
...
L180: * @type {-2|-1|0|1}
L181: * @private
L182: */
...
L920: }
L921: const code = this.code = key.charCodeAt(index2);
L922: if (code > 127) {
Critical
Sensitive Archive Exfiltration
Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.
dist/index.cjsView on unpkg · L3737L38: // node_modules/.pnpm/undici@8.10.0/node_modules/undici/lib/core/symbols.js
L39: var require_symbols = __commonJS({
...
L63: kBodyUsed: /* @__PURE__ */ Symbol("used"),
L64: kBody: /* @__PURE__ */ Symbol("abstracted request body"),
L65: kRunning: /* @__PURE__ */ Symbol("running"),
...
L180: * @type {-2|-1|0|1}
L181: * @private
L182: */
...
L920: }
L921: const code = this.code = key.charCodeAt(index2);
L922: if (code > 127) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/index.cjsView on unpkg · L3737L38: // node_modules/.pnpm/undici@8.10.0/node_modules/undici/lib/core/symbols.js
L39: var require_symbols = __commonJS({
...
L63: kBodyUsed: /* @__PURE__ */ Symbol("used"),
L64: kBody: /* @__PURE__ */ Symbol("abstracted request body"),
L65: kRunning: /* @__PURE__ */ Symbol("running"),
...
L180: * @type {-2|-1|0|1}
L181: * @private
L182: */
...
L920: }
L921: const code = this.code = key.charCodeAt(index2);
L922: if (code > 127) {
Findings
4 Critical7 High5 Medium5 Low
CriticalSensitive Archive Exfiltrationdist/index.cjs
CriticalCredential Exfiltrationdist/index.cjs
CriticalRemote Asset Decode Executedist/index.cjs
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
HighChild Processdist/index.cjs
HighCredential Redirect Persistencedist/index.cjs
HighEntrypoint Foreign Package Code Overwritedist/index.cjs
HighCommand Output Exfiltrationdist/index.cjs
HighCloud Metadata Accessdist/index.cjs
HighTrigger Reachable Credential Exfiltrationdist/index.cjs
HighSemantic Analysis Limiteddist/index.cjs
Medium
Affected versions and remediation
This report applies to @firfi/huly-mcp@0.49.5.
See all versions of @firfi/huly-mcp for other recorded verdicts.
- Review the evidence and your use of @firfi/huly-mcp@0.49.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.