registry / @okostream/mcp / 0.6.0
@okostream/mcp@0.6.0
Unsupported: update to @okostream/mcp@latest for current OKO access and onboarding.
MCP server for managing OKO Stream webinars as an organizer.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe network and environment use support the declared OKO MCP organizer service, and the apparent Firebase key is public client configuration rather than a privileged secret. Static inspection found no install-time execution, exfiltration beyond declared authentication, local persistence, or AI-agent control-surface mutation.
Static reason
One or more suspicious static signals were detected.
Trigger
User starts `oko-mcp` and invokes an MCP tool with configured credentials.
Impact
Authorized webinar, workspace, media, and Telegram changes may occur only through invoked MCP tools; no stealth local persistence or credential harvesting was found.
Mechanism
Scoped OKO API/Firebase organizer operations with optional user-supplied image retrieval.
AI rationale
The network and environment use support the declared OKO MCP organizer service, and the apparent Firebase key is public client configuration rather than a privileged secret. Static inspection found no install-time execution, exfiltration beyond declared authentication, local persistence, or AI-agent control-surface mutation.
Evidence
package.jsondist/server.jsdist/auth.jsdist/env.jsdist/tools.jsdist/networkPolicy.jsdist/firebase.jsdist/firebaseDefaults.jsdist/guides.jsREADME.md
Network endpoints3
us-central1-okostreamcore.cloudfunctions.net/exchangeApiKeyokostreamcore-default-rtdb.firebaseio.comokostreamcore-chat.firebaseio.com
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- `dist/auth.js` POSTs `OKO_API_KEY` to the configured key-exchange endpoint at runtime.
- `dist/tools.js` exposes authenticated webinar, Firebase, and Telegram write/delete operations.
Evidence against
- `package.json` has only `prepublishOnly`; no install-time lifecycle hook executes for users.
- `dist/server.js` starts an explicit stdio MCP server; there is no import-time shell or payload execution.
- `dist/auth.js` uses the API key only for the declared OKO custom-token exchange.
- `dist/tools.js` requires scopes and explicit `confirm` for dangerous or external side effects.
- `dist/tools.js` remote image fetching is HTTPS-only and blocks localhost/private IP targets.
- No package code writes local files, spawns processes, dynamically evaluates code, or mutates AI-agent configuration.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
2 flaggeddist/firebaseDefaults.jsView file
3patternName = google_api_key
severity = high
line = 3
matchedText = apiKey: ...Ag",
High
High Secret
Package contains a high-severity secret pattern.
dist/firebaseDefaults.jsView on unpkg · L33patternName = google_api_key
severity = high
line = 3
matchedText = apiKey: ...Ag",
High
Findings
2 High2 Medium6 Low
HighHigh Secretdist/firebaseDefaults.js
HighSecret Patterndist/firebaseDefaults.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @okostream/mcp@0.6.0.
See all versions of @okostream/mcp for other recorded verdicts.
- Review the evidence and your use of @okostream/mcp@0.6.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.