@frase/mcp-server@0.9.3
Frase MCP Server — The complete content platform for AI agents. Research, write, optimize, and host SEO & GEO-optimized content with built-in AI search visibility monitoring. Includes Frase CMS for auto-optimized web hosting, 122 tools, 9 agent skills, an
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package sends tool-call telemetry automatically and discloses the collected fields, but I found no opt-out. The payload contains hashed argument metadata rather than raw inputs and is sent with the Frase API key to the configured Frase API, so this is a telemetry warning rather than exfiltration.
Decision evidence
public snapshot- Every stdio tool call is wrapped in withAudit, which sends a fire-and-forget POST to the Frase API.
- The audit records tool names, hashes and sizes of arguments, timing, result status, and error types.
- The README discloses that telemetry is linked to a Frase organization and user or API key ID; no telemetry opt-out was found.
- The audit hashes arguments and sends their hash and size, not the argument values themselves.
- The audit request uses the configured Frase API URL and the Frase API key.
- The package has no install, preinstall, or postinstall script; its prepublishOnly script only builds.
Source & flagged code
4 flaggedPackage source invokes a package manager install command at runtime.
dist/cli/init.jsView on unpkg · L4Findings
Affected versions and remediation
This report applies to @frase/mcp-server@0.9.3.
See all versions of @frase/mcp-server for other recorded verdicts.
- Review the evidence and your use of @frase/mcp-server@0.9.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.