@okostream/mcp@0.20.0
Control OKO Stream webinars from Claude, Codex, and other MCP clients.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package automatically sends undisclosed runtime audit telemetry to its own service for non-read-only tool calls, including selected resource identifiers. This warrants a warning, but the inspected payload does not include credentials or file contents.
Static reason
One or more suspicious static signals were detected.
Trigger
A non-read-only tool call completes or errors.
Impact
OKO receives a record of tool usage and related resource IDs. No credentials or file contents are included in this audit payload.
Mechanism
The server invokes OKO’s Firebase callable recordMcpToolAudit with the tool name, outcome, selected target IDs, duration, and error type.
AI rationale
The package automatically sends undisclosed runtime audit telemetry to its own service for non-read-only tool calls, including selected resource identifiers. This warrants a warning, but the inspected payload does not include credentials or file contents.
Evidence
dist/server.js
Network endpoints2
us-central1-okostreamcore.cloudfunctions.net/recordMcpToolAuditus-central1-okostreamcore.cloudfunctions.net/exchangeApiKey
Decision evidence
public snapshotAI called this Suspicious at 95.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Every successful non-read-only tool call is automatically audited; read-only calls are skipped.
- The audit sends the tool name, outcome, selected resource IDs, duration, and error type to OKO’s recordMcpToolAudit callable.
- The OKO API key is sent to the configured exchange endpoint for authentication.
Evidence against
- The manifest has no install, preinstall, or postinstall hook.
- The package is an OKO Stream MCP server, and its audit data goes to its own Firebase project.
- The audit does not send credentials or file contents.
Behavioral surface
Eval
HighEntropyStringsUrlStrings
NoLicense
Oversized source lightweight scan
dist/server.js4.61 MB file, sampled 256 KB
Source & flagged code
6 flaggeddist/server.jsView file
1232// validation function arguments
L1233: data: new codegen_1.Name("data"),
L1234: // data passed to validation function
...
L2259: id = normalizeId(id);
L2260: return resolver.resolve(baseId, id);
L2261: }
...
L3141: for (i = 0; i < input.length; i++) {
L3142: code = input[i].charCodeAt(0);
L3143: if (code === 48) {
...
L10040:
L10041: // node_modules/@grpc/grpc-js/package.json
L10042: var require_package = __commonJS({
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
dist/server.jsView on unpkg · L12321232// validation function arguments
L1233: data: new codegen_1.Name("data"),
L1234: // data passed to validation function
...
L2259: id = normalizeId(id);
L2260: return resolver.resolve(baseId, id);
L2261: }
...
L3141: for (i = 0; i < input.length; i++) {
L3142: code = input[i].charCodeAt(0);
L3143: if (code === 48) {
...
L10040:
L10041: // node_modules/@grpc/grpc-js/package.json
L10042: var require_package = __commonJS({
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/server.jsView on unpkg · L1232•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
Findings
3 High3 Medium6 Low
HighBrowser Session Account Hijackdist/server.js
HighObfuscated Payload Loaderdist/server.js
HighSemantic Analysis Limiteddist/server.js
MediumOversized Source Filedist/server.js
MediumOversized Cli Entrypointdist/server.js
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/server.js
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @okostream/mcp@0.20.0.
See all versions of @okostream/mcp for other recorded verdicts.
- Review the evidence and your use of @okostream/mcp@0.20.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.