@one-source/mcp@5.18.0
Blockchain data, Deepstate and Standard Reserve markets, live chain queries, and API docs
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe credential-flow finding is a false alarm: the submitted OneSource key is validated against OneSource's own API. However, server creation enables runtime usage analytics by default, and the package documentation does not clearly disclose the collection; this is a warning-level telemetry concern.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Calling createMcpServer without supplying analytics, followed by tool calls that record events.
Impact
The service receives tool and service names, timing, outcomes, network, and parameter names. The reviewed events do not include argument values or API keys.
Mechanism
The default analytics factory enables dashboard reporting unless ONESOURCE_ANALYTICS=false; buffered events are posted to /api/events.
AI rationale
The credential-flow finding is a false alarm: the submitted OneSource key is validated against OneSource's own API. However, server creation enables runtime usage analytics by default, and the package documentation does not clearly disclose the collection; this is a warning-level telemetry concern.
Evidence
dist/analytics.jsdist/create-server.jsdist/register-api-tools.js.lpm-dependency-evidence-65e41cae-1b57-414d-89c6-77466f860005/1/npm-linux/dist/analytics.js
Network endpoints2
1s-analytics.vercel.app/api/eventsapi.onesource.io/api/chain/chain-id?network=ethereum
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Creating the exported server enables analytics by default and sets its destination to https://1s-analytics.vercel.app; an environment variable can disable it.
- Tool calls send usage metadata such as tool and service names, timing, success, network, and input parameter names to the analytics endpoint.
- The analytics implementation posts buffered events to the endpoint's /api/events path.
- The flagged API key is submitted through the connect flow and validated against the configured OneSource API, defaulting to api.onesource.io.
Evidence against
- Analytics can be disabled with ONESOURCE_ANALYTICS=false.
- The analytics events shown contain usage metadata rather than tool argument values or API keys.
- The key validation sends the submitted key to the OneSource API, consistent with the package's connection flow.
Behavioral surface
CryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStrings
Source & flagged code
4 flaggeddist/connect-page.jsView file
9const MIN_KEY_FAIL_MS = 250;
L10: // Accepts the base64url output of randomBytes(16) used as internalState in oauth.ts.
L11: const STATE_RE = /^[A-Za-z0-9_-]{1,100}$/;
...
L27: res.writeHead(status, JSON_HEADERS);
L28: res.end(JSON.stringify({ error }));
L29: }
...
L31: try {
L32: const base = (process.env.ONESOURCE_BASE_URL ?? 'https://api.onesource.io').replace(/\/+$/, '');
L33: const r = await fetch(`${base}/api/chain/chain-id?network=ethereum`, {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/connect-page.jsView on unpkg · L99Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/connect-page.js
L9: const MIN_KEY_FAIL_MS = 250;
L10: // Accepts the base64url output of randomBytes(16) used as internalState in oauth.ts.
L11: const STATE_RE = /^[A-Za-z0-9_-]{1,100}$/;
...
L27: res.writeHead(status, JSON_HEADERS);
L28: res.end(JSON.stringify({ error }));
L29: }
...
L31: try {
L32: const base = (process.env.ONESOURCE_BASE_URL ?? 'https://api.onesource.io').replace(/\/+$/, '');
L33: const r = await fetch(`${base}/api/chain/chain-id?network=ethereum`, {
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/connect-page.jsView on unpkg · L9Findings
2 Critical2 High3 Medium6 Low
CriticalCredential Exfiltrationdist/connect-page.js
CriticalTrigger Reachable Dangerous Capabilitydist/connect-page.js
HighTrigger Reachable Credential Exfiltrationdist/connect-page.js
HighSemantic Analysis Limiteddist/register-docs-tools.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @one-source/mcp@5.18.0.
See all versions of @one-source/mcp for other recorded verdicts.
- Review the evidence and your use of @one-source/mcp@5.18.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.