registry / Credential exfiltration / @roarkanalytics/sdk-mcp / 4.15.0

@roarkanalytics/sdk-mcp@4.15.0

The official MCP Server for the Roark API

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The remote handler forwards an existing Roark bearer token to a configurable endpoint with no destination validation. Because the CLI defaults to local mode and the transfer requires remote mode, this supports a warning rather than a publish block.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A caller invokes the remote handler with a Roark client and remote execution mode.

Impact

If configured to an unintended endpoint, the recipient can receive the Roark bearer token.

Mechanism

The handler places the token in a client environment object and POSTs it to CODE_MODE_ENDPOINT_URL, which has no destination restriction.

AI rationale

Evidence

code-tool.jsoptions.js

Network endpoints1

api.stainless.com/api/ai/code-tool

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

In remote mode, code-tool.js reads the Roark bearer token from the client or environment and selects CODE_MODE_ENDPOINT_URL without restricting its destination.
The remote handler POSTs the merged client environment, including that bearer token, in the x-stainless-mcp-client-envs header.
The CLI defaults code execution to local mode; the credential transfer is conditional on remote mode.

Evidence against

The default remote endpoint is api.stainless.com, and the CLI defaults to local execution.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 53 file(s), 3.16 MB of source, external domains: api.roark.ai, api.stainless.com, bun.sh, cursor.com, deno.land, docs.deno.com, docs.pydantic.dev, docs.python.org, docs.roark.ai, endoflife.date, example.com, github.com, img.shields.io, jsr.io, my.test.proxy.example.com, my.test.server.example.com, npmjs.org, pypi.org, raw.githubusercontent.com, semver.org, vscode.stainless.com, www.github.com, www.npmjs.com, www.python-httpx.org, www.stainless.com

Source & flagged code

12 flagged

code-tool.mjsView file

Lines 215-255javascript

215 throw new Error(`deno-http-worker did not grant the worker socket ${socketPath} on ${missing.join(' or ')}, ` +

216 'so the Deno sandbox would not be able to serve requests.');

217 }

218 if (!addSocketToAllowNet)

219 return spawnArgs;

220 return spawnArgs.map((arg) => (arg.startsWith('--allow-net=') ? `${arg},unix:${socketPath}` : arg));

221};

222const localDenoHandler = async ({ reqContext, args, }) => {

223 const fs = await import('node:fs');

224 const path = await import('node:path');

225 const url = await import('node:url');

226 const { newDenoHTTPWorker } = await import('@valtown/deno-http-worker');

227 const { getWorkerPath } = await import('./code-tool-paths.cjs');

228 const workerPath = getWorkerPath();

229 const client = reqContext.client;

230 const baseURLHostname = new URL(client.baseURL).hostname;

231 const { code } = args;

232 let denoPath;

233 const packageRoot = path.resolve(path.dirname(workerPath), '..');

234 const packageNodeModulesPath = path.resolve(packageRoot, 'node_modules');

235 // Check if deno is in PATH

236 const { execSync, spawn, spawnSync } = await import('node:child_process');

237 try {

High

Child Process

Package source references child process execution.

code-tool.mjsView on unpkg · L235

238 execSync('command -v deno', { stdio: 'ignore' });

239 denoPath = 'deno';

240 }

241 catch {

242 try {

243 // Use deno binary in node_modules if it's found

244 const denoNodeModulesPath = path.resolve(packageNodeModulesPath, 'deno', 'bin.cjs');

245 await fs.promises.access(denoNodeModulesPath, fs.constants.X_OK);

246 denoPath = denoNodeModulesPath;

247 }

248 catch {

249 return asErrorResult('Deno is required for code execution but was not found. ' +

250 'Install it from https://deno.land or run: npm install deno');

251 }

252 }

253 const allowReadPaths = [

254 'code-tool-worker.mjs',

255 `${workerPath.replace(/([\/\\]node_modules)[\/\\].+$/, '$1')}/`,

instructions.jsView file

Lines 1-27javascript

1"use strict";

2// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.

