registry / @roarkanalytics/sdk-mcp / 3.32.0
@roarkanalytics/sdk-mcp@3.32.0
The official MCP Server for the Roark API
AI Security Review
scanned 1mo ago · by lpm-firewall-aiScanner malware labels come from the shared Stainless MCP template and a leftover remote sandbox helper that still posts a Roark token to api.stainless.com. The published CLI defaults to local Deno, rejects stainless-sandbox, has no install hooks, and only talks to Roark and Stainless product endpoints when the user starts the MCP server.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user runs the mcp-server binary or npx, then an MCP client calls execute or search_docs.
Impact
No unconsented install-time change, secret theft, or persistence was found.
Mechanism
No confirmed malicious attack surface; remaining eval and network calls are the documented MCP Code Mode product.
AI rationale
Scanner malware labels come from the shared Stainless MCP template and a leftover remote sandbox helper that still posts a Roark token to api.stainless.com. The published CLI defaults to local Deno, rejects stainless-sandbox, has no install hooks, and only talks to Roark and Stainless product endpoints when the user starts the MCP server.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- code-tool still has a remote Stainless handler that POSTs the Roark bearer token to api.stainless.com.
- selectTools falls back to stainless-sandbox when a library caller omits codeExecutionMode.
- The Deno worker evaluates agent-supplied TypeScript through a data-URL import.
- Server startup can fetch MCP instructions from api.stainless.com.
- Several files match the shared Stainless MCP template, which scanners treat as previously seen malware.
- local-docs-search ships a large generated API documentation corpus.
Evidence against
- package.json has no preinstall, install, or postinstall hooks; the only entry is the user-run mcp-server binary.
- CLI --code-execution-mode defaults to local and throws if stainless-sandbox is requested because that sandbox is retired.
- Network use is the documented Roark/Stainless Code Mode product (api.roark.ai, api.stainless.com), not a hidden receiver.
- child_process is used only to locate and spawn a Deno worker with network limited to the Roark API host.
- No agent-config writes, obfuscation, persistence, destructive behavior, or self-dependency install chain is present.
Source & flagged code
12 flagged · loading sourceinstructions.jsView file
•matchType = normalized_sha256
matchedPackage = plumery-mcp@3.9.0
matchedPath = instructions.js
matchedIdentity = npm:cGx1bWVyeS1tY3A:3.9.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
instructions.jsView on unpkg7exports.getInstructions = getInstructions;
L8: const promises_1 = __importDefault(require("fs/promises"));
L9: const logger_1 = require("./logger.js");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
instructions.jsView on unpkg · L7code-tool.jsView file
52Source sends the broad process environment to a literal external destination.
L52: interfaceType: 'PHONE',
L53: recordingUrl: 'https://example.com',
L54: startedAt: 'startedAt',
...
L155: },
L156: body: JSON.stringify({
L157: project_name: 'roark-analytics',
...
L166: }
L167: throw new Error(`${res.status}: ${res.statusText} error when trying to contact Code Tool server. Details: ${await res.text()}`);
L168: }
...
L214: // Check if deno is in PATH
L215: const { execSync, spawn } = await Promise.resolve().then(() => __importStar(require('node:child_process')));
L216: try {
Findings
2 Critical8 High5 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationcode-tool.js
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limitedcode-tool.js#virtual:normalized:round1
HighKnown Malware Source Similaritycode-tool.js
HighKnown Malware Source Similaritycode-tool.mjs
HighKnown Malware Source Similaritysrc/code-tool.ts
HighKnown Malware Source Similaritycode-tool-worker.js
HighKnown Malware Source Similarityinstructions.js
HighKnown Malware Source Similaritylocal-docs-search.js
HighPrevious Version Dangerous Deltalocal-docs-search.js
MediumDynamic Requireinstructions.js
Affected versions and remediation
This report applies to @roarkanalytics/sdk-mcp@3.32.0.
See all versions of @roarkanalytics/sdk-mcp for other recorded verdicts.
- Review the evidence and your use of @roarkanalytics/sdk-mcp@3.32.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.