registry / Credential exfiltration / @henrylabs/mcp
@henrylabs/mcp
The official MCP Server for the Henry SDK API
This report shows the evidence for @henrylabs/mcp@1.15.0. 1 of 6 known versions is blocked or flagged. The newest version, 1.17.0, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source implements a default credential-forwarding path to a third-party endpoint during normal tool use. The explicit option does not remove the default external disclosure.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
An MCP client invokes the default execute tool.
Impact
A Henry API credential and submitted code can be disclosed to api.stainless.com.
Mechanism
Credential and code forwarding to a third-party remote sandbox
Attack narrative
When an MCP client calls execute, the package defaults to remote Stainless execution. It collects the Henry API key and base URL, merges supplied client environment values, and posts them with the submitted code and intent to api.stainless.com. This exposes credentials and request content outside the Henry service.
AI rationale
The source implements a default credential-forwarding path to a third-party endpoint during normal tool use. The explicit option does not remove the default external disclosure.
Evidence
src/code-tool.tssrc/options.tssrc/server.ts
Network endpoints1
api.stainless.com/api/ai/code-tool
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The default remote code tool sends the Henry API key and base URL to api.stainless.com.
- It transmits caller-supplied code and intent to that external endpoint.
- Remote Stainless execution is enabled by default.
Evidence against
- The remote execution behavior and local alternative are exposed as CLI options.
- The manifest has no install lifecycle hook.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
9 flagged · loading sourceinstructions.jsView file
•matchType = normalized_sha256
matchedPackage = @roarkanalytics/sdk-mcp@3.6.0
matchedPath = instructions.js
matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:3.6.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
instructions.jsView on unpkg7exports.getInstructions = getInstructions;
L8: const promises_1 = __importDefault(require("fs/promises"));
L9: const logger_1 = require("./logger.js");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
instructions.jsView on unpkg · L7code-tool.jsView file
51Source sends the broad process environment to a literal external destination.
L51: type: 'image',
L52: imageUrl: 'https://static.nike.com/a/images/t_web_pdp_535_v2/f_auto/example.png',
L53: country: 'US',
...
L157: },
L158: body: JSON.stringify({
L159: project_name: 'henry-sdk',
...
L168: }
L169: throw new Error(`${res.status}: ${res.statusText} error when trying to contact Code Tool server. Details: ${await res.text()}`);
L170: }
...
L196: // Check if deno is in PATH
L197: const { execSync } = await Promise.resolve().then(() => __importStar(require('node:child_process')));
L198: try {
Findings
2 Critical5 High5 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationcode-tool.js
CriticalManifest Confusionpackage.json
HighKnown Malware Source Similaritycode-tool.js
HighKnown Malware Source Similaritycode-tool.mjs
HighKnown Malware Source Similaritysrc/code-tool.ts
HighKnown Malware Source Similaritycode-tool-worker.js
HighKnown Malware Source Similarityinstructions.js
MediumDynamic Requireinstructions.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumRemote Tarball Dependencypackage.json
LowScripts Present
Affected versions and remediation
This report applies to @henrylabs/mcp@1.15.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing @henrylabs/mcp@1.15.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.