registry / @roarkanalytics/sdk-mcp / 4.1.0
@roarkanalytics/sdk-mcp@4.1.0
The official MCP Server for the Roark API
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is a Stainless-generated Roark MCP server whose CLI defaults code execution to a local Deno sandbox and rejects the retired remote sandbox. Child process, dynamic import, and outbound fetch are tied to that user-invoked tool and to docs or instruction loading, with no install hook or hidden exfiltration on the active entrypoint.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user starts the mcp-server binary or an agent calls the execute tool.
Impact
The agent can call the Roark API with the configured bearer token. No unsolicited credential export or install mutation was found on the CLI path.
Mechanism
Caller TypeScript is evaluated in a Deno worker whose network allowlist is the Roark client hostname. The CLI sets code execution mode to local.
AI rationale
This is a Stainless-generated Roark MCP server whose CLI defaults code execution to a local Deno sandbox and rejects the retired remote sandbox. Child process, dynamic import, and outbound fetch are tied to that user-invoked tool and to docs or instruction loading, with no install hook or hidden exfiltration on the active entrypoint.
Network endpoints2
api.stainless.com/api/ai/instructions/roark-analyticsapi.stainless.com/api/ai/code-tool
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with medium false-positive risk.
Evidence for AI clean decision
- package.json has no preinstall, install, or postinstall hook; the bin entry is the MCP server at index.js.
- The CLI code-execution-mode option defaults to local and rejects stainless-sandbox before tools start.
- The local execute path runs caller code in Deno with network limited to the Roark client hostname.
- The worker loads TypeScript only from the execute tool argument via a data URL import.
- Instructions and docs search serve MCP help text; the default docs index is embedded method data.
Evidence against
- A remote handler can POST ROARK_API_BEARER_TOKEN to CODE_MODE_ENDPOINT_URL or api.stainless.com, but the CLI default is local and stainless-sandbox is rejected.
- selectTools still falls back to stainless-sandbox only when a library caller omits the mode.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
12 flagged · loading sourceinstructions.jsView file
•matchType = normalized_sha256
matchedPackage = plumery-mcp@3.9.0
matchedPath = instructions.js
matchedIdentity = npm:cGx1bWVyeS1tY3A:3.9.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
instructions.jsView on unpkg7exports.getInstructions = getInstructions;
L8: const promises_1 = __importDefault(require("fs/promises"));
L9: const logger_1 = require("./logger.js");
Medium
Dynamic Require
Package source references dynamic require/import behavior.
instructions.jsView on unpkg · L7code-tool.jsView file
52Source sends the broad process environment to a literal external destination.
L52: interfaceType: 'PHONE',
L53: recordingUrl: 'https://example.com',
L54: startedAt: 'startedAt',
...
L155: },
L156: body: JSON.stringify({
L157: project_name: 'roark-analytics',
...
L166: }
L167: throw new Error(`${res.status}: ${res.statusText} error when trying to contact Code Tool server. Details: ${await res.text()}`);
L168: }
...
L214: // Check if deno is in PATH
L215: const { execSync, spawn } = await Promise.resolve().then(() => __importStar(require('node:child_process')));
L216: try {
Findings
2 Critical8 High5 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationcode-tool.js
CriticalManifest Confusionpackage.json
HighSemantic Analysis Limitedcode-tool.js#virtual:normalized:round1
HighKnown Malware Source Similaritycode-tool.js
HighKnown Malware Source Similaritycode-tool.mjs
HighKnown Malware Source Similaritysrc/code-tool.ts
HighKnown Malware Source Similaritycode-tool-worker.js
HighKnown Malware Source Similarityinstructions.js
HighKnown Malware Source Similaritylocal-docs-search.js
HighPrevious Version Dangerous Deltacode-tool-worker.js
MediumDynamic Requireinstructions.js
Affected versions and remediation
This report applies to @roarkanalytics/sdk-mcp@4.1.0.
See all versions of @roarkanalytics/sdk-mcp for other recorded verdicts.
- Review the evidence and your use of @roarkanalytics/sdk-mcp@4.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.