registry / @okostream/mcp / 0.10.0
@okostream/mcp@0.10.0
Control OKO Stream webinars from Claude, Codex, and other MCP clients.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe network and environment signals support the package’s authenticated MCP functionality, and the flagged Firebase value is client configuration. Static inspection found no concrete malicious behavior warranting a warning or block.
Static reason
One or more suspicious static signals were detected.
Trigger
Starting the MCP server exposes tools; client tool calls activate authentication and webinar operations.
Impact
Requested operations affect OKO webinar data; no covert credential harvesting, shell execution, persistence, or agent configuration mutation was identified.
Mechanism
Configured credentials authenticate to OKO services, while image tools enforce confirmation, directory restrictions, and public network address checks.
AI rationale
The network and environment signals support the package’s authenticated MCP functionality, and the flagged Firebase value is client configuration. Static inspection found no concrete malicious behavior warranting a warning or block.
Network endpoints3
us-central1-okostreamcore.cloudfunctions.net/exchangeApiKeyokostreamcore-default-rtdb.firebaseio.comokostreamcore-chat.firebaseio.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no registry-install lifecycle hooks or runtime self-dependency; its entrypoint runs an MCP server.
- dist/firebaseDefaults.js defines OKO Firebase project configuration, consumed by Firebase client initialization rather than privileged secret handling.
- Authentication sends the explicitly configured OKO_API_KEY to the default OKO exchange service or a caller-configured exchange URL.
- Image uploads require an authenticated scope and confirmation; local reads enforce configured directory boundaries.
- Remote image fetching rejects non-public addresses and pins the validated address.
Evidence against
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flaggeddist/firebaseDefaults.jsView file
3patternName = google_api_key
severity = high
line = 3
High
High Secret
Package contains a high-severity secret pattern.
dist/firebaseDefaults.jsView on unpkg · L33patternName = google_api_key
severity = high
line = 3
High
4authDomain: "okostreamcore.firebaseapp.com",
databaseURL: "https://okostreamcore-default-rtdb.firebaseio.com",
chatDatabaseURL: "https://okostreamcore-chat.firebaseio.com",
projectId: "okostreamcore",
storageBucket: "oko
Low
Ai Review Evidence
dist/firebaseDefaults.js defines OKO Firebase project configuration, consumed by Firebase client initialization rather than privileged secret handling.
dist/firebaseDefaults.jsView on unpkg · L4Findings
2 High2 Medium8 Low
HighHigh Secretdist/firebaseDefaults.js
HighSecret Patterndist/firebaseDefaults.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/firebaseDefaults.js
Affected versions and remediation
This report applies to @okostream/mcp@0.10.0.
See all versions of @okostream/mcp for other recorded verdicts.
- Review the evidence and your use of @okostream/mcp@0.10.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.