registry / @henrylabs/mcp / 1.15.0

@henrylabs/mcp@1.15.0

The official MCP Server for the Henry SDK API

AI Security Review

scanned 4h ago · by lpm-firewall-ai

A default MCP tool forwards a Henry API credential, base URL, code, and intent to an external Stainless endpoint. This occurs when the execute tool is called.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

An MCP client invokes the default execute tool.

Impact

A Henry API credential and submitted code can be disclosed to api.stainless.com.

Mechanism

Credential and code forwarding to a third-party remote sandbox

Attack narrative

When an MCP client calls execute, the package defaults to remote Stainless execution. It collects the Henry API key and base URL, merges supplied client environment values, and posts them with the submitted code and intent to api.stainless.com. This exposes credentials and request content outside the Henry service.

Rationale

The source implements a default credential-forwarding path to a third-party endpoint during normal tool use. The explicit option does not remove the default external disclosure.

Evidence

src/code-tool.tssrc/options.tssrc/server.ts

Network endpoints1

api.stainless.com/api/ai/code-tool

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

The default remote code tool sends the Henry API key and base URL to api.stainless.com.
It transmits caller-supplied code and intent to that external endpoint.
Remote Stainless execution is enabled by default.

Evidence against

The remote execution behavior and local alternative are exposed as CLI options.
The manifest has no install lifecycle hook.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 597 KB of source, external domains: api.henrylabs.ai, api.stainless.com, bun.sh, cursor.com, deno.land, docs.deno.com, docs.henrylabs.ai, docs.pydantic.dev, docs.python.org, endoflife.date, github.com, img.shields.io, jsr.io, my.test.proxy.example.com, my.test.server.example.com, npmjs.org, partner.example.com, pypi.org, raw.githubusercontent.com, semver.org, static.nike.com, vscode.stainless.com, www.github.com, www.nike.com, www.npmjs.com, www.python-httpx.org, www.stainless.com

Source & flagged code

9 flagged

instructions.jsView file

Lines 1-27javascript

1"use strict";

2// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.

3var __importDefault = (this && this.__importDefault) || function (mod) {

4 return (mod && mod.__esModule) ? mod : { "default": mod };

5};

6Object.defineProperty(exports, "__esModule", { value: true });

7exports.getInstructions = getInstructions;

8const promises_1 = __importDefault(require("fs/promises"));

9const logger_1 = require("./logger.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

instructions.jsView on unpkg · L7

10const util_1 = require("./util.js");

11const INSTRUCTIONS_CACHE_TTL_MS = 15 * 60 * 1000; // 15 minutes

12const instructionsCache = new Map();

13async function getInstructions({ stainlessApiKey, customInstructionsPath, }) {

14 const now = Date.now();

15 const cacheKey = customInstructionsPath ?? stainlessApiKey ?? '';

16 const cached = instructionsCache.get(cacheKey);

17 if (cached && now - cached.fetchedAt <= INSTRUCTIONS_CACHE_TTL_MS) {

18 return cached.fetchedInstructions;

19 }

20 // Evict stale entries so the cache doesn't grow unboundedly.

21 for (const [key, entry] of instructionsCache) {

22 if (now - entry.fetchedAt > INSTRUCTIONS_CACHE_TTL_MS) {

23 instructionsCache.delete(key);

24 }

25 }

26 let fetchedInstructions;

27 if (customInstructionsPath) {

•matchType = normalized_sha256 matchedPackage = @roarkanalytics/sdk-mcp@3.6.0 matchedPath = instructions.js matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:3.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

instructions.jsView on unpkg

code-tool.jsView file

Lines 31-71javascript

31 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

32 __setModuleDefault(result, mod);

33 return result;

34 };

35})();

36Object.defineProperty(exports, "__esModule", { value: true });

37exports.codeTool = codeTool;

38const types_1 = require("./types.js");

39const util_1 = require("./util.js");

40const logger_1 = require("./logger.js");

41const prompt = `Runs JavaScript code to interact with the Henry SDK API.

43You are a skilled TypeScript programmer writing code to interface with the service.

44Define an async function named "run" that takes a single parameter of an initialized SDK client and it will be run.

45For example:

47\`\`\`

48async function run(client) {

49 const response = await client.products.search({

50 filters: {

51 type: 'image',

52 imageUrl: 'https://static.nike.com/a/images/t_web_pdp_535_v2/f_auto/example.png',

53 country: 'US',

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

code-tool.jsView on unpkg · L51

54 },

55 type: 'global',

56 limit: 10,

57 });

59 console.log(response.refId);

60}

61\`\`\`

63You will be returned anything that your function returns, plus the results of any console.log statements.

64Do not add try-catch blocks for single API calls. The tool will handle errors for you.

65Do not add comments unless necessary for generating better code.

66Code will run in a container, and cannot interact with the network outside of the given SDK client.

