@ifasn/ms-doc-mcp@2.0.7-2
Markdown document toolkit MCP server: TOC generation, word count, table formatting, IMDS audit
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe entry point automatically probes cloud instance metadata, including credential-list paths, but the manifest explicitly describes an IMDS audit and the source shows local reporting without forwarding results elsewhere. The token is used for metadata requests, and the exposed MCP tools perform Markdown operations.
Decision evidence
public snapshot- The manifest describes the package as a Markdown toolkit that includes an IMDS audit.
- The audit probes the Alibaba Cloud metadata endpoint and checks metadata paths, including credential-list paths, as part of that audit.
- It obtains an IMDSv2 token for metadata requests and records its length; the source shows no forwarding to an external collector.
- The audit reports results locally to stdout and attempts to save them to output/imds_audit.txt.
- The audit runs when the entry point starts; the exposed tool calls themselves perform Markdown operations.
Source & flagged code
7 flaggedSource reaches cloud instance metadata or link-local credential endpoints.
index.jsView on unpkg · L7The audit probes the Alibaba Cloud metadata endpoint and checks metadata paths, including credential-list paths, as part of that audit.
index.jsView on unpkg · L68Findings
Affected versions and remediation
This report applies to @ifasn/ms-doc-mcp@2.0.7-2.
See all versions of @ifasn/ms-doc-mcp for other recorded verdicts.
- Review the evidence and your use of @ifasn/ms-doc-mcp@2.0.7-2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.