@roarkanalytics/sdk-mcp@3.1.0
The official MCP Server for the Roark API
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe default remote code tool copies the Roark bearer token to an unrestricted CODE_MODE_ENDPOINT_URL that is not the Roark API, which is conditional credential exposure rather than covert theft. There are no install hooks or hidden attacker endpoints, so this is a dangerous dual-use capability, not malware.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
The operator starts this MCP server and an agent calls the execute tool while code execution mode is stainless-sandbox.
Impact
The Roark API token can be exposed to Stainless or to any host set in CODE_MODE_ENDPOINT_URL, without theft to a hidden package-owned recipient.
Mechanism
Forwards an existing Roark bearer token to an unrestricted operator-configured code-tool endpoint
AI rationale
The default remote code tool copies the Roark bearer token to an unrestricted CODE_MODE_ENDPOINT_URL that is not the Roark API, which is conditional credential exposure rather than covert theft. There are no install hooks or hidden attacker endpoints, so this is a dangerous dual-use capability, not malware.
Evidence
src/server.tssrc/options.tssrc/code-tool.tscode-tool.js
Network endpoints1
api.stainless.com/api/ai/code-tool
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The execute code tool is on by default and uses remote Stainless sandbox execution unless the operator changes that.
- The Roark API bearer token from the environment or SDK client is copied into outbound request headers.
- Those headers are posted to CODE_MODE_ENDPOINT_URL, which has no host allowlist and defaults to the Stainless code-tool API.
Evidence against
- package.json has no preinstall, install, or postinstall scripts.
- This is a Stainless-generated official Roark MCP server; the default receiver is api.stainless.com, not a hidden unrelated host.
- Operators can switch to local Deno execution, and docs or instructions fetches do not send the Roark token.
- Scanner malware-similarity hits match the shared Stainless MCP template, not a distinct hidden payload.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
11 flagged · loading sourceinstructions.jsView file
•matchType = normalized_sha256
matchedPackage = plumery-mcp@3.9.0
matchedPath = instructions.js
matchedIdentity = npm:cGx1bWVyeS1tY3A:3.9.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
instructions.jsView on unpkg7exports.getInstructions = getInstructions;
L8: const promises_1 = __importDefault(require("fs/promises"));
L9: const logger_1 = require("./logger.js");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
instructions.jsView on unpkg · L7code-tool.jsView file
51Source sends the broad process environment to a literal external destination.
L51: interfaceType: 'PHONE',
L52: recordingUrl: 'https://example.com',
L53: startedAt: 'startedAt',
...
L154: },
L155: body: JSON.stringify({
L156: project_name: 'roark-analytics',
...
L165: }
L166: throw new Error(`${res.status}: ${res.statusText} error when trying to contact Code Tool server. Details: ${await res.text()}`);
L167: }
...
L193: // Check if deno is in PATH
L194: const { execSync } = await Promise.resolve().then(() => __importStar(require('node:child_process')));
L195: try {
Findings
2 Critical7 High5 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationcode-tool.js
CriticalManifest Confusionpackage.json
HighKnown Malware Source Similaritycode-tool.js
HighKnown Malware Source Similaritycode-tool.mjs
HighKnown Malware Source Similaritysrc/code-tool.ts
HighKnown Malware Source Similaritycode-tool-worker.js
HighKnown Malware Source Similarityinstructions.js
HighKnown Malware Source Similaritylocal-docs-search.js
HighPrevious Version Dangerous Deltacode-tool.js
MediumDynamic Requireinstructions.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @roarkanalytics/sdk-mcp@3.1.0.
See all versions of @roarkanalytics/sdk-mcp for other recorded verdicts.
- Review the evidence and your use of @roarkanalytics/sdk-mcp@3.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.