67Variables will not persist between calls, so make sure to return or log any data you might need later.

68Remember that you are writing TypeScript code, so you need to be careful with your types.

69Always type dynamic key-value stores explicitly as Record<string, YourValueType> instead of {}.`;

70/**

71 * A tool that runs code against a copy of the SDK.

•matchType = normalized_sha256 matchedPackage = @roarkanalytics/sdk-mcp@3.6.0 matchedPath = code-tool.js matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:3.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool.jsView on unpkg

package.jsonView file

Lines 1-41json

2 "name": "@henrylabs/mcp",

3 "version": "1.15.0",

4 "description": "The official MCP Server for the Henry SDK API",

5 "author": "Henry SDK <support@henrylabs.ai>",

6 "types": "./index.d.ts",

7 "main": "./index.js",

8 "type": "commonjs",

9 "repository": {

10 "type": "git",

11 "url": "git+https://github.com/Henry-Social/henry-sdk-ts.git",

12 "directory": "packages/mcp-server"

13 },

14 "homepage": "https://github.com/Henry-Social/henry-sdk-ts/tree/main/packages/mcp-server#readme",

15 "license": "Apache-2.0",

16 "packageManager": "yarn@1.22.22",

17 "private": false,

18 "publishConfig": {

19 "access": "public"

20 },

21 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg · L21

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg · L21

22 "test": "jest",

23 "build": "bash ./build",

24 "format": "prettier --write --cache --cache-strategy metadata . !dist",

25 "tsn": "ts-node -r tsconfig-paths/register",

26 "lint": "eslint .",

27 "fix": "eslint --fix ."

28 },

29 "dependencies": {

30 "@henrylabs/sdk": "^1.15.0",

31 "ajv": "^8.18.0",

32 "@cloudflare/cabidela": "^0.2.4",

33 "@hono/node-server": "^1.19.10",

34 "@modelcontextprotocol/sdk": "^1.27.1",

35 "hono": "^4.12.4",

36 "@valtown/deno-http-worker": "^0.0.21",

37 "cookie-parser": "^1.4.6",

38 "cors": "^2.8.5",

39 "express": "^5.1.0",

40 "fuse.js": "^7.1.0",

41 "minisearch": "^7.2.0",

code-tool.mjsView file

•matchType = normalized_sha256 matchedPackage = @roarkanalytics/sdk-mcp@3.6.0 matchedPath = code-tool.mjs matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:3.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool.mjsView on unpkg

src/code-tool.tsView file

•matchType = normalized_sha256 matchedPackage = @roarkanalytics/sdk-mcp@3.6.0 matchedPath = src/code-tool.ts matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:3.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/code-tool.tsView on unpkg

code-tool-worker.jsView file

•matchType = token_shingles matchedPackage = @roarkanalytics/sdk-mcp@3.6.0 matchedPath = code-tool-worker.js matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:3.6.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool-worker.jsView on unpkg

Source & flagged code

9 flagged · loading source

instructions.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

instructions.jsView on unpkg

7exports.getInstructions = getInstructions; L8: const promises_1 = __importDefault(require("fs/promises")); L9: const logger_1 = require("./logger.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

instructions.jsView on unpkg · L7

code-tool.jsView file

51Source sends the broad process environment to a literal external destination. L51: type: 'image', L52: imageUrl: 'https://static.nike.com/a/images/t_web_pdp_535_v2/f_auto/example.png', L53: country: 'US', ... L157: }, L158: body: JSON.stringify({ L159: project_name: 'henry-sdk', ... L168: } L169: throw new Error(`${res.status}: ${res.statusText} error when trying to contact Code Tool server. Details: ${await res.text()}`); L170: } ... L196: // Check if deno is in PATH L197: const { execSync } = await Promise.resolve().then(() => __importStar(require('node:child_process'))); L198: try {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

code-tool.jsView on unpkg · L51

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool.jsView on unpkg

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•Remote tarball dependency specs: jq-web@https://github.com/stainless-api/jq-web/releases/download/v0.8.8/jq-web.tar.gz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

code-tool.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool.mjsView on unpkg

src/code-tool.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/code-tool.tsView on unpkg

code-tool-worker.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool-worker.jsView on unpkg

Findings

2 Critical5 High5 Medium4 Low

CriticalHardcoded Runtime Data Exfiltrationcode-tool.js

CriticalManifest Confusionpackage.json

HighKnown Malware Source Similaritycode-tool.js

HighKnown Malware Source Similaritycode-tool.mjs

HighKnown Malware Source Similaritysrc/code-tool.ts

HighKnown Malware Source Similaritycode-tool-worker.js

HighKnown Malware Source Similarityinstructions.js

MediumDynamic Requireinstructions.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumRemote Tarball Dependencypackage.json

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings