registry / @okostream/mcp / 0.11.0
@okostream/mcp@0.11.0
Control OKO Stream webinars from Claude, Codex, and other MCP clients.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe flagged network and environment access support the package's MCP service functionality, and the Firebase finding is client application configuration. Inspected source establishes no concrete malicious behavior or unresolved credential-forwarding chain involving harvested sessions.
Static reason
One or more suspicious static signals were detected.
Trigger
Starting the MCP server and invoking its tools activates service operations; no install-time attack was identified.
Impact
Expected effects are service authentication and requested webinar operations; no malicious execution, covert harvesting, or agent configuration mutation was established.
Mechanism
Caller-configured authentication and Firebase clients support webinar operations; local image access requires an explicit directory allowlist.
AI rationale
The flagged network and environment access support the package's MCP service functionality, and the Firebase finding is client application configuration. Inspected source establishes no concrete malicious behavior or unresolved credential-forwarding chain involving harvested sessions.
Network endpoints3
us-central1-okostreamcore.cloudfunctions.net/exchangeApiKeyokostreamcore-default-rtdb.firebaseio.comokostreamcore-chat.firebaseio.com
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no registry-install lifecycle hooks or runtime self-dependency; prepublishOnly builds the package.
- dist/firebaseDefaults.js contains OKO service configuration, consumed by Firebase initialization rather than secret harvesting.
- Authentication sends the explicitly configured OKO_API_KEY to the default OKO exchange service or caller-configured exchange URL.
- Local image reads require configured trusted roots and enforce containment after resolving real paths.
- The entrypoint registers MCP tools and connects a stdio transport.
Evidence against
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flaggeddist/firebaseDefaults.jsView file
3patternName = google_api_key
severity = high
line = 3
High
High Secret
Package contains a high-severity secret pattern.
dist/firebaseDefaults.jsView on unpkg · L33patternName = google_api_key
severity = high
line = 3
High
1export const DEFAULT_EXCHANGE_URL = "https://us-central1-okostreamcore.cloudfunctions.net/exchangeApiKey
Low
Ai Review Evidence
dist/firebaseDefaults.js contains OKO service configuration, consumed by Firebase initialization rather than secret harvesting.
dist/firebaseDefaults.jsView on unpkg · L1package.jsonView file
Findings
2 High2 Medium8 Low
HighHigh Secretdist/firebaseDefaults.js
HighSecret Patterndist/firebaseDefaults.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencedist/firebaseDefaults.js
Affected versions and remediation
This report applies to @okostream/mcp@0.11.0.
See all versions of @okostream/mcp for other recorded verdicts.
- Review the evidence and your use of @okostream/mcp@0.11.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.