registry / @roarkanalytics/sdk-mcp / 3.33.0
@roarkanalytics/sdk-mcp@3.33.0
The official MCP Server for the Roark API
AI Security Review
scanned 1mo ago · by lpm-firewall-aiScanner malice labels come from a shared Stainless MCP template and leftover remote-sandbox code, not from a hidden exfil or install hook. The published CLI defaults to local Deno execution, rejects the retired Stainless sandbox, and has no lifecycle scripts.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
A user runs the mcp-server binary or imports the MCP server after install.
Impact
No confirmed malicious impact; agent-driven SDK calls use the user's own Roark token as designed.
Mechanism
User-invoked MCP code and docs tools for the Roark API
AI rationale
Scanner malice labels come from a shared Stainless MCP template and leftover remote-sandbox code, not from a hidden exfil or install hook. The published CLI defaults to local Deno execution, rejects the retired Stainless sandbox, and has no lifecycle scripts.
Decision evidence
public snapshotAI called this Clean at 88.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- code-tool.js still has a retired remote handler that would POST ROARK_API_BEARER_TOKEN to api.stainless.com when execution mode is not local.
- The same remote handler is present in code-tool.mjs and src/code-tool.ts.
- instructions.js GETs MCP prompt text from api.stainless.com when the server starts.
- code-tool-worker.js dynamically imports agent-supplied TypeScript in the local Deno worker.
- local-docs-search.js is a large generated Roark API docs index; the scanner treated that Stainless MCP template as malware-similar.
Evidence against
- package.json has no preinstall, install, or postinstall scripts; the only bin is user-run mcp-server.
- CLI defaults code-execution-mode to local and throws if stainless-sandbox is requested, so the published entrypoint does not send the Roark token to Stainless.
- Docs search defaults to the shipped local MiniSearch index, not the hosted Stainless search API.
- Network hosts are vendor-aligned (api.stainless.com, api.roark.ai) and there is no obfuscation, persistence, or agent-config write.
- Scanner similarity is shared Stainless MCP server code, not a unique hidden payload.
Source & flagged code
11 flagged · loading sourceinstructions.jsView file
•matchType = normalized_sha256
matchedPackage = plumery-mcp@3.9.0
matchedPath = instructions.js
matchedIdentity = npm:cGx1bWVyeS1tY3A:3.9.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
instructions.jsView on unpkg7exports.getInstructions = getInstructions;
L8: const promises_1 = __importDefault(require("fs/promises"));
L9: const logger_1 = require("./logger.js");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
instructions.jsView on unpkg · L7code-tool.jsView file
52Source sends the broad process environment to a literal external destination.
L52: interfaceType: 'PHONE',
L53: recordingUrl: 'https://example.com',
L54: startedAt: 'startedAt',
...
L155: },
L156: body: JSON.stringify({
L157: project_name: 'roark-analytics',
...
L166: }
L167: throw new Error(`${res.status}: ${res.statusText} error when trying to contact Code Tool server. Details: ${await res.text()}`);
L168: }
...
L214: // Check if deno is in PATH
L215: const { execSync, spawn } = await Promise.resolve().then(() => __importStar(require('node:child_process')));
L216: try {
Findings
2 Critical7 High5 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationcode-tool.js
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limitedcode-tool.js#virtual:normalized:round1
HighKnown Malware Source Similaritycode-tool.js
HighKnown Malware Source Similaritycode-tool.mjs
HighKnown Malware Source Similaritysrc/code-tool.ts
HighKnown Malware Source Similaritycode-tool-worker.js
HighKnown Malware Source Similarityinstructions.js
HighKnown Malware Source Similaritylocal-docs-search.js
MediumDynamic Requireinstructions.js
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to @roarkanalytics/sdk-mcp@3.33.0.
See all versions of @roarkanalytics/sdk-mcp for other recorded verdicts.
- Review the evidence and your use of @roarkanalytics/sdk-mcp@3.33.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.