registry / @kryptosai/mcp-observatory / 1.44.3
@kryptosai/mcp-observatory@1.44.3
MCP security scanner and CI gate. Test, secure, and monitor MCP servers with attack simulation, schema drift detection, health scoring, and SARIF before agents depend on them.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a real guarded install-time CI mutation and future execution path, but the inspected source requires an explicit enablement condition and does not establish credential theft, remote payload execution, or stealth persistence. It warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package in a detected MCP project with mcpObservatory.autoSetupCi set to true, or with the auto-setup environment flag enabled.
Impact
Adds CI automation and a recurring third-party action execution path to the consumer repository.
Mechanism
Conditional postinstall creation of a scheduled GitHub Actions workflow.
AI rationale
This is a real guarded install-time CI mutation and future execution path, but the inspected source requires an explicit enablement condition and does not establish credential theft, remote payload execution, or stealth persistence. It warrants a warning rather than a block.
Evidence
package.jsonscripts/postinstall.mjsdist/src/commands/test.js.github/workflows/mcp-observatory.yml
Decision evidence
public snapshotAI called this Suspicious at 83.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest runs a postinstall script during dependency installation.
- The postinstall script can create a GitHub Actions workflow in the consuming project.
- The generated workflow runs on pushes, pull requests, and a weekly schedule and invokes the vendor action.
- A runtime command uses a shell string to probe or download a related package when the user runs the test command.
Evidence against
- The postinstall exits for CI and self-installs, and only writes the workflow when an explicit package setting or environment flag enables automatic setup.
- Workflow creation uses exclusive create mode, so it does not overwrite an existing workflow.
- No self-dependency, credential harvesting, secret exfiltration, obfuscation, or install-time network request was found in the inspected sources.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
11 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/src/ci-issue.jsView file
1import { execFile } from "node:child_process";
L2: import { mkdtemp, rm, writeFile } from "node:fs/promises";
High
Child Process
Package source references child process execution.
dist/src/ci-issue.jsView on unpkg · L1Findings
1 Critical9 High5 Medium4 Low
CriticalPrevious Version Dangerous Deltadist/src/checks/runtime-profile.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/src/ci-issue.js
HighShell
HighRuntime Package Installdist/src/commands/test.js
HighSemantic Analysis Limiteddist/src/checks/skill-scan.js#virtual:normalized:round1
HighKnown Malware Source Similaritydist/src/commands/helpers.js
HighKnown Malware Source Similaritydist/src/risk-graph.js
HighKnown Malware Source Similaritydist/src/checks/attack-sim.js
HighKnown Malware Source Similaritydist/src/utils/failure-diagnosis.js
MediumAmbiguous Install Lifecycle Script
Affected versions and remediation
This report applies to @kryptosai/mcp-observatory@1.44.3.
See all versions of @kryptosai/mcp-observatory for other recorded verdicts.
- Review the evidence and your use of @kryptosai/mcp-observatory@1.44.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.