3var __importDefault = (this && this.__importDefault) || function (mod) {

4 return (mod && mod.__esModule)

code-tool.mjs#virtual:normalized:round1View file

173const allowRead = allowReadPaths.join(","); L174: const addSocketToAllowNet = denoAcceptsUnixAllowNet(denoPath, (command, probeArgs) => spawnSync(command, probeArgs, { L175: stdio: "ignore", L176: // spawnSync blocks, so an unbounded probe would hang the server rather than L177: // fail one call. Deno"s first run can populate its cache directory, hence\n // seconds rather than milliseconds, and DENO_NO_UPDATE_CHECK keeps a version\n // check ... L178: // is added to this same allowlist by scopeAllowNetToWorkerSocket below, on the ... L184: ], L185: // deno-http-worker picks the worker"s Unix socket path while it builds the spawn\n // arguments, so it is not known when runFlags are constructed above. Intercept the\n ... L186: };

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

code-tool.mjs#virtual:normalized:round1View on unpkg · L173

146/** L147: * Whether this Deno wants the worker"s Unix socket named in `--allow-net`.\n *\n * Deno changed its mind about this, and the two behaviors are mutually exclusive:\n *\n * Deno 2.... L148: const denoNodeModulesPath = path.resolve(packageNodeModulesPath, "deno", "bin.cjs"); ... L152: catch { L153: return asErrorResult("Deno is required for code execution but was not found. Install it from https://deno.land or run: npm install deno"); L154: }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

code-tool.mjs#virtual:normalized:round1View on unpkg · L146

package.jsonView file

Lines 1-40json

2 "name": "@roarkanalytics/sdk-mcp",

3 "version": "4.15.0",

4 "description": "The official MCP Server for the Roark API",

5 "author": "Roark <james@roark.ai>",

code-tool.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

code-tool.js#virtual:normalized:round1View on unpkg

code-tool-worker.jsView file

•matchType = token_shingles matchedPackage = plumery-mcp@3.9.0 matchedPath = code-tool-worker.js matchedIdentity = npm:cGx1bWVyeS1tY3A:3.9.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool-worker.jsView on unpkg

local-docs-search.jsView file

•matchType = token_shingles matchedPackage = @roarkanalytics/sdk-mcp@3.24.0 matchedPath = local-docs-search.js matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:3.24.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

local-docs-search.jsView on unpkg

code-tool.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @roarkanalytics/sdk-mcp@4.10.0 matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:4.10.0 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

code-tool.jsView on unpkg

Source & flagged code

12 flagged · loading source

code-tool.mjsView file

235// Check if deno is in PATH L236: const { execSync, spawn, spawnSync } = await import('node:child_process'); L237: try {

High

Child Process

Package source references child process execution.

code-tool.mjsView on unpkg · L235

instructions.jsView file

•matchType = normalized_sha256 matchedPackage = plumery-mcp@3.9.0 matchedPath = instructions.js matchedIdentity = npm:cGx1bWVyeS1tY3A:3.9.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

instructions.jsView on unpkg

7exports.getInstructions = getInstructions; L8: const promises_1 = __importDefault(require("fs/promises")); L9: const logger_1 = require("./logger.js");

Medium

Dynamic Require

Findings

2 Critical8 High4 Medium4 Low

CriticalManifest Confusionpackage.json

CriticalPrevious Version Dangerous Deltacode-tool.js

HighChild Processcode-tool.mjs

HighSame File Env Network Executioncode-tool.mjs#virtual:normalized:round1

HighCommand Output Exfiltrationcode-tool.mjs#virtual:normalized:round1

HighTrigger Reachable Command Output Exfiltrationcode-tool.mjs#virtual:normalized:round1

HighSemantic Analysis Limitedcode-tool.js#virtual:normalized:round1

HighKnown Malware Source Similaritycode-tool-worker.js

HighKnown Malware Source Similarityinstructions.js

HighKnown Malware Source Similaritylocal-docs-search.js

MediumDynamic Require

Affected versions and remediation

This report applies to @roarkanalytics/sdk-mcp@4.15.0.

See all versions of @roarkanalytics/sdk-mcp for other recorded verdicts.

Review the evidence and your use of @roarkanalytics/sdk-mcp@4.15.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 15:38:00.344Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.