@roarkanalytics/sdk-mcp@3.30.0
The official MCP Server for the Roark API
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource inspection does not establish malicious intent or install-time abuse, but it does establish a credential-forwarding remote default for library consumers. Treat it as a high-risk vulnerability requiring a warning.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A caller uses selectTools or initMcpServer without codeExecutionMode and invokes the execute MCP tool.
Impact
Credentials and arbitrary upstream environment values can be disclosed to api.stainless.com.
Mechanism
Remote forwarding of credentials and environment values in an HTTP header.
AI rationale
Source inspection does not establish malicious intent or install-time abuse, but it does establish a credential-forwarding remote default for library consumers. Treat it as a high-risk vulnerability requiring a warning.
Evidence
src/server.tssrc/code-tool.ts
Network endpoints1
api.stainless.com/api/ai/code-tool
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
- The exported tool selector defaults callers without options to the retired remote Stainless execution mode.
- That remote mode sends the Roark bearer token and caller-supplied upstream environment values to api.stainless.com.
Evidence against
- The CLI explicitly defaults to local Deno execution and rejects the remote mode.
- There are no npm install lifecycle hooks.
- The network behavior is part of the MCP code-execution feature, not hidden import-time activity.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged · loading sourceinstructions.jsView file
•matchType = normalized_sha256
matchedPackage = cas-parser-node-mcp@1.17.1
matchedPath = instructions.js
matchedIdentity = npm:Y2FzLXBhcnNlci1ub2RlLW1jcA:1.17.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
instructions.jsView on unpkg7exports.getInstructions = getInstructions;
L8: const promises_1 = __importDefault(require("fs/promises"));
L9: const logger_1 = require("./logger.js");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
instructions.jsView on unpkg · L7code-tool.jsView file
52Source sends the broad process environment to a literal external destination.
L52: interfaceType: 'PHONE',
L53: recordingUrl: 'https://example.com',
L54: startedAt: 'startedAt',
...
L155: },
L156: body: JSON.stringify({
L157: project_name: 'roark-analytics',
...
L166: }
L167: throw new Error(`${res.status}: ${res.statusText} error when trying to contact Code Tool server. Details: ${await res.text()}`);
L168: }
...
L214: // Check if deno is in PATH
L215: const { execSync, spawn } = await Promise.resolve().then(() => __importStar(require('node:child_process')));
L216: try {
Findings
2 Critical8 High5 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationcode-tool.js
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limitedcode-tool.js#virtual:normalized:round1
HighKnown Malware Source Similaritycode-tool.js
HighKnown Malware Source Similaritycode-tool.mjs
HighKnown Malware Source Similaritysrc/code-tool.ts
HighKnown Malware Source Similaritycode-tool-worker.js
HighKnown Malware Source Similarityinstructions.js
HighKnown Malware Source Similaritylocal-docs-search.js
HighPrevious Version Dangerous Deltalocal-docs-search.js
MediumDynamic Requireinstructions.js
Affected versions and remediation
This report applies to @roarkanalytics/sdk-mcp@3.30.0.
See all versions of @roarkanalytics/sdk-mcp for other recorded verdicts.
- Review the evidence and your use of @roarkanalytics/sdk-mcp@3.30.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.