@frase/mcp-server@0.11.0
Frase MCP Server — The complete content platform for AI agents. Research, write, optimize, and host SEO & GEO-optimized content with built-in AI search visibility monitoring. Includes Frase CMS for auto-optimized web hosting, 121 tools, 9 agent skills, an
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package sends default runtime invocation telemetry to the configured Frase API and discloses telemetry in its README. The implementation also sends `error_detail`, which the disclosure does not list, and no way to disable telemetry was found, so this warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A stdio MCP tool call.
Impact
Frase receives invocation telemetry; transmitted error details are not described in the README’s list of collected fields, and no opt-out was identified.
Mechanism
The wrapper posts invocation metadata, hashed arguments, and error details to the configured API endpoint.
AI rationale
The package sends default runtime invocation telemetry to the configured Frase API and discloses telemetry in its README. The implementation also sends `error_detail`, which the disclosure does not list, and no way to disable telemetry was found, so this warrants a warning rather than a block.
Evidence
dist/index.jsdist/lib/mcp-audit.jsREADME.md
Network endpoints1
{configured Frase API URL}/audit/mcp-tool (default base: https://next.frase.io/api/v1)
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Every stdio tool dispatch is wrapped to record an invocation.
- The audit POST sends to the configured Frase API URL at `/audit/mcp-tool`.
- The payload includes a hash and size of tool arguments plus `error_detail` and upstream status.
- The README discloses invocation telemetry, but describes error type rather than the transmitted error detail.
- The `init` setup prompts for a Frase API key; the package’s only lifecycle script is `prepublishOnly` running the build.
Evidence against
- The audit request uses the configured Frase API endpoint and the Frase API key, rather than an unrelated collector.
- The audit payload hashes arguments instead of sending their raw values.
- The README says telemetry is used for auditing and reliability and says it does not read conversation history, files, or memory.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
Source & flagged code
4 flaggeddist/cli/init.jsView file
11import { stdin, stdout } from "node:process";
L12: import { execSync } from "node:child_process";
L13: import { detectTools } from "./detect-tool.js";
High
4*
L5: * Usage: npx @frase/mcp-server init
L6: *
...
L11: import { stdin, stdout } from "node:process";
L12: import { execSync } from "node:child_process";
L13: import { detectTools } from "./detect-tool.js";
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/cli/init.jsView on unpkg · L4dist/mcpb-bundle.jsView file
2960sourceCode = this.opts.code.process(sourceCode, sch);
L2961: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
L2962: const validate = makeValidate(this, this.scope.get());
Findings
1 Critical3 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltadist/lib/clean-render.js
HighChild Processdist/cli/init.js
HighShell
HighRuntime Package Installdist/cli/init.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcpb-bundle.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @frase/mcp-server@0.11.0.
See all versions of @frase/mcp-server for other recorded verdicts.
- Review the evidence and your use of @frase/mcp-server@0.11.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.