@one-source/mcp@5.20.0
Blockchain data, Deepstate and Standard Reserve markets, live chain queries, and API docs
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe package enables runtime analytics by default and sends tool-usage metadata, including client and session or wallet identifiers, to its analytics endpoint. This is undisclosed telemetry, so it warrants a warning; the flagged API-key validation is part of the explicit OneSource connection flow.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
When the CLI starts or an application calls createMcpServer without supplying its own analytics instance; telemetry can be disabled with ONESOURCE_ANALYTICS=false.
Impact
The vendor receives telemetry about tool usage and some client or account identifiers without an explicit opt-in.
Mechanism
The server records tool-call events and flushes them to https://1s-analytics.vercel.app/api/events, including tool and service names, network, input parameter names, response size, client metadata, and session or wallet identifiers.
AI rationale
The package enables runtime analytics by default and sends tool-usage metadata, including client and session or wallet identifiers, to its analytics endpoint. This is undisclosed telemetry, so it warrants a warning; the flagged API-key validation is part of the explicit OneSource connection flow.
Evidence
dist/analytics.jsdist/create-server.jsdist/register-api-tools.js.lpm-dependency-evidence-151e5a9f-5b07-40cf-b68b-4f919f17d135/1/npm-linux/dist/analytics.jsdist/connect-page.js
Network endpoints2
1s-analytics.vercel.appapi.onesource.io
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Creating the MCP server uses dashboard analytics by default; the package sets the endpoint to https://1s-analytics.vercel.app and provides an environment-variable opt-out.
- Tool-call events include tool and service names, network, input parameter names, response size, client name and version, authentication method, and session or wallet identifiers.
- The analytics implementation sends buffered events to the configured endpoint's /api/events route.
- The flagged API key is submitted through the connect flow and validated as a Bearer token against the configured OneSource API base URL.
Evidence against
- The package describes an MCP server for blockchain data and documentation, consistent with tool-usage analytics.
- The package's prepare script runs TypeScript compilation; no install, preinstall, or postinstall hook is declared.
- The connect handler validates a user-submitted API key against the OneSource API host, which is consistent with its authentication purpose.
Behavioral surface
CryptoEnvironmentVars
Source & flagged code
4 flaggeddist/connect-page.jsView file
9const MIN_KEY_FAIL_MS = 250;
L10: // Accepts the base64url output of randomBytes(16) used as internalState in oauth.ts.
L11: const STATE_RE = /^[A-Za-z0-9_-]{1,100}$/;
...
L27: res.writeHead(status, JSON_HEADERS);
L28: res.end(JSON.stringify({ error }));
L29: }
...
L31: try {
L32: const base = (process.env.ONESOURCE_BASE_URL ?? 'https://api.onesource.io').replace(/\/+$/, '');
L33: const r = await fetch(`${base}/api/chain/chain-id?network=ethereum`, {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/connect-page.jsView on unpkg · L99Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/connect-page.js
L9: const MIN_KEY_FAIL_MS = 250;
L10: // Accepts the base64url output of randomBytes(16) used as internalState in oauth.ts.
L11: const STATE_RE = /^[A-Za-z0-9_-]{1,100}$/;
...
L27: res.writeHead(status, JSON_HEADERS);
L28: res.end(JSON.stringify({ error }));
L29: }
...
L31: try {
L32: const base = (process.env.ONESOURCE_BASE_URL ?? 'https://api.onesource.io').replace(/\/+$/, '');
L33: const r = await fetch(`${base}/api/chain/chain-id?network=ethereum`, {
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/connect-page.jsView on unpkg · L9Findings
2 Critical2 High3 Medium6 Low
CriticalCredential Exfiltrationdist/connect-page.js
CriticalTrigger Reachable Dangerous Capabilitydist/connect-page.js
HighTrigger Reachable Credential Exfiltrationdist/connect-page.js
HighSemantic Analysis Limiteddist/register-docs-tools.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @one-source/mcp@5.20.0.
See all versions of @one-source/mcp for other recorded verdicts.
- Review the evidence and your use of @one-source/mcp@5.20.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.