registry / @roarkanalytics/sdk-mcp / 3.34.1

@roarkanalytics/sdk-mcp@3.34.1

The official MCP Server for the Roark API

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Source is a first-party Roark MCP server with no lifecycle hooks; credential posts to api.stainless.com live only in a retired remote sandbox that the CLI rejects in favor of local Deno. Similarity hits are the shared Stainless MCP template plus an embedded docs index, not a hidden attack.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A user runs the mcp-server binary or imports the library to start an MCP server.

Impact

No confirmed malicious impact on install or default CLI use.

Mechanism

Documented MCP code-mode and docs search, not a hidden install or exfil chain

AI rationale

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

A leftover remote code-tool path still posts the Roark bearer token to api.stainless.com when execution mode is not local.
On server start, instructions are fetched from the Stainless instructions URL unless a local file is configured.
The Deno worker evaluates agent-supplied TypeScript through a data-URL import, which is the documented code tool.
Several files match a shared Stainless MCP template that scanners have previously labeled malicious by similarity.

Evidence against

package.json has no preinstall, install, or postinstall scripts; the process starts only when the mcp-server binary is the main module.
The CLI defaults code execution and docs search to local and rejects the retired stainless-sandbox mode.
Network calls go to api.stainless.com and Roark or Stainless docs hosts as part of this official MCP server.
local-docs-search.js is an embedded MiniSearch index of SDK documentation, not a hidden payload.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVars

Source & flagged code

11 flagged

instructions.jsView file

•matchType = normalized_sha256 matchedPackage = plumery-mcp@3.9.0 matchedPath = instructions.js matchedIdentity = npm:cGx1bWVyeS1tY3A:3.9.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

instructions.jsView on unpkg

7exports.getInstructions = getInstructions; L8: const promises_1 = __importDefault(require("fs/promises")); L9: const logger_1 = require("./logger.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

instructions.jsView on unpkg · L7

code-tool.jsView file

52Source sends the broad process environment to a literal external destination. L52: interfaceType: 'PHONE', L53: recordingUrl: 'https://example.com', L54: startedAt: 'startedAt', ... L155: }, L156: body: JSON.stringify({ L157: project_name: 'roark-analytics', ... L166: } L167: throw new Error(`${res.status}: ${res.statusText} error when trying to contact Code Tool server. Details: ${await res.text()}`); L168: } ... L214: // Check if deno is in PATH L215: const { execSync, spawn } = await Promise.resolve().then(() => __importStar(require('node:child_process'))); L216: try {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

code-tool.jsView on unpkg · L52

•matchType = normalized_sha256 matchedPackage = @roarkanalytics/sdk-mcp@3.24.0 matchedPath = code-tool.js matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:3.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool.jsView on unpkg

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•Remote tarball dependency specs: jq-web@https://github.com/stainless-api/jq-web/releases/download/v0.8.8/jq-web.tar.gz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

code-tool.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

code-tool.js#virtual:normalized:round1View on unpkg

code-tool.mjsView file

•matchType = normalized_sha256 matchedPackage = @roarkanalytics/sdk-mcp@3.24.0 matchedPath = code-tool.mjs matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:3.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool.mjsView on unpkg

src/code-tool.tsView file

•matchType = normalized_sha256 matchedPackage = @roarkanalytics/sdk-mcp@3.24.0 matchedPath = src/code-tool.ts matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:3.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/code-tool.tsView on unpkg

code-tool-worker.jsView file

•matchType = token_shingles matchedPackage = plumery-mcp@3.9.0 matchedPath = code-tool-worker.js matchedIdentity = npm:cGx1bWVyeS1tY3A:3.9.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool-worker.jsView on unpkg

local-docs-search.jsView file

•matchType = token_shingles matchedPackage = @roarkanalytics/sdk-mcp@3.24.0 matchedPath = local-docs-search.js matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:3.24.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

local-docs-search.jsView on unpkg

Source & flagged code

11 flagged · loading source

instructions.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

instructions.jsView on unpkg

7exports.getInstructions = getInstructions; L8: const promises_1 = __importDefault(require("fs/promises")); L9: const logger_1 = require("./logger.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

instructions.jsView on unpkg · L7

code-tool.jsView file

Findings

2 Critical7 High5 Medium4 Low

CriticalHardcoded Runtime Data Exfiltrationcode-tool.js

CriticalManifest Confusionpackage.json

HighSemantic Analysis Limitedcode-tool.js#virtual:normalized:round1

HighKnown Malware Source Similaritycode-tool.js

HighKnown Malware Source Similaritycode-tool.mjs

HighKnown Malware Source Similaritysrc/code-tool.ts

HighKnown Malware Source Similaritycode-tool-worker.js

HighKnown Malware Source Similarityinstructions.js

HighKnown Malware Source Similaritylocal-docs-search.js

MediumDynamic Requireinstructions.js

MediumNetwork

MediumEnvironment Vars

Affected versions and remediation

This report applies to @roarkanalytics/sdk-mcp@3.34.1.

See all versions of @roarkanalytics/sdk-mcp for other recorded verdicts.

Review the evidence and your use of @roarkanalytics/sdk-mcp@3.34.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-18 02:42:46.378Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.