@henrylabs/mcp@1.17.0

Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

The official MCP Server for the Henry SDK API

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is an MCP server for the Henry SDK with no install lifecycle hooks and no self-install chain. Dynamic code execution and a Deno subprocess are the documented execute tool and run only when a client invokes them.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Operator starts the mcp-server binary and a client calls the execute tool with code.

Impact

The tool can call the configured Henry API with the caller credentials. No unsolicited credential export, persistence, or install mutation was found.

Mechanism

The handler launches Deno with network limited to the configured SDK hostname and the worker calls the supplied run function with the Henry SDK client.

AI rationale

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json scripts are test, build, format, tsn, lint, and fix, with no preinstall, install, or postinstall hook.
index.js starts the MCP server only when it is the main module.
The execute tool runs caller-supplied code only from its tool handler by spawning a local Deno worker.
Deno is started with network access limited to the SDK client hostname and read access limited to package paths.
The worker loads the caller module and invokes its run function with a Henry SDK client.

Evidence against

The execute handler can run caller code in Deno with environment access, but only after the operator starts the server and a client calls the tool.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 551 KB of source, external domains: api.henrylabs.ai, bun.sh, cursor.com, deno.land, docs.deno.com, docs.henrylabs.ai, endoflife.date, github.com, img.shields.io, jsr.io, npmjs.org, partner.example.com, raw.githubusercontent.com, semver.org, static.nike.com, vscode.stainless.com, www.github.com, www.nike.com, www.npmjs.com, www.stainless.com

Source & flagged code

6 flagged

instructions.jsView file

7exports.getInstructions = getInstructions; L8: const promises_1 = __importDefault(require("fs/promises")); L9: const logger_1 = require("./logger.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

instructions.jsView on unpkg · L7

code-tool.jsView file

50Source sends the broad process environment to a literal external destination. L50: type: 'image', L51: imageUrl: 'https://static.nike.com/a/images/t_web_pdp_535_v2/f_auto/example.png', L52: country: 'US', ... L145: // Check if deno is in PATH L146: const { execSync } = await Promise.resolve().then(() => __importStar(require('node:child_process'))); L147: try { ... L195: // with the upstream env vars taking precedence. L196: env: { ...process.env, ...reqContext.upstreamClientEnvs }, L197: }, ... L200: const resp = await new Promise((resolve, reject) => { L201: worker.addEventListener('exit', (exitCode) => { L202: reject(new Error(`Worker exited with code ${exitCode}`));

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

code-tool.jsView on unpkg · L50

•matchType = previous_version_dangerous_delta matchedPackage = @henrylabs/mcp@1.16.0 matchedIdentity = npm:QGhlbnJ5bGFicy9tY3A:1.16.0 similarity = 0.596 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

code-tool.jsView on unpkg

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•Remote tarball dependency specs: jq-web@https://github.com/stainless-api/jq-web/releases/download/v0.8.8/jq-web.tar.gz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

code-tool-worker.jsView file

•matchType = token_shingles matchedPackage = plumery-mcp@3.9.0 matchedPath = code-tool-worker.js matchedIdentity = npm:cGx1bWVyeS1tY3A:3.9.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool-worker.jsView on unpkg

Source & flagged code

6 flagged · loading source

instructions.jsView file

7exports.getInstructions = getInstructions; L8: const promises_1 = __importDefault(require("fs/promises")); L9: const logger_1 = require("./logger.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

instructions.jsView on unpkg · L7

code-tool.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

code-tool.jsView on unpkg · L50

Findings

2 Critical2 High5 Medium4 Low

CriticalHardcoded Runtime Data Exfiltrationcode-tool.js

CriticalManifest Confusionpackage.json

HighKnown Malware Source Similaritycode-tool-worker.js

HighPrevious Version Dangerous Deltacode-tool.js

MediumDynamic Requireinstructions.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumRemote Tarball Dependencypackage.json

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @henrylabs/mcp@1.17.0.

See all versions of @henrylabs/mcp for other recorded verdicts.

Review the evidence and your use of @henrylabs/mcp@1.17.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-22 19:46:36.366Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.