registry / @okostream/mcp / 0.5.1
@okostream/mcp@0.5.1
Unsupported: update to @okostream/mcp@latest for current OKO access and onboarding.
MCP server for managing OKO Stream webinars as an organizer.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic inspection shows sensitive primitives are expected for an authenticated MCP server that manages OKO Stream resources, with no install-time hooks, no broad AI-agent control-surface mutation, and no concrete malicious chain. The Firebase API key is public client configuration and OKO_API_KEY exchange is package-aligned authentication.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs oko-mcp/npx @okostream/mcp and invokes MCP tools with OKO_API_KEY.
Impact
Can manage OKO webinars and related data within API-key scopes; no unconsented install-time mutation or unrelated exfiltration identified.
Mechanism
Package-aligned MCP management client for OKO Firebase/Cloud Functions APIs.
AI rationale
Static inspection shows sensitive primitives are expected for an authenticated MCP server that manages OKO Stream resources, with no install-time hooks, no broad AI-agent control-surface mutation, and no concrete malicious chain. The Firebase API key is public client configuration and OKO_API_KEY exchange is package-aligned authentication.
Evidence
package.jsondist/server.jsdist/env.jsdist/auth.jsdist/firebaseDefaults.jsdist/firebase.jsdist/tools.jsdist/networkPolicy.jsdist/utils.jsREADME.md~/.envOKO_IMAGE_ROOTS image paths
Network endpoints6
us-central1-okostreamcore.cloudfunctions.net/exchangeApiKeyokostreamcore.firebaseapp.comokostreamcore-default-rtdb.firebaseio.comokostreamcore-chat.firebaseio.comokostreamcore.firebasestorage.appokostream.app
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- dist/env.js loads ~/.env and requires OKO_API_KEY at MCP server startup.
- dist/auth.js POSTs OKO_API_KEY to configured exchangeUrl for Firebase custom-token auth.
- dist/tools.js exposes user-invoked write/destructive MCP tools for OKO events, chat, Telegram, workspaces, and images.
- dist/tools.js can read local image files under OKO_IMAGE_ROOTS or fetch public HTTPS images for upload.
Evidence against
- package.json has no preinstall/install/postinstall hooks; only prepublishOnly build is present.
- dist/server.js only starts an MCP stdio server and registers OKO guides/tools; no install-time or import-time agent config mutation found.
- dist/firebaseDefaults.js contains public Firebase client config and an OKO Cloud Function URL, not a private secret by itself.
- Write/destructive/external-side-effect tools check scopes via ensureAuth and many require confirm:true.
- Remote image fetching blocks localhost/private IPs, pins DNS, limits redirects, content types, bytes, and pixels.
- No child_process, eval, dynamic code loading, persistence, credential harvesting beyond package-aligned OKO_API_KEY exchange, or unrelated exfiltration found.
Source & flagged code
2 flaggeddist/firebaseDefaults.jsView file
3patternName = google_api_key
severity = high
line = 3
matchedText = apiKey: ...Ag",
High
High Secret
Package contains a high-severity secret pattern.
dist/firebaseDefaults.jsView on unpkg · L33patternName = google_api_key
severity = high
line = 3
matchedText = apiKey: ...Ag",
High
Findings
2 High2 Medium6 Low
HighHigh Secretdist/firebaseDefaults.js
HighSecret Patterndist/firebaseDefaults.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @okostream/mcp@0.5.1.
See all versions of @okostream/mcp for other recorded verdicts.
- Review the evidence and your use of @okostream/mcp@0.5.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.