registry / @one-source/mcp / 5.19.1
@one-source/mcp@5.19.1
Blockchain data, Deepstate and Standard Reserve markets, live chain queries, and API docs
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe flagged credential flow is a user-triggered API-key validation request to the package's own service, with a configurable service base URL. Runtime tool analytics is directed to the package's analytics endpoint, reports metadata, and can be disabled; the CLI also reports its analytics status.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the HTTP server and submits an API key through its OAuth connect flow; analytics is created when the server or factory is started.
Impact
No malicious behavior identified; the key-validation request supports the package's connection flow, and analytics can be disabled.
Mechanism
The key is sent as a Bearer token to the OneSource chain API, or to the base URL the operator configured. Runtime analytics sends tool-call metadata to the OneSource analytics service and has an opt-out setting.
AI rationale
The flagged credential flow is a user-triggered API-key validation request to the package's own service, with a configurable service base URL. Runtime tool analytics is directed to the package's analytics endpoint, reports metadata, and can be disabled; the CLI also reports its analytics status.
Network endpoints2
api.onesource.io/api/chain/chain-id?network=ethereum1s-analytics.vercel.app/api/events
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with high false-positive risk.
Evidence for AI clean decision
- The package entry points are a CLI and a server factory; the manifest's prepare script runs TypeScript compilation.
- The flagged connect handler sends the submitted API key to the OneSource API for validation, using the documented service host by default or a user-configured base URL.
- The key-validation handler is reached through the HTTP OAuth connect-submit route, and requires an OAuth session and request before processing the key.
- Dashboard analytics can be disabled with ONESOURCE_ANALYTICS=false; the CLI reports its analytics status, and tool events include metadata such as tool name and input parameter names.
Evidence against
Behavioral surface
CryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
4 flaggeddist/connect-page.jsView file
9const MIN_KEY_FAIL_MS = 250;
L10: // Accepts the base64url output of randomBytes(16) used as internalState in oauth.ts.
L11: const STATE_RE = /^[A-Za-z0-9_-]{1,100}$/;
...
L27: res.writeHead(status, JSON_HEADERS);
L28: res.end(JSON.stringify({ error }));
L29: }
...
L31: try {
L32: const base = (process.env.ONESOURCE_BASE_URL ?? 'https://api.onesource.io').replace(/\/+$/, '');
L33: const r = await fetch(`${base}/api/chain/chain-id?network=ethereum`, {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/connect-page.jsView on unpkg · L99Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/connect-page.js
L9: const MIN_KEY_FAIL_MS = 250;
L10: // Accepts the base64url output of randomBytes(16) used as internalState in oauth.ts.
L11: const STATE_RE = /^[A-Za-z0-9_-]{1,100}$/;
...
L27: res.writeHead(status, JSON_HEADERS);
L28: res.end(JSON.stringify({ error }));
L29: }
...
L31: try {
L32: const base = (process.env.ONESOURCE_BASE_URL ?? 'https://api.onesource.io').replace(/\/+$/, '');
L33: const r = await fetch(`${base}/api/chain/chain-id?network=ethereum`, {
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/connect-page.jsView on unpkg · L9Findings
2 Critical2 High3 Medium6 Low
CriticalCredential Exfiltrationdist/connect-page.js
CriticalTrigger Reachable Dangerous Capabilitydist/connect-page.js
HighTrigger Reachable Credential Exfiltrationdist/connect-page.js
HighSemantic Analysis Limiteddist/register-docs-tools.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @one-source/mcp@5.19.1.
See all versions of @one-source/mcp for other recorded verdicts.
- Review the evidence and your use of @one-source/mcp@5.19.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.