registry / Credential exfiltration / @roarkanalytics/sdk-mcp / 4.19.0

@roarkanalytics/sdk-mcp@4.19.0

The official MCP Server for the Roark API

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The programmatic server API defaults to hosted execution and forwards the Roark bearer token to api.stainless.com. The CLI defaults to local execution and rejects hosted mode, so this is a conditional credential exposure rather than evidence of malicious intent.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A consumer calls the exported selectTools API without specifying codeExecutionMode, then invokes the execute tool.

Impact

The hosted endpoint receives a Roark API credential that can authorize API access. The source does not establish how the endpoint handles the credential.

Mechanism

The server defaults to stainless-sandbox and POSTs the token sourced from the environment or client to https://api.stainless.com/api/ai/code-tool in the x-stainless-mcp-client-envs header. CODE_MODE_ENDPOINT_URL can override the destination.

AI rationale

Evidence

package.jsonserver.jsserver.mjscode-tool.jscode-tool.mjsoptions.jsoptions.mjs

Network endpoints1

api.stainless.com/api/ai/code-tool

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The exported server API includes the code tool by default and selects stainless-sandbox when codeExecutionMode is omitted.
In non-local mode, the handler selects api.stainless.com as the default endpoint and sources ROARK_API_BEARER_TOKEN from the environment or SDK client.
The handler sends merged client environment values in the x-stainless-mcp-client-envs request header.
The package exposes the server module; its normal CLI defaults to local execution and rejects stainless-sandbox.

Evidence against

The regular CLI path defaults to local execution and rejects the hosted mode.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 53 file(s), 3.19 MB of source, external domains: api.roark.ai, api.stainless.com, bun.sh, cursor.com, deno.land, docs.deno.com, docs.pydantic.dev, docs.python.org, docs.roark.ai, endoflife.date, example.com, github.com, img.shields.io, jsr.io, my.test.proxy.example.com, my.test.server.example.com, npmjs.org, pypi.org, raw.githubusercontent.com, semver.org, vscode.stainless.com, www.github.com, www.npmjs.com, www.python-httpx.org, www.stainless.com

Source & flagged code

12 flagged

code-tool.mjsView file

235// Check if deno is in PATH L236: const { execSync, spawn, spawnSync } = await import('node:child_process'); L237: try {

High

Child Process

Package source references child process execution.

code-tool.mjsView on unpkg · L235

instructions.jsView file

•matchType = normalized_sha256 matchedPackage = plumery-mcp@3.9.0 matchedPath = instructions.js matchedIdentity = npm:cGx1bWVyeS1tY3A:3.9.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

instructions.jsView on unpkg

7exports.getInstructions = getInstructions; L8: const promises_1 = __importDefault(require("fs/promises")); L9: const logger_1 = require("./logger.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

instructions.jsView on unpkg · L7

code-tool.mjs#virtual:normalized:round1View file

173const allowRead = allowReadPaths.join(","); L174: const addSocketToAllowNet = denoAcceptsUnixAllowNet(denoPath, (command, probeArgs) => spawnSync(command, probeArgs, { L175: stdio: "ignore", L176: // spawnSync blocks, so an unbounded probe would hang the server rather than L177: // fail one call. Deno"s first run can populate its cache directory, hence\n // seconds rather than milliseconds, and DENO_NO_UPDATE_CHECK keeps a version\n // check ... L178: // is added to this same allowlist by scopeAllowNetToWorkerSocket below, on the ... L184: ], L185: // deno-http-worker picks the worker"s Unix socket path while it builds the spawn\n // arguments, so it is not known when runFlags are constructed above. Intercept the\n ... L186: };

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

code-tool.mjs#virtual:normalized:round1View on unpkg · L173

146/** L147: * Whether this Deno wants the worker"s Unix socket named in `--allow-net`.\n *\n * Deno changed its mind about this, and the two behaviors are mutually exclusive:\n *\n * Deno 2.... L148: const denoNodeModulesPath = path.resolve(packageNodeModulesPath, "deno", "bin.cjs"); ... L152: catch { L153: return asErrorResult("Deno is required for code execution but was not found. Install it from https://deno.land or run: npm install deno"); L154: }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

code-tool.mjs#virtual:normalized:round1View on unpkg · L146

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

•Remote tarball dependency specs: jq-web@https://github.com/stainless-api/jq-web/releases/download/v0.8.8/jq-web.tar.gz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

code-tool.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

code-tool.js#virtual:normalized:round1View on unpkg

code-tool-worker.jsView file

•matchType = token_shingles matchedPackage = plumery-mcp@3.9.0 matchedPath = code-tool-worker.js matchedIdentity = npm:cGx1bWVyeS1tY3A:3.9.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

code-tool-worker.jsView on unpkg

local-docs-search.jsView file

•matchType = token_shingles matchedPackage = @roarkanalytics/sdk-mcp@3.24.0 matchedPath = local-docs-search.js matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:3.24.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

local-docs-search.jsView on unpkg

code-tool.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @roarkanalytics/sdk-mcp@4.10.0 matchedIdentity = npm:QHJvYXJrYW5hbHl0aWNzL3Nkay1tY3A:4.10.0 similarity = 0.577 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

code-tool.jsView on unpkg

Source & flagged code

12 flagged · loading source

code-tool.mjsView file

235// Check if deno is in PATH L236: const { execSync, spawn, spawnSync } = await import('node:child_process'); L237: try {

High

Child Process

Package source references child process execution.

code-tool.mjsView on unpkg · L235

instructions.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

instructions.jsView on unpkg

7exports.getInstructions = getInstructions; L8: const promises_1 = __importDefault(require("fs/promises")); L9: const logger_1 = require("./logger.js");

Medium

Dynamic Require

Findings

2 Critical8 High4 Medium4 Low

CriticalManifest Confusionpackage.json

CriticalPrevious Version Dangerous Deltacode-tool.js

HighChild Processcode-tool.mjs

HighSame File Env Network Executioncode-tool.mjs#virtual:normalized:round1

HighCommand Output Exfiltrationcode-tool.mjs#virtual:normalized:round1

HighTrigger Reachable Command Output Exfiltrationcode-tool.mjs#virtual:normalized:round1

HighSemantic Analysis Limitedcode-tool.js#virtual:normalized:round1

HighKnown Malware Source Similaritycode-tool-worker.js

HighKnown Malware Source Similarityinstructions.js

HighKnown Malware Source Similaritylocal-docs-search.js

MediumDynamic Require

Affected versions and remediation

This report applies to @roarkanalytics/sdk-mcp@4.19.0.

See all versions of @roarkanalytics/sdk-mcp for other recorded verdicts.

Review the evidence and your use of @roarkanalytics/sdk-mcp@4.19.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-20 15:40:20.979Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.