registry / @one-source/mcp / 5.9.1
@one-source/mcp@5.9.1
Unified MCP server for OneSource — 30 tools for blockchain data, with x402 (USDC on Base) and MPP (Tempo) pay-per-call payment rails
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe scanner's credential-exfiltration label maps to a disclosed first-party OAuth/API-key validation flow, not an unrelated recipient or stealth collection. Source inspection found no install-time execution, foreign AI-agent configuration mutation, payload staging, or arbitrary execution chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Explicit CLI/server execution, MCP tool calls, or OAuth connection flow
Impact
The user-supplied API key is validated against OneSource; package telemetry and explicit bug reports may reach package-operated endpoints.
Mechanism
First-party API-key validation, MCP API access, telemetry, and payment-preference persistence
AI rationale
The scanner's credential-exfiltration label maps to a disclosed first-party OAuth/API-key validation flow, not an unrelated recipient or stealth collection. Source inspection found no install-time execution, foreign AI-agent configuration mutation, payload staging, or arbitrary execution chain.
Evidence
package.jsondist/cli.jsdist/connect-page.jsdist/analytics.jsdist/register-bug-report-tool.jsdist/batch-prefs.js~/.onesource/batch-config.json
Network endpoints4
api.onesource.io/api/chain/chain-id?network=ethereum1s-analytics.vercel.app1s-analytics.vercel.app/api/bugsregistry.npmjs.org/@one-source/mcp/latest
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- `dist/connect-page.js` submits a user-entered API key to `api.onesource.io` only to validate it.
- `dist/analytics.js` enables package-branded analytics by default.
- `dist/batch-prefs.js` can persist payment preferences under `~/.onesource/batch-config.json` when its configuration tool is invoked.
Evidence against
- `package.json` has only `prepare: tsc`; no preinstall/install/postinstall hook.
- No package source uses shell execution, eval/vm, native loading, or arbitrary code download.
- `dist/connect-page.js` uses the submitted key for the documented first-party validation endpoint and OAuth encryption flow.
- `dist/register-bug-report-tool.js` sends only explicit bug-report tool input to its disclosed package endpoint.
- Batch preference writes are limited to package-owned payment settings, not MCP-client or AI-agent configuration.
- The flagged font blobs are valid WOFF/TTF font assets, not executable payloads.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystem
Source & flagged code
3 flaggeddist/connect-page.jsView file
9const MIN_KEY_FAIL_MS = 250;
L10: // Accepts the base64url output of randomBytes(16) used as internalState in oauth.ts.
L11: const STATE_RE = /^[A-Za-z0-9_-]{1,100}$/;
...
L27: res.writeHead(status, JSON_HEADERS);
L28: res.end(JSON.stringify({ error }));
L29: }
...
L31: try {
L32: const base = (process.env.ONESOURCE_BASE_URL ?? 'https://api.onesource.io').replace(/\/+$/, '');
L33: const r = await fetch(`${base}/api/chain/chain-id?network=ethereum`, {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/connect-page.jsView on unpkg · L99Trigger-reachable chain: manifest.bin -> dist/cli.js -> dist/connect-page.js
L9: const MIN_KEY_FAIL_MS = 250;
L10: // Accepts the base64url output of randomBytes(16) used as internalState in oauth.ts.
L11: const STATE_RE = /^[A-Za-z0-9_-]{1,100}$/;
...
L27: res.writeHead(status, JSON_HEADERS);
L28: res.end(JSON.stringify({ error }));
L29: }
...
L31: try {
L32: const base = (process.env.ONESOURCE_BASE_URL ?? 'https://api.onesource.io').replace(/\/+$/, '');
L33: const r = await fetch(`${base}/api/chain/chain-id?network=ethereum`, {
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/connect-page.jsView on unpkg · L9Findings
2 Critical1 High3 Medium6 Low
CriticalCredential Exfiltrationdist/connect-page.js
CriticalTrigger Reachable Dangerous Capabilitydist/connect-page.js
HighShips High Entropy Blobweb/out/fonts/MonaspaceNeon-SemiBold.woff
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @one-source/mcp@5.9.1.
See all versions of @one-source/mcp for other recorded verdicts.
- Review the evidence and your use of @one-source/mcp@5.9.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.