registry / @okostream/mcp / 0.1.2
@okostream/mcp@0.1.2
Unsupported: update to @okostream/mcp@latest for current OKO access and onboarding.
MCP server for managing OKO Stream webinars as an organizer.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe suspicious primitives are package-aligned MCP capabilities requiring user runtime configuration and OKO scopes, with no install-time execution or hidden exfiltration chain. Firebase defaults and network calls support the documented OKO service behavior rather than malware.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs oko-mcp/npx and invokes MCP tools with OKO_API_KEY configured.
Impact
Can manage OKO webinars, chat, analytics, images, Telegram posts, and workspace invites within granted OKO scopes.
Mechanism
Authenticated Firebase/OKO API operations over MCP stdio.
AI rationale
The suspicious primitives are package-aligned MCP capabilities requiring user runtime configuration and OKO scopes, with no install-time execution or hidden exfiltration chain. Firebase defaults and network calls support the documented OKO service behavior rather than malware.
Evidence
package.jsonREADME.mddist/server.jsdist/env.jsdist/auth.jsdist/firebaseDefaults.jsdist/tools.jsdist/utils.js~/.envuser-supplied image path
Network endpoints5
us-central1-okostreamcore.cloudfunctions.net/exchangeApiKeyokostreamcore.firebaseapp.comokostreamcore-default-rtdb.firebaseio.comokostreamcore-chat.firebaseio.comokostreamcore.firebasestorage.app
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- dist/env.js loads ~/.env and requires OKO_API_KEY at runtime.
- dist/auth.js POSTs OKO_API_KEY to configured exchangeUrl for Firebase custom token.
- dist/tools.js exposes write/destructive MCP tools for OKO events/chat/Telegram/workspace state.
- dist/tools.js can read a user-supplied local image path or fetch public HTTPS image URLs for upload.
Evidence against
- package.json has no preinstall/install/postinstall hook; prepublishOnly only runs build before publishing.
- dist/server.js only starts an MCP stdio server and registers tools; no import-time mutation of agent configs.
- No child_process, eval, dynamic remote code loading, persistence, or broad filesystem harvesting found.
- Firebase API key in dist/firebaseDefaults.js is public client config for okostreamcore, not a private secret by itself.
- Destructive operations in dist/tools.js are user-invoked MCP tools and many require confirm:true.
- Remote image fetch is constrained to HTTPS images and blocks localhost/private IPs.
Behavioral surface
Crypto
Source & flagged code
2 flaggeddist/firebaseDefaults.jsView file
3patternName = google_api_key
severity = high
line = 3
matchedText = apiKey: ...Ag",
High
High Secret
Package contains a high-severity secret pattern.
dist/firebaseDefaults.jsView on unpkg · L33patternName = google_api_key
severity = high
line = 3
matchedText = apiKey: ...Ag",
High
Findings
2 High2 Medium6 Low
HighHigh Secretdist/firebaseDefaults.js
HighSecret Patterndist/firebaseDefaults.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @okostream/mcp@0.1.2.
See all versions of @okostream/mcp for other recorded verdicts.
- Review the evidence and your use of @okostream/mcp@0.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.