registry / Data exfiltration / @kryptosai/mcp-observatory

@kryptosai/mcp-observatory

MCP security scanner and CI gate. Test, secure, and monitor MCP servers with attack simulation, schema drift detection, health scoring, and SARIF before agents depend on them.

This report shows the evidence for @kryptosai/mcp-observatory@1.36.4. 3 of 34 known versions are blocked or flagged. The newest version, 1.50.1, is allowed. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is concrete default-on data exfiltration of user and repository identity, amplified by cross-agent configuration discovery. Explicit cloud features and guarded CI setup do not mitigate the unsolicited telemetry path.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Any explicit CLI invocation; scan additionally reads agent MCP configuration files.

Impact

Leaks identifying repository/device data and MCP deployment metadata to a vendor endpoint.

Mechanism

default telemetry and agent-config inventory exfiltration

Attack narrative

On every CLI run, the package loads telemetry state, gathers hostname and Git identity, then emits a default-enabled event. Scan reads MCP configurations from multiple unrelated agent products and reports discovered server commands or URLs in telemetry. The implementation includes a disclosure function, but the shipped CLI does not call it before collection or transmission.

AI rationale

Evidence

dist/src/cli.jsdist/src/telemetry.jsdist/src/discovery.jsdist/src/commands/scan.jsscripts/postinstall.mjs~/.mcp-observatory/config.json~/.claude.json~/.codex/config.json~/.cursor/mcp.json~/.vscode/mcp.json

Network endpoints1

mcp-observatory-telemetry.kryptosai.workers.dev/v1/events

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

dist/src/cli.js sends telemetry for every CLI invocation.
dist/src/telemetry.js enables telemetry by default and posts to KryptosAI.
Telemetry collects hostname, Git email, origin URL, fingerprint, commands, and target metadata.
dist/src/discovery.js reads numerous AI-agent MCP config files; scan telemetry sends discovered commands/URLs.
The first-run telemetry notice exists but is never invoked by shipped CLI code.

Evidence against

Cloud artifact upload and OIDC flows are explicit CLI commands.
postinstall only creates a CI workflow when an opt-in config/env flag is set.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 110 file(s), 677 KB of source, external domains: docs.oasis-open.org, github.com, img.shields.io, mcp-observatory-api.kryptosai.workers.dev, mcp-observatory-telemetry.kryptosai.workers.dev, registry.modelcontextprotocol.io, registry.smithery.ai, www.w3.org

Source & flagged code

9 flagged

package.jsonView file

Lines 91-131json

91 "examples/insecure-mcp-server",

92 "scripts/postinstall.mjs",

93 "schemas"

94 ],

95 "scripts": {

96 "build": "tsc -p tsconfig.json",

97 "cli": "tsx src/cli.ts",

98 "dashboard:build": "tsx scripts/build-dashboard.ts",

99 "metrics:collect": "tsx scripts/metrics-dashboard.ts collect",

100 "metrics:build": "tsx scripts/metrics-dashboard.ts build",

101 "metrics:refresh": "tsx scripts/metrics-dashboard.ts refresh",

102 "metrics:open": "tsx scripts/metrics-dashboard.ts open",

103 "metrics:serve": "tsx scripts/metrics-dashboard.ts serve",

104 "integration:real": "tsx scripts/run-real-server-matrix.ts",

105 "evaluate:permission-delta": "tsx scripts/evaluate-permission-delta-conformance.ts",

106 "evaluate:permission-delta:mcp-diff": "tsx scripts/run-mcp-diff-baseline.ts",

107 "intel:run": "tsx scripts/enterprise-intel.ts",

108 "safety-index": "tsx scripts/run-safety-index.ts",

109 "lint": "eslint .",

110 "prepack": "npm run build",

111 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L111

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L111

112 "proof:refresh": "tsx scripts/refresh-proof-artifacts.ts",

113 "release:prep": "node scripts/release.mjs",

114 "certification:pr-body": "tsx scripts/print-certification-pr-body.ts",

115 "typecheck": "tsc --noEmit -p tsconfig.json && npm --prefix api install && npm --prefix api run typecheck",

116 "test": "vitest run",

117 "test:permission-delta-model": "vitest run tests/permission-delta-model.test.ts",

118 "test:coverage": "vitest run --coverage",

119 "validate:artifacts": "tsx scripts/validate-artifacts.ts",

120 "verify:packed-install": "node scripts/verify-packed-install.mjs",

121 "smoke": "npm run cli -- run --target tests/fixtures/sample-target-config.json && npm run cli -- diff tests/fixtures/sample-run-a.json tests/fixtures/sample-run-b.json",

122 "telemetry:export": "tsx scripts/export-telemetry-d1.ts",

123 "telemetry:intelligence": "tsx scripts/telemetry-company-intelligence.ts --input telemetry-exports/events-flat-full.json --out-dir reports",

124 "telemetry:external": "tsx scripts/telemetry-company-intelligence.ts --input telemetry-exports/events-flat-full.json --out-dir reports"

125 },

126 "keywords": [

127 "mcp",

128 "mcp-server",

129 "model-context-protocol",

130 "ai-agent",

131 "agent-security",

dist/src/ci-issue.jsView file

1import { execFile } from "node:child_process"; L2: import { mkdtemp, rm, writeFile } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/src/ci-issue.jsView on unpkg · L1

dist/src/commands/test.jsView file

242try { L243: execSync("command -v mcp-seatbelt 2>/dev/null || npx @kryptosai/mcp-seatbelt --version 2>/dev/null", { L244: stdio: "pipe",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/commands/test.jsView on unpkg · L242

dist/src/checks/skill-scan.jsView file

•matchType = normalized_sha256 matchedPackage = @kryptosai/mcp-observatory@1.32.1 matchedPath = dist/src/checks/skill-scan.js matchedIdentity = npm:[redacted]:1.32.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High