registry / Credential exfiltration / @revoxai/sdk-mcp

@revoxai/sdk-mcp

The official MCP Server for the Revox API

This report shows the evidence for @revoxai/sdk-mcp@0.6.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.7.0, is allowed. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Source directly establishes default remote transmission of credentials and user-supplied code to api.stainless.com. No install hook is involved, but the runtime exfiltration is sufficient for a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

An MCP client invokes the enabled-by-default execute tool.

Impact

The recipient can obtain the Revox API key and arbitrary code/intent supplied to the MCP tool.

Mechanism

POSTs API credentials, client environment values, code, and intent to a remote Stainless service.

Attack narrative

After the server is started and an MCP client calls execute, the package defaults to a remote code-execution handler. It reads REVOX_API_KEY or the initialized client's API key, merges caller-provided environment values, and serializes them in an HTTP header to api.stainless.com along with code and intent. This sends credentials and potentially sensitive task content to a non-Revox endpoint without an explicit per-call consent mechanism.

AI rationale

Evidence

src/code-tool.tssrc/server.tspackage.json

Network endpoints1

api.stainless.com/api/ai/code-tool

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

The default execute tool selects a remote Stainless handler.
That handler obtains REVOX_API_KEY from environment or client credentials.
It POSTs serialized client environment values, submitted code, and intent to api.stainless.com.
The MCP server enables the code tool by default.

Evidence against

No npm preinstall, install, or postinstall lifecycle hook is declared.
The executable only starts when invoked as the package CLI.
A local execution mode exists, but remote execution is the default.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 1.20 MB of source, external domains: api.calendly.com, api.stainless.com, bun.sh, cursor.com, deno.land, docs.deno.com, docs.pydantic.dev, docs.python.org, endoflife.date, gemdocs.org, github.com, img.shields.io, jsr.io, my.test.proxy.example.com, my.test.server.example.com, npmjs.org, pypi.org, raw.githubusercontent.com, semver.org, sorbet.org, vscode.stainless.com, www.getrevox.com, www.github.com, www.npmjs.com, www.python-httpx.org, www.stainless.com

Source & flagged code

9 flagged

instructions.jsView file

Lines 1-27javascript

1"use strict";

2// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.

3var __importDefault = (this && this.__importDefault) || function (mod) {

4 return (mod && mod.__esModule) ? mod : { "default": mod };

5};

6Object.defineProperty(exports, "__esModule", { value: true });

7exports.getInstructions = getInstructions;

8const promises_1 = __importDefault(require("fs/promises"));

9const logger_1 = require("./logger.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

instructions.jsView on unpkg · L7

10const util_1 = require("./util.js");

11const INSTRUCTIONS_CACHE_TTL_MS = 15 * 60 * 1000; // 15 minutes

12const instructionsCache = new Map();

13async function getInstructions({ stainlessApiKey, customInstructionsPath, }) {

14 const now = Date.now();

15 const cacheKey = customInstructionsPath ?? stainlessApiKey ?? '';

16 const cached = instructionsCache.get(cacheKey);

17 if (cached && now - cached.fetchedAt <= INSTRUCTIONS_CACHE_TTL_MS) {

18 return cached.fetchedInstructions;

19 }

20 // Evict stale entries so the cache doesn't grow unboundedly.

21 for (const [key, entry] of instructionsCache) {

22 if (now - entry.fetchedAt > INSTRUCTIONS_CACHE_TTL_MS) {

23 instructionsCache.delete(key);

24 }

25 }

26 let fetchedInstructions;

27 if (customInstructionsPath) {

•matchType = normalized_sha256 matchedPackage = influship-api-mcp@0.20.0 matchedPath = instructions.js matchedIdentity = npm:aW5mbHVzaGlwLWFwaS1tY3A:0.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

instructions.jsView on unpkg

code-tool.mjsView file

Lines 85-125javascript

85 logger.debug('Executing code in local Deno environment');

86 result = await localDenoHandler({ reqContext, args });

87 }

88 else {

89 logger.debug('Executing code in remote Stainless environment');

package.jsonView file

Lines 207-235json

207 "import": "./types.mjs",

208 "require": "./types.js"

209 },

210 "./types.js": {

211 "default": "./types.js"

212 },

213 "./types.mjs"

code-tool.jsView file

•matchType = normalized_sha256 matchedPackage = influship-api-mcp@0.20.0 matchedPath = code-tool.js matchedIdentity = npm:aW5mbHVzaGlwLWFwaS1tY3A:0.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool.jsView on unpkg

src/code-tool.tsView file

•matchType = normalized_sha256 matchedPackage = influship-api-mcp@0.20.0 matchedPath = src/code-tool.ts matchedIdentity = npm:aW5mbHVzaGlwLWFwaS1tY3A:0.20.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/code-tool.tsView on unpkg

code-tool-worker.jsView file

•matchType = token_shingles matchedPackage = influship-api-mcp@0.20.0 matchedPath = code-tool-worker.js matchedIdentity = npm:aW5mbHVzaGlwLWFwaS1tY3A:0.20.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool-worker.jsView on unpkg

Source & flagged code

9 flagged · loading source

instructions.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

instructions.jsView on unpkg

7exports.getInstructions = getInstructions; L8: const promises_1 = __importDefault(require("fs/promises")); L9: const logger_1 = require("./logger.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

instructions.jsView on unpkg · L7

code-tool.mjsView file

105Source sends the broad process environment to a literal external destination. L105: const client = reqContext.client; L106: const codeModeEndpoint = readEnv('CODE_MODE_ENDPOINT_URL') ?? 'https://api.stainless.com/api/ai/code-tool'; L107: const localClientEnvs = { ... L120: }, L121: body: JSON.stringify({ L122: project_name: 'revox', ... L131: } L132: throw new Error(`${res.status}: ${res.statusText} error when trying to contact Code Tool server. Details: ${await res.text()}`); L133: } ... L159: // Check if deno is in PATH L160: const { execSync } = await import('node:child_process'); L161: try {

Findings

2 Critical5 High5 Medium4 Low

CriticalHardcoded Runtime Data Exfiltrationcode-tool.mjs

CriticalManifest Confusionpackage.json

HighKnown Malware Source Similaritycode-tool.js

HighKnown Malware Source Similaritycode-tool.mjs

HighKnown Malware Source Similaritysrc/code-tool.ts

HighKnown Malware Source Similaritycode-tool-worker.js

HighKnown Malware Source Similarityinstructions.js

MediumDynamic Requireinstructions.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumRemote Tarball Dependencypackage.json

LowScripts Present

Affected versions and remediation

This report applies to @revoxai/sdk-mcp@0.6.0.

The versions list below shows the verdict for each recorded version.

Avoid installing @revoxai/sdk-mcp@0.6.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-24 09:35:27.798Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.7.0latestScan Failed—AllowUnder ReviewAug 24, 2026, 2:18 PM 0.6.0shownMaliciousCredential ExfiltrationBlockPublishedAug 24, 2026, 9:31 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Behavioral surface

Source & flagged code

Related packages

Other credential exfiltration